The messaging protocol reference.
A precise, standards-based reference for the protocols that carry SMS — written for the engineers who wire them up. Grounded in the SMPP v3.4/v5.0 specifications and 3GPP TS 23.038 / 23.040, with real byte layouts, field tables and wire-format examples.
65 docs across 9 protocols
SMPP
The Short Message Peer-to-Peer protocol — the binary session protocol carriers and aggregators expose for high-throughput A2P messaging.
- Fundamentals
SMPP protocol overview
What SMPP is, how the ESME↔SMSC session works, the difference between v3.4 and v5.0, and why it remains the standard for high-throughput A2P SMS.
- Wire format
SMPP PDU anatomy: header and body
The exact byte layout of an SMPP PDU: the 16-byte header (command_length, command_id, command_status, sequence_number), the body, and how fields are encoded.
- Session
SMPP bind operations and session states
How an SMPP session authenticates: bind_transmitter, bind_receiver and bind_transceiver, the system_id/password/system_type fields, interface_version, session states and unbind.
- Operations
SMPP submit_sm: every mandatory field
A complete field-by-field reference for submit_sm — service_type, TON/NPI, esm_class, data_coding, registered_delivery, validity_period, short_message and the rest — with the values that actually matter.
- Operations
SMPP deliver_sm: MO messages and receipts
deliver_sm carries two things from SMSC to ESME: mobile-originated (MO) messages and delivery receipts. How to tell them apart with esm_class, and why you must always reply deliver_sm_resp.
- Errors
SMPP command_status error codes
The SMPP command_status field and the ESME_R* error range: what the common codes mean (ESME_RINVPASWD, ESME_RTHROTTLED, ESME_RMSGQFUL…) and how to react to each.
- Wire format
SMPP TLV optional parameters
SMPP's optional parameters use a Tag-Length-Value format. The TLV byte layout plus the common tags: message_payload, receipted_message_id, message_state, user_message_reference and the sar_* concatenation set.
- Operations
SMPP delivery receipts (DLR) format
The Appendix-B delivery-receipt text format inside deliver_sm: id, sub, dlvrd, submit date, done date, stat, err and Text — plus the stat keywords and their message_state numbers.
- Session
SMPP enquire_link, windowing and throttling
How SMPP keeps a session alive with enquire_link, how the window limits outstanding un-acked PDUs, and how ESME_RTHROTTLED and per-bind TPS govern your real throughput.
- Security
Securing SMPP: TLS, auth and IP allow-listing
SMPP has no native encryption. How to secure a bind in production: SMPP over TLS, credential and IP-based authentication, allow-listing, and credential hygiene.
- Fundamentals
SMPP v3.4 vs v5.0: what changed
The practical differences between SMPP v3.4 and v5.0: congestion control, broadcast operations, extra message states and TLVs — and why v3.4 is still the default interconnect.
- Integration
SMPP integration best practices
How to build an SMPP integration that stays reliable in production: bind strategy, sequence_number discipline, windowing, retries with backoff, idempotency, DLR handling and reconnection.
SMS encoding
How SMS text is encoded on the wire — GSM 7-bit, UCS-2, data-coding schemes, segmentation and the cost implications of every character.
- Character sets
The GSM-7 character set
The full GSM 7-bit default alphabet from GSM 03.38: the basic 128-character table, the escape-based extension table (| ^ € { } [ ] ~ \ and form-feed), and how 7-bit packing works.
- Character sets
UCS-2 and Unicode SMS
How SMS carries Unicode via UCS-2 (16-bit): the 70-character single-message limit, 67 per concatenated segment, what forces UCS-2, and the surrogate-pair caveat for emoji.
- Data coding
The data coding scheme (DCS)
The data-coding scheme byte that tells the network how an SMS is encoded: GSM-7 (0x00), 8-bit (0x04), UCS-2 (0x08), plus message classes (0/flash to 3/SIM) from GSM 03.38.
- Segmentation
SMS segmentation, concatenation and the UDH
How long SMS is split and reassembled: the 6-byte User Data Header, the resulting 153 (GSM-7) and 67 (UCS-2) characters per segment, the reference number and segment sequencing.
