SS7 signaling inspection
One firewall on the signaling path. MAP, CAP and SCCP are decoded, normalized and scored against a single policy engine before any message reaches your SMSC, HLR or MSC.
Protocols
MAP·CAP·SCCP
Decode
Per-IE
Mode
Inline / OOB
SS7 SMS firewall · Operator-grade
SS7 firewall for signaling fraud and grey routes
Stop grey routes. Monetize A2P. Protect the signaling layer.
BroadNet's SS7 firewall stops signaling fraud and grey-route A2P traffic for mobile operators by inspecting SS7 signaling in-line, before it reaches the core network. An SS7 firewall with in-line MAP/SCCP filtering between the international STP and your core network. Sender ID control, route validation, SRI-SM cache filtering, content filtering and A2P monetization — all from a single signaling-layer firewall. Deployed at Tier-1 operators across the MENA region.
<5ms
Inspection latency
99.99%
In-line uptime
1,000+
MNO connections
Signaling stream · sample data
stp-edge-01 · mena-1Blocked
12,842
Allowed
184,902
Quarantined
317
Op · Origin GTVerdict
- AnyTimeInterrogationGT 882 16xxxxxCat 1BLOCK↳ Location tracking attempt
- MT-ForwardSMGT 971 50xxxxxCat 3ALLOW↳ SRI-SM cache match
- MT-ForwardSMGT 234 80xxxxxCat 2BLOCK↳ Spoofed origin · A2P leakage
- ProvideSubscriberInfoGT 7 921xxxxxCat 1BLOCK↳ Foreign HLR probe
- MO-ForwardSMGT 971 50xxxxxCat 3ALLOW↳ Sender ID registry match
- CAP InitialDPGT 850 2xxxxxxCat 3QUARANTINE↳ Wangiri pattern · velocity
- SendRoutingInfoGT 880 17xxxxxCat 1BLOCK↳ IRSF reconnaissance
FS.11 rule pack · v2026.1<5 ms / msg
Inspection latency
<5ms
Every MAP, CAP and SCCP unit decoded, scored and decided in-line at the STP
In-line uptime
99.99%
Active-active firewall pairs on the international signaling path
MNO connections
1,000+
Direct operator connections, direct binds in 86 countries, since 2003
Tier-1 operators
MENA
Deployed at Tier-1 operators across the MENA region
How it sits in the signaling plane
From international STP
to home core, in 5 hops.
One firewall on the international signaling path. Every MAP, CAP and SCCP unit is decoded per-IE, categorized against GSMA FS.11, and a verdict is returned in under five milliseconds. No re-route, no broken roaming.
- 01 · IngressInt'l STP
International SS7 (SIGTRAN, M3UA) links inbound from roaming partners and grey routes.
no added hop - 02 · DecodeSignaling firewall
MAP, CAP and SCCP per-IE decode. GT, AC, CdPA/CgPA, IMSI, MSISDN normalized for policy lookup.
decode < 0.8ms - 03 · ScoreFS.11 · SRI-SM
Category 1/2/3 classification, SRI-SM cache validation, sender-ID and route checks, velocity buckets.
score < 2.0ms - 04 · VerdictPolicy DSL
Allow · modify · quarantine · drop · monetize. Per-route, per-partner, per-subscriber. Maker-checker promoted rules.
verdict < 1.0ms - 05 · CoreHLR / SMSC / MSC
Only validated signaling reaches the home network. Quarantined messages mirrored for fraud team review.
total p99 < 5ms - ← signed audit · regulator export · NOC stream
01 · Ingress
Int'l STP
International SS7 (SIGTRAN, M3UA) links inbound from roaming partners and grey routes.
no added hop
02 · Decode
Signaling firewall
MAP, CAP and SCCP per-IE decode. GT, AC, CdPA/CgPA, IMSI, MSISDN normalized for policy lookup.
decode < 0.8ms
03 · Score
FS.11 · SRI-SM
Category 1/2/3 classification, SRI-SM cache validation, sender-ID and route checks, velocity buckets.
score < 2.0ms
04 · Verdict
Policy DSL
Allow · modify · quarantine · drop · monetize. Per-route, per-partner, per-subscriber. Maker-checker promoted rules.
verdict < 1.0ms
05 · Core
HLR / SMSC / MSC
Only validated signaling reaches the home network. Quarantined messages mirrored for fraud team review.
total p99 < 5ms
What the firewall does
Six layers, one signaling engine.
