# The messaging protocol reference.

- Canonical URL: https://www.broadnet.me/reference
- Language: en
- Last updated: 2026-10-21
- Publisher: BroadNet (https://www.broadnet.me)
- Markdown version of the page above, generated from the rendered page.

Protocol reference Standards-based

A precise, standards-based reference for the protocols that carry SMS — written for the engineers who wire them up. Grounded in the SMPP v3.4/v5.0 specifications and 3GPP TS 23.038 / 23.040, with real byte layouts, field tables and wire-format examples.

65 reference docs 9 protocols Cites SMPP.org & 3GPP

65 docs across 9 protocols

## SMPP

The Short Message Peer-to-Peer protocol — the binary session protocol carriers and aggregators expose for high-throughput A2P messaging.

- [Fundamentals SMPP protocol overview What SMPP is, how the ESME↔SMSC session works, the difference between v3.4 and v5.0, and why it remains the standard for high-throughput A2P SMS.](https://www.broadnet.me/reference/smpp-protocol-overview)
- [Wire format SMPP PDU anatomy: header and body The exact byte layout of an SMPP PDU: the 16-byte header (command_length, command_id, command_status, sequence_number), the body, and how fields are encoded.](https://www.broadnet.me/reference/smpp-pdu-anatomy)
- [Session SMPP bind operations and session states How an SMPP session authenticates: bind_transmitter, bind_receiver and bind_transceiver, the system_id/password/system_type fields, interface_version, session states and unbind.](https://www.broadnet.me/reference/smpp-bind-operations)
- [Operations SMPP submit_sm: every mandatory field A complete field-by-field reference for submit_sm — service_type, TON/NPI, esm_class, data_coding, registered_delivery, validity_period, short_message and the rest — with the values that actually matter.](https://www.broadnet.me/reference/smpp-submit-sm)
- [Operations SMPP deliver_sm: MO messages and receipts deliver_sm carries two things from SMSC to ESME: mobile-originated (MO) messages and delivery receipts. How to tell them apart with esm_class, and why you must always reply deliver_sm_resp.](https://www.broadnet.me/reference/smpp-deliver-sm)
- [Errors SMPP command_status error codes The SMPP command_status field and the ESME_R* error range: what the common codes mean (ESME_RINVPASWD, ESME_RTHROTTLED, ESME_RMSGQFUL…) and how to react to each.](https://www.broadnet.me/reference/smpp-command-status-errors)
- [Wire format SMPP TLV optional parameters SMPP's optional parameters use a Tag-Length-Value format. The TLV byte layout plus the common tags: message_payload, receipted_message_id, message_state, user_message_reference and the sar_* concatenation set.](https://www.broadnet.me/reference/smpp-tlv-parameters)
- [Operations SMPP delivery receipts (DLR) format The Appendix-B delivery-receipt text format inside deliver_sm: id, sub, dlvrd, submit date, done date, stat, err and Text — plus the stat keywords and their message_state numbers.](https://www.broadnet.me/reference/smpp-delivery-receipts-dlr)
- [Session SMPP enquire_link, windowing and throttling How SMPP keeps a session alive with enquire_link, how the window limits outstanding un-acked PDUs, and how ESME_RTHROTTLED and per-bind TPS govern your real throughput.](https://www.broadnet.me/reference/smpp-enquire-link-throttling)
- [Security Securing SMPP: TLS, auth and IP allow-listing SMPP has no native encryption. How to secure a bind in production: SMPP over TLS, credential and IP-based authentication, allow-listing, and credential hygiene.](https://www.broadnet.me/reference/smpp-over-tls-security)
- [Fundamentals SMPP v3.4 vs v5.0: what changed The practical differences between SMPP v3.4 and v5.0: congestion control, broadcast operations, extra message states and TLVs — and why v3.4 is still the default interconnect.](https://www.broadnet.me/reference/smpp-3-4-vs-5-0)
- [Integration SMPP integration best practices How to build an SMPP integration that stays reliable in production: bind strategy, sequence_number discipline, windowing, retries with backoff, idempotency, DLR handling and reconnection.](https://www.broadnet.me/reference/smpp-integration-best-practices)

## SMS encoding

How SMS text is encoded on the wire — GSM 7-bit, UCS-2, data-coding schemes, segmentation and the cost implications of every character.