- Cost
Encoding detection and SMS cost
How to detect whether text is GSM-7 or UCS-2, which characters silently force UCS-2, and how encoding drives the segment count — and therefore the cost — of every SMS you send.
SS7 / MAP
Signalling System No. 7 and the MAP layer that carry mobile-terminated SMS, HLR queries and mobility management across legacy core networks.
- Fundamentals
SS7 stack overview: MTP, SCCP, TCAP, MAP, ISUP
How the SS7 stack is layered — MTP1-3 transport, SCCP addressing, TCAP transactions, and the MAP and ISUP user parts — and which layer does what for SMS, calls and mobility.
- Transport
MTP: the Message Transfer Part (levels 1-3)
The three MTP levels that transport SS7: MTP1 physical links, MTP2 error-controlled data link (MSU/LSSU/FISU signal units), and MTP3 routing by point code with load-sharing and network management.
- Addressing
SCCP, global title translation and subsystem numbers
How SCCP extends MTP3 with global-title addressing: the Called/Calling Party Address, Global Title Translation (GTT), subsystem numbers (HLR/VLR/MSC), and connectionless vs connection-oriented classes.
- Transactions
TCAP: transactions, dialogues and components
How TCAP structures SS7 application exchanges: the transaction sublayer (Begin/Continue/End/Abort with transaction IDs), the dialogue portion (application context), and the component sublayer (Invoke, ReturnResult, ReturnError, Reject).
- MAP
MAP operations: SRI-SM, ForwardSM, UpdateLocation and more
The MAP operations that run mobile networks: SendRoutingInfoForSM and MT-ForwardSM for SMS, UpdateLocation for roaming, ProvideSubscriberInfo and AnyTimeInterrogation for location — with their TS 29.002 opcodes.
- SMS delivery
SS7 MT-SMS delivery flow, step by step
The full mobile-terminated SMS path over SS7: SMSC to HLR SendRoutingInfoForSM, HLR returns IMSI + serving MSC, SMSC to MSC MT-ForwardSM, paging and delivery, and the absent-subscriber retry via MWD and AlertServiceCentre.
- Addressing
SS7 point codes and network addressing
How SS7 addresses signalling points: ITU-T 14-bit vs ANSI 24-bit point codes, their zone/network structure, the OPC/DPC/SLS routing label, and how point codes relate to SCCP global titles.
- Security
SS7 security threats and the GSMA FS.11 categories
The main SS7 attack classes — location tracking, SMS/OTP interception, call redirection and fraud — and how GSMA FS.11 categorises MAP messages (categories 1/2/3) so signalling firewalls can filter them.
- Fundamentals
SS7 vs SIGTRAN: TDM signalling over IP
How SIGTRAN relates to classic SS7: the same MTP3/SCCP/TCAP/MAP application layer, but carried over IP with SCTP and M3UA (or SUA) instead of TDM MTP1/MTP2 links.
SIGTRAN
SS7 signalling transported over IP — M3UA, SUA and SCTP — the bridge between TDM signalling and modern packet cores.
- Fundamentals
SIGTRAN overview: SS7 signalling over IP
What SIGTRAN is: the IETF framework (RFC 2719) for carrying SS7 signalling over IP, using SCTP transport and adaptation layers (M3UA, SUA, M2PA) that preserve the MTP3/SCCP/TCAP/MAP application stack.
- Transport
SCTP: Stream Control Transmission Protocol
How SCTP works and why SIGTRAN uses it: message-oriented delivery, multi-streaming to avoid head-of-line blocking, multi-homing for path failover, the chunk-based packet format, and how it differs from TCP.
- Adaptation
M3UA: MTP3-User Adaptation layer
How M3UA carries SCCP and ISUP over SCTP: the SG/ASP/AS roles, routing keys and routing contexts, message classes (Transfer, SSNM, ASPSM, ASPTM), and IPSP vs signalling-gateway modes.