Decoded at the STP, scored in real time, and acted on in under five milliseconds. One signaling-layer engine handles MAP, CAP and SCCP; one policy DSL writes the rules; one audit store keeps the evidence.
GSMA FS.11 category enforcement
Out-of-the-box rule packs aligned with GSMA FS.11 for SS7 interconnect. Category 1 never crosses the network boundary; Category 2 is validated against home-network origin; Category 3 is velocity-scored per subscriber.
FS.11
Cat 1–3
Boundary
Cat 1 drop
Updates
Quarterly
Real-time threat scoring
Every message is fingerprinted across origin GT, SCCP CdPA/CgPA, application context and historical pattern. Anomaly scores feed a policy DSL that decides allow, modify, quarantine or drop in a single hop.
Scoring
Per-msg
Signals
Multi
Actions
5 verbs
Location-tracking detection
AnyTimeInterrogation, ProvideSubscriberInfo, ProvideSubscriberLocation and SendRoutingInfo abuse are caught at first contact. Foreign GTs probing for IMSI–MSC–VLR tuples are blocked before a single subscriber is geolocated.
ATI
Blocked
PSL
Origin-checked
SRI
Cache-validated
SMS fraud at the signaling layer
MT-ForwardSM is validated against a live SRI-SM cache by IMSI / MSC / SMSC tuple. Spoofed sender IDs, A2P leakage onto grey routes and SIM-swap reconnaissance are stopped before the SMSC sees them, not after.
SRI cache
24h TTL
Spoof
Blocked
A2P leak
Recovered
Forensic audit logging
Every signaling decision is committed to a tamper-evident audit store with HMAC-signed event chains. Regulator-ready exports, role-based dashboards and incident replays — your NOC sees what the firewall saw, frame-for-frame.
Retention
12 mo
Signed
HMAC
Export
Regulator
Threat catalog
What we see crossing your border.
The five signaling attack classes that account for most subscriber harm and most operator revenue loss — and the layer at which the firewall catches each one.
SMS spoofing
MAP · MT-ForwardSM
Originator addresses fabricated to impersonate banks, brands and government services. Caught by SRI-SM cache mismatch and sender-ID registry cross-check.
Location tracking
MAP · ATI / PSI / PSL
Foreign GTs query the HLR to triangulate a subscriber's serving cell. Blocked at the network boundary as GSMA FS.11 Category 1 messages.
SIM-swap reconnaissance
MAP · SendIMSI / UpdateLocation
Attackers probe for IMSI–MSC bindings ahead of social-engineered swaps. Pattern-scored per origin, then quarantined for fraud-team review.
Fraud calls and CLI spoofing
CAP · InitialDP / SS7 IAM
International revenue-share fraud, Wangiri loops and spoofed CLIs intercepted at the signaling layer before they ring the subscriber.
A2P leakage and grey routes
MAP · MT-ForwardSM
Unmonetized enterprise traffic injected via roaming partners. Forced onto the agreed commercial route — or blocked, with the revenue recovered.
Attack catalogue · MAP layer
Two MAP operations behind most signalling abuse.
Two MAP operations explain a disproportionate share of the subscriber-privacy and OTP-interception incidents reaching regulators today. The firewall handles both at the international edge — categorised, scored and signed — before they reach a home HLR or SMSC.
GSMA FS.11 Categories 1 & 2
FS.11 · Cat 1Boundary drop
MAP_PROVIDE_SUBSCRIBER_INFO
Location tracking
Foreign HLR probes that resolve to a serving cell ID, used by surveillance operators and abusers to triangulate a subscriber's real-world position. The firewall classifies these as GSMA FS.11 Category 1 and drops them at the network boundary, with a signed audit entry for the regulator file.
Operator impact · Subscriber-privacy compromise
FS.11 · Cat 2Boundary drop
MAP_SEND_ROUTING_INFO_FOR_SM
SMS interception groundwork
SRI-SM queries that map a subscriber to their serving MSC/SMSC, the reconnaissance step before MT-ForwardSM hijack of OTP and 2FA traffic. The firewall validates each query against a 24-hour SRI-SM cache; cache-miss queries from foreign GTs quarantine for fraud-team review.
Operator impact · OTP / 2FA bypass enablement
3-pillar rule engine
Technical. Business. Dynamic. One verdict.
