# ATG — Anti Traffic Generation in A2P firewalls

> ATG (Anti Traffic Generation) is the umbrella term for the set of techniques an operator-side SMS firewall uses to detect and stop artificially-generated SMS traffic — pumped OTPs, SIM-box-originated A2P, bot-driven smishing campaigns, and the various flavours of grey-route abuse that look like organic traffic but aren't. ATG is what stands between the operator's revenue and the always-evolving fraud market.

- Canonical URL: https://www.broadnet.me/answers/what-is-atg-firewall
- Language: en
- Last reviewed: 2026-10-01
- Publisher: BroadNet (https://www.broadnet.me)

## What it actually does

An ATG-equipped firewall fingerprints every inbound SMS along multiple axes: source IP / source SMPP account / source MSISDN reputation, destination MSISDN range concentration, content template clustering (the same templated message arriving at 50,000 numbers in a minute), per-source throughput vs historical baseline, and behavioural signatures (one-way traffic with no inbound, identical inter-arrival gaps consistent with a script). When a combination crosses threshold, the firewall blocks, throttles, or quarantines the traffic and writes an audit record. Modern ATG combines hard rules with ML-driven anomaly scoring.

## Why it matters commercially

Without ATG, operators lose A2P revenue to grey routes and SIM-box bypass; senders lose budget to AIT (artificial inflated traffic) pumping. ATG is the technical enforcement layer that makes A2P monetisation work — detect the abusive traffic, block or rate-limit it, offer the legitimate aggregator a direct A2P agreement at the wholesale rate. BroadNet's SMS Firewall (/operators/sms-firewall) ships with ATG modules covering SIM-box detection, AIT-pumping correlation, content-template clustering, and per-source-MSISDN behavioural scoring.

## Latency, scale, and compliance angle

ATG decisions are made inline at SMS-firewall scale — single-digit milliseconds added to the message path, hundreds of thousands of TPS sustained. False-positive rates matter enormously: an ATG that blocks 5% of legitimate traffic is worse than no ATG at all because customers lose trust in the network. Mature ATG ships in monitoring-mode first, builds the per-source baseline, then enforces. Compliance: ATG decisions are in scope for FS.11-style monitoring logs, and operators that share blocked-source reputation across the industry typically do so via GSMA T-FCS.

## Privacy and compliance considerations

ATG processes MSISDN, source/destination, content templates, and behavioural metadata — all of which becomes personal-data-adjacent the moment it's tied to an individual. Mature ATG deployments minimise the retained content (template hash, not full body), aggressively pseudonymise downstream analytics feeds, and keep the raw decision logs in operator-controlled storage with short retention. Cross-operator threat-sharing is typically done with hashed identifiers, not raw MSISDNs.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [What is SIM box fraud?](https://www.broadnet.me/answers/what-is-sim-box-fraud)
- [What is SMS pumping / artificial inflated traffic (AIT)?](https://www.broadnet.me/answers/what-is-sms-pumping)
- [What is A2P monetization?](https://www.broadnet.me/answers/what-is-a2p-monetization)
- [What is sender ID spoofing?](https://www.broadnet.me/answers/what-is-sender-id-spoofing)
- [SMS Firewall (operators)](https://www.broadnet.me/operators/sms-firewall)
- [SS7 Firewall](https://www.broadnet.me/operators/ss7-firewall)