- Adaptation
M2PA and SUA adaptation layers
Two more SIGTRAN adaptation layers: M2PA (RFC 4165) replaces MTP2 to build IP-based STP links running full MTP3, and SUA (RFC 3868) carries SCCP-users (TCAP/MAP) directly over SCTP, bypassing MTP3.
- Architecture
SIGTRAN deployment architecture: SG, ASP, AS
How a SIGTRAN network is built: the signalling gateway bridging TDM and IP, application servers and their processes, SCTP associations, and the redundancy modes (override, load-share, broadcast) that give carrier-grade availability.
SIP / VoIP
The Session Initiation Protocol behind programmable voice, SIP trunking and VoLTE call control, plus the media stack that rides alongside it.
- Fundamentals
SIP protocol overview
What SIP is and how it works: a text-based request/response signalling protocol (RFC 3261) that sets up, modifies and tears down media sessions, its user agents, proxies and registrars, and its transactions and dialogs.
- Requests
SIP methods and requests
Every SIP request method and what it does: the six core RFC 3261 methods (INVITE, ACK, BYE, CANCEL, REGISTER, OPTIONS) and the common extensions (INFO, PRACK, UPDATE, SUBSCRIBE/NOTIFY, REFER, MESSAGE, PUBLISH).
- Responses
SIP response codes (1xx-6xx)
The six classes of SIP response code and the ones that matter: 1xx provisional (100 Trying, 180 Ringing), 2xx success (200 OK), 3xx redirection, 4xx client error (404, 486), 5xx server error and 6xx global failure.
- Messages
SIP headers: Via, From, To, Call-ID, CSeq, Contact
The essential SIP headers and what they do: Via (with the branch parameter) for routing responses, From/To with tags, Call-ID, CSeq, Contact, Max-Forwards, and how dialogs and transactions are identified from them.
- Media
SDP: the Session Description Protocol
How SDP describes a media session inside SIP: the v=/o=/s=/c=/t=/m=/a= line structure, the offer/answer model (RFC 3264), codec negotiation via rtpmap, and media direction attributes.
- Media
RTP and SRTP: the media stream
How the media flows once SIP has set up a call: the RTP header and payload, RTCP quality reports, and SRTP encryption and authentication with keying via SDES or DTLS-SRTP.
- Call flow
SIP call flow: INVITE to BYE
A complete SIP call walked step by step: INVITE with SDP offer, 100 Trying, 180 Ringing, 200 OK with SDP answer, the three-way ACK, RTP media, and BYE/200 OK teardown — plus how CANCEL aborts a ringing call.
- Deployment
SIP trunking and the session border controller
What a SIP trunk is and the role of the session border controller (SBC): NAT traversal with STUN/TURN/ICE, topology hiding via B2BUA, security and admission control at the network border, and transcoding.
DIAMETER
The AAA and signaling protocol behind 4G/5G mobility, policy and charging (S6a, Gx, Gy), IMS control (Cx/Sh) and Diameter roaming security at the IPX edge.
- Fundamentals
Diameter base protocol: RFC 6733 explained
How the Diameter base protocol works per RFC 6733: the 20-byte message header, command codes and R/P/E/T flags, the CER/CEA capabilities exchange, DWR/DWA watchdog and DPR/DPA disconnect, over SCTP or TCP/TLS.
- Message format
Diameter AVPs, data types and Result-Code
The anatomy of a Diameter AVP: code, V/M/P flags, length, optional Vendor-Id and data; the base data types (Enumerated, Unsigned32, OctetString, Address, Time); Grouped AVPs; and the Result-Code / Experimental-Result error model.
- Fundamentals
Diameter vs RADIUS: why Diameter replaced RADIUS
Why Diameter (RFC 6733) superseded RADIUS (RFC 2865) for carrier AAA: reliable SCTP transport and failover, capability negotiation, a far larger 32-bit AVP space, peer discovery, richer error handling and stronger security — with a comparison table and migration notes.
- Mobility (HSS)
Diameter S6a/S6d: LTE mobility to the HSS
How LTE mobility and subscription management run over Diameter S6a (MME↔HSS) and S6d (SGSN↔HSS) per 3GPP TS 29.272: ULR/ULA, AIR/AIA, CLR/CLA, PUR/PUA and IDR/IDA, EPS-AKA authentication vectors, and the SS7 MAP operations they replace.