The signalling layer needs protocol enforcement, commercial policy, and behaviour-aware adaptation in the same engine. The three pillars run as one decision path — sub-5 ms inspection latency per signalling unit — so the right verdict reaches the right network element on the first hop.
Pillar 01
Technical rules
Protocol-level enforcement at the signaling layer. MAP operation allow/deny, Global Title filtering, OPC/DPC point-code controls, MCC/MNC conditions per partner. Every malformed or out-of-context signaling unit drops at decode.
MAP allow/denyGT filterOPC/DPCMCC/MNC
Pillar 02
Business rules
Commercial and operational policy expressed as data. Route selection per partner agreement, product-class policies (OTP, transactional, promotional), monetisation of bypass traffic toward agreed A2P channels. The firewall enforces the contract, not just the spec.
Route policyPer-partnerOTP vs promoMonetise bypass
Pillar 03
Dynamic controls
Behaviour-aware enforcement that adapts to live traffic. TPS thresholds, burst detection, time-of-day windows, velocity per origin GT. The dynamic layer catches what static rules cannot — emerging campaigns, new SIM-box farms, sudden roaming anomalies.
TPS thresholdsBurst detectTime windowsVelocity
Sub-5 ms inspection latency
per signalling unit · decode + score + verdict
All common signalling vendorsActive-active STP pairsSIGTRAN M3UA · M2PA · SUAMAP · CAP · SCCP inspectionInline · in front of the SMSCOut-of-band tap option
Policy DSL
Rules your signaling engineers already think in.
FS.11 categorisation expressed as readable YAML. MAP and CAP operations named, not numbered. Sender-ID, route and A2P rules promoted through maker-checker — versioned, signed, auditable.
Example
# /etc/broadnet/ss7fw/rules.d/fs11-category1.yaml# GSMA FS.11 Category 1 — never crosses the network boundaryrule: cat1_ati_block match: application_context: anyTimeInterrogation origin: !is_home_network action: drop audit: regulator.signal_event fs_tag: FS.11-CAT1 rule: cat1_psi_block match: application_context: provideSubscriberInfo origin: !is_home_network action: drop fs_tag: FS.11-CAT1 # Category 2 — origin must be validated against home-network MAPrule: cat2_sri_sm_validate match: application_context: sendRoutingInfoForSM validate: msc_id: from sri_sm_cache(ttl=24h) on_mismatch: action: quarantine notify: fraud-ops@operator.tldIllustrative operator scenarios
What signaling protection
looks like in production.
Tier-1 GCC operatorMNO · GCC
- Challenge
- subscriber location-tracking probes were an active regulator concern with no domestic deterrent in place.
- Approach
- FS.11 categorization at the international SS7 edge, plus an SRI-SM cache for spoof detection.
Signaling security lead
Cat 1
Location probes blocked at edge
SRI-SM
Spoof detection live
West African MNO groupMNO · West Africa
- Challenge
- international STPs across multiple vendor stacks made the quarterly regulator return a manual exercise.
- Approach
- a single policy DSL unified rule enforcement across every edge with a versioned audit trail.
Network security lead
Unified
One rule pack, every STP edge
Quarantine
Grey-route SMS held for review
Levant MNOMNO · Levant
- Challenge
- the national regulator required FS.11 conformance evidence on short notice during an annual review.
- Approach
- rule-pack versioning produced a signed manifest plus an IR.71 / IR.82 regression report in a single run.
Senior signaling engineer
Signed
FS.11 conformance manifest
IR.82
Regression in one run
Where it sits
International signaling in. Clean traffic out.
Inline between the international STP and your core. Every message passes the firewall before it reaches an HLR, SMSC or MSC — and every decision is streamed to your NOC in real time.
Int'l STP
SS7 / SIGTRAN
Roaming partner
SS7 / MAP
Grey route
Untrusted GT
BroadNet Signaling Firewall
Active / ActiveDecode
Sender ID
Route check
SRI-SM cache
Content filter
Geo / origin
Rate limit
Policy DSL
Audit log
HLR
SMSC
MSC
Billing
Deployment options
In-line at the STP
Active-active pair sits on the international signaling path. Decisions are enforced in real time — block, allow, modify, monetize.
Out-of-band tap
Mirror feed from the STP for baseline establishment and analytics. Move to in-line enforcement when policy and false-positive rates stabilize.