- Policy & charging
Diameter Gx and Gy: policy and charging control
How Diameter carries Policy and Charging Control: Gx (PCEF↔PCRF, CCR/CCA installing PCC rules), Gy (online charging to the OCS with quota), and Rf (offline charging to the CDF) — plus the PCRF/PCEF/OCS/OFCS roles, QoS/QCI and Sy/Sd interfaces.
- IMS
Diameter Cx/Dx and Sh: IMS registration and the HSS
How IMS registration and authentication run over Diameter Cx/Dx (S-CSCF/I-CSCF↔HSS) per 3GPP TS 29.228/29.229 — UAR/UAA, MAR/MAA, SAR/SAA, LIR/LIA — plus the Sh interface (AS↔HSS) and how these tie to SIP REGISTER.
- Security
Diameter roaming security: DRA, DEA and the IPX border
How Diameter routing and interconnect security work at the roaming border: the Diameter Routing Agent (DRA) and Diameter Edge Agent (DEA), realm-based routing, the FS.19 threat classes (info disclosure, location tracking, fraud), topology hiding and AVP filtering.
Messaging channels
The application-layer messaging channels enterprises send on: RCS Business Messaging / MaaP, WhatsApp Business Cloud API, MMS (MM1/MM4/MM7), verified & branded sender, and channel fallback orchestration.
- RCS
RCS Business Messaging and the MaaP platform
How RCS Business Messaging works: the GSMA Universal Profile (RCC.07), the Messaging-as-a-Platform architecture (RCC.71), verified agents, capability discovery, MO/MT flows and billing events — and how the RBM agent API differs from an SMPP bind.
- WhatsApp
WhatsApp Business Platform: Cloud API and templates
How the WhatsApp Business Platform works: Cloud API vs On-Premises API, template (HSM) messages vs session messages, the 24-hour customer service window, the marketing/utility/authentication categories, webhooks, phone-number quality tiers and opt-in.
- MMS
MMS architecture: the MM1, MM4 and MM7 interfaces
How MMS works per 3GPP TS 23.140 and OMA MMS: the MMSC/relay-server, MM1 (handset↔MMSC over WAP/HTTP), MM4 (MMSC↔MMSC over SMTP for inter-carrier), MM7 (VASP↔MMSC over SOAP/XML), MIME/SMIL content, size limits and A2P MMS.
- Trust & branding
Verified and branded sender messaging
How brands prove who they are across channels: RCS Verified Sender and verified business agents, GSMA sender-ID registration and brand verification, and VMC certificates with BIMI for verified logos in email — the controls that fight spoofing and impersonation.
- Decision matrix
RCS vs SMS vs WhatsApp: a channel decision matrix
A vendor-neutral comparison of RCS, SMS and WhatsApp for business messaging: features, reach and coverage, end-to-end encryption, read receipts and typing, rich media, cost models, fallback behaviour and regulatory constraints — with guidance on when to use which.
- Orchestration
Channel fallback and omnichannel orchestration
How omnichannel delivery cascades across channels: capability checks, RCS→SMS and WhatsApp→SMS fallback, least-cost versus best-experience routing, retry and timeout rules, and a unified delivery-receipt view that reconciles status across every channel.
- Interactive
Rich cards and interactive messaging
The interactive building blocks of RCS and WhatsApp: rich cards and carousels, suggested replies and actions, quick-reply buttons and list pickers — with example JSON payloads for each platform, plus UX and accessibility guidance.
Numbering & identity
The numbering and identity layer beneath every message and call: E.164 / MSISDN, MCC-MNC / PLMN codes, IMSI / IMEI subscriber identity, ENUM (E.164→URI) and mobile number portability routing.
- Public numbering
E.164 numbering and the MSISDN explained
How the ITU-T E.164 international numbering plan works: country calling codes, national destination code (NDC) and subscriber number, the 15-digit maximum, MSISDN structure, and how to normalise numbers to E.164 for A2P messaging.
- Network identity
MCC, MNC and PLMN codes explained (E.212)
How the ITU-T E.212 identification plan works: the 3-digit Mobile Country Code (MCC) and 2–3-digit Mobile Network Code (MNC) that combine into a PLMN identity, how they identify the home network, test ranges, and how MCC-MNC differs from the MSISDN's NDC.
- Subscriber identity
IMSI, IMEI and subscriber identity explained
The identities that distinguish a subscriber from a device: the IMSI (MCC+MNC+MSIN, E.212), the IMEI (TAC+serial), the Ki authentication key, temporary identities TMSI/GUTI, the SIM/USIM/eSIM (eUICC), and how the HLR maps MSISDN to IMSI.
- Number routing
ENUM: mapping E.164 numbers to URIs
How ENUM (IETF RFC 6116) maps E.164 telephone numbers to URIs through DNS: the reversed-digit e164.arpa domain, NAPTR records with regexp rewrite, and the difference between public (user) and private (carrier/infrastructure) ENUM for SIP and VoIP routing.
- Number routing
Mobile number portability and routing
How mobile number portability (MNP) breaks the link between a dialed number and its home network: routing numbers (RN), All-Call-Query vs Onward Routing, MNP databases and dips, and how HLR/MNP lookup drives least-cost routing and reliable delivery.
HTTP API & webhooks
The HTTP/REST layer above the wire protocols: REST messaging API design, webhook delivery & HMAC signature verification, status/inbound payloads, auth & signing, idempotency, rate limiting and problem+json errors — standards-grounded (RFC 9457/8288/6749, IETF drafts).
- API design
REST messaging API design: resources, methods, status codes
How a standards-based REST messaging API is modelled: a messages collection, HTTP methods and status-code semantics per RFC 9110, synchronous vs asynchronous send (202 Accepted plus a status callback), content negotiation and URL-vs-header versioning — with a REST-vs-SMPP tradeoff table.
- Webhooks
Webhook delivery and reliability: retries, ordering, dead-letter
The standard webhook/callback architecture and its reliability model: at-least-once delivery, exponential backoff with jitter on retries, delivery timeouts, ordering guarantees, dead-letter queues, idempotent consumers and endpoint health / circuit-breaking to protect a failing receiver.
- Security
Webhook signature verification: HMAC-SHA256 and replay protection
How to verify a webhook is authentic and untampered: HMAC-SHA256 over the raw body, the signature and timestamp headers, replay protection with a timestamp tolerance and nonce, constant-time comparison to defeat timing attacks, and safe secret rotation with overlapping keys.
- Webhooks
Message status (DLR) and inbound (MO) webhook payloads
The payload schemas for the two core messaging callbacks: the delivery-status (DLR) event with its message id, status enum, error reason and timestamps, and the inbound (MO) message event — plus an event-type taxonomy and how an HTTP DLR maps onto an SMPP deliver_sm receipt.
- Security
API authentication and request signing: tokens, HMAC, OAuth, mTLS
The standard ways to authenticate an HTTP messaging API: bearer tokens and API keys in the Authorization header, HMAC request signing over a canonical request, key scoping and rotation, mutual TLS, and OAuth 2.0 client-credentials for machine-to-machine access.
- Reliability
Idempotency and rate limiting: keys, 429, Retry-After, RateLimit
Two standards-track HTTP patterns for safe, well-behaved clients: the Idempotency-Key header (IETF draft) for exactly-once submission with a dedup window and response replay, and rate limiting — 429 with Retry-After, the RateLimit / RateLimit-Policy headers (IETF draft), token buckets and client backpressure.
- API design
API errors (problem+json) and pagination (cursor, Link header)
Two standards that keep an HTTP API predictable: RFC 9457 problem+json for machine-readable errors (type, title, status, detail, instance) with a retryable-vs-terminal taxonomy, and pagination — cursor vs offset, the RFC 8288 Link header for next/prev, and page-size limits.
From the spec to the wire.
These references describe the protocols BroadNet has operated at carrier grade since 2003 — across 200+ countries and 1,000+ operator connections. When you are ready to send, the docs and tools below take you from reading to shipping.