Hybrid edge + core
International edge runs in-line, domestic core runs in detect-and-alert. Common policy plane, common audit store, one operator dashboard.
Compliance
Aligned with the standards your regulator already reads.
GSMA FS.11 categorization for SS7 interconnect is enforced by default and maintained by the BroadNet signaling security team, with regulator-ready exports on demand.
GSMA Associate Member
BroadNet is a GSMA Associate Member
GSMA FS.11
SS7 interconnect security categorization (Cat 1–3)
Revenue assurance
A2P monetization and grey-route recovery, built in
Regulator exports
Country-specific signaling reports on demand
Operator due diligence
Eight answers
for the RFI shortlist.
Yes. The firewall presents as an SCCP/SIGTRAN signaling peer and integrates with the common STP platforms operators run today, across mixed vendor stacks. No STP routing-table surgery is required beyond redirecting the international point codes through the firewall pair.
We almost always start with an out-of-band mirror from the STP for 14–30 days. That gives the security and RA teams a clean baseline of the international traffic and lets us tune the FS.11 rule pack against the operator's actual roaming-partner mix. Once the false-positive envelope is agreed in writing, the firewall flips to inline active-active. Hybrid (inline at the international edge, mirror at the domestic core) is the common steady state.
BroadNet's signaling security team publishes a versioned rule pack every quarter, with hot-fix patches for new threat intelligence pushed in days. Each rule pack ships with the IR.71, IR.81, and IR.82 conformance test packs so your team can run regression before promoting it. The operator pins or vetoes any version from the dashboard — nothing is auto-promoted to production.
Per inspected signaling unit (MAP/CAP), banded by monthly volume. No per-link, per-point-code or per-Erlang fee. There is a one-time NRE for the STP integration and a small annual maintenance fee covering rule-pack updates, the threat-intel feed, and quarterly architecture reviews. Operators typically see payback from recovered A2P revenue and avoided fraud loss.
Yes. The policy DSL is the same one our security team uses internally. Operators routinely write rules to enforce their bilateral roaming agreements, to whitelist authorized law-enforcement location queries, to monetise specific bypass flows rather than drop them, and to feed verdicts to in-house SIEM and fraud platforms. Custom rules go through the same maker-checker promotion as ours, with full audit trail.
TTL is 24h by default and tunable per operator. The cache is populated from observed legitimate SRI-SM and refreshed on every successful MT-ForwardSM. We expose hit rate, miss rate, and quarantine rate per partner GT so RA teams can spot a sudden cache miss spike (usually the first sign of a spoofing campaign or a partner re-keying their SMSC GT).
Yes. Every decision is HMAC-signed, written to a tamper-evident store, and retained for the operator's regulatory window. We ship pre-built export templates for TRC (Jordan), CST (KSA), NCC (Nigeria), TDRA (UAE), CRA (Qatar), TRA (Oman), TRA (Bahrain), ARPT (Algeria), ANRT (Morocco), and INT-T (Tunisia). The export module also produces the FS.11 conformance manifest that several MENA regulators now ask for at licence renewal.
In steady state, false positives against bona-fide roaming partners are very low. We measure the rate weekly and expose the per-partner number in the dashboard, so RA teams always see it. The mirror-mode bake-in phase exists exactly so that this envelope is agreed and signed off before enforcement goes live.
Need the FS.11 conformance manifest or a working session with our signaling engineers? Request signaling security review
Related operator products
All operator productsSMS firewall
Application-layer SMS firewall sitting on the SMPP interface to your SMSC.
Learn more
Signalling & CDR intelligence
Vendor-agnostic capture and correlation for SS7, SIGTRAN and SIP — the companion intelligence layer.
Learn more
SMSC gateway
Hosted SMSC with multi-routing, multi-language and unified billing.
Learn more
Performance system
Real-time observability across firewall, SMSC, signaling and routes.
Learn more
Signaling protection · operator-grade
Protect signaling. Stop grey routes.
Schedule an operator briefing. We'll walk the FS.11 categorization, the SRI-SM cache, the A2P monetization model, and the deployment plan for your network — backed by 24/7 BroadNet NOC support.
$ ss7fw --policy fs11 --mode inline --audit signed
Resources
SS7 Firewall datasheet
Related guides & answers
Go deeper on the concepts behind this product.