- [Character sets The GSM-7 character set The full GSM 7-bit default alphabet from GSM 03.38: the basic 128-character table, the escape-based extension table (| ^ € { } ~ \ and form-feed), and how 7-bit packing works.](https://www.broadnet.me/reference/gsm7-character-set)
- [Character sets UCS-2 and Unicode SMS How SMS carries Unicode via UCS-2 (16-bit): the 70-character single-message limit, 67 per concatenated segment, what forces UCS-2, and the surrogate-pair caveat for emoji.](https://www.broadnet.me/reference/ucs2-unicode-sms)
- [Data coding The data coding scheme (DCS) The data-coding scheme byte that tells the network how an SMS is encoded: GSM-7 (0x00), 8-bit (0x04), UCS-2 (0x08), plus message classes (0/flash to 3/SIM) from GSM 03.38.](https://www.broadnet.me/reference/data-coding-scheme-dcs)
- [Segmentation SMS segmentation, concatenation and the UDH How long SMS is split and reassembled: the 6-byte User Data Header, the resulting 153 (GSM-7) and 67 (UCS-2) characters per segment, the reference number and segment sequencing.](https://www.broadnet.me/reference/sms-segmentation-concatenation-udh)
- [Cost Encoding detection and SMS cost How to detect whether text is GSM-7 or UCS-2, which characters silently force UCS-2, and how encoding drives the segment count — and therefore the cost — of every SMS you send.](https://www.broadnet.me/reference/encoding-detection-and-cost)

## SS7 / MAP

Signalling System No. 7 and the MAP layer that carry mobile-terminated SMS, HLR queries and mobility management across legacy core networks.

- [Fundamentals SS7 stack overview: MTP, SCCP, TCAP, MAP, ISUP How the SS7 stack is layered — MTP1-3 transport, SCCP addressing, TCAP transactions, and the MAP and ISUP user parts — and which layer does what for SMS, calls and mobility.](https://www.broadnet.me/reference/ss7-stack-overview)
- [Transport MTP: the Message Transfer Part (levels 1-3) The three MTP levels that transport SS7: MTP1 physical links, MTP2 error-controlled data link (MSU/LSSU/FISU signal units), and MTP3 routing by point code with load-sharing and network management.](https://www.broadnet.me/reference/mtp-message-transfer-part)
- [Addressing SCCP, global title translation and subsystem numbers How SCCP extends MTP3 with global-title addressing: the Called/Calling Party Address, Global Title Translation (GTT), subsystem numbers (HLR/VLR/MSC), and connectionless vs connection-oriented classes.](https://www.broadnet.me/reference/sccp-and-global-title)
- [Transactions TCAP: transactions, dialogues and components How TCAP structures SS7 application exchanges: the transaction sublayer (Begin/Continue/End/Abort with transaction IDs), the dialogue portion (application context), and the component sublayer (Invoke, ReturnResult, ReturnError, Reject).](https://www.broadnet.me/reference/tcap-transactions)
- [MAP MAP operations: SRI-SM, ForwardSM, UpdateLocation and more The MAP operations that run mobile networks: SendRoutingInfoForSM and MT-ForwardSM for SMS, UpdateLocation for roaming, ProvideSubscriberInfo and AnyTimeInterrogation for location — with their TS 29.002 opcodes.](https://www.broadnet.me/reference/map-operations)
- [SMS delivery SS7 MT-SMS delivery flow, step by step The full mobile-terminated SMS path over SS7: SMSC to HLR SendRoutingInfoForSM, HLR returns IMSI + serving MSC, SMSC to MSC MT-ForwardSM, paging and delivery, and the absent-subscriber retry via MWD and AlertServiceCentre.](https://www.broadnet.me/reference/ss7-mt-sms-delivery-flow)
- [Addressing SS7 point codes and network addressing How SS7 addresses signalling points: ITU-T 14-bit vs ANSI 24-bit point codes, their zone/network structure, the OPC/DPC/SLS routing label, and how point codes relate to SCCP global titles.](https://www.broadnet.me/reference/point-codes-addressing)
- [Security SS7 security threats and the GSMA FS.11 categories The main SS7 attack classes — location tracking, SMS/OTP interception, call redirection and fraud — and how GSMA FS.11 categorises MAP messages (categories 1/2/3) so signalling firewalls can filter them.](https://www.broadnet.me/reference/ss7-security-threats-fs11)
- [Fundamentals SS7 vs SIGTRAN: TDM signalling over IP How SIGTRAN relates to classic SS7: the same MTP3/SCCP/TCAP/MAP application layer, but carried over IP with SCTP and M3UA (or SUA) instead of TDM MTP1/MTP2 links.](https://www.broadnet.me/reference/ss7-vs-sigtran)

## SIGTRAN

SS7 signalling transported over IP — M3UA, SUA and SCTP — the bridge between TDM signalling and modern packet cores.

- [Fundamentals SIGTRAN overview: SS7 signalling over IP What SIGTRAN is: the IETF framework (RFC 2719) for carrying SS7 signalling over IP, using SCTP transport and adaptation layers (M3UA, SUA, M2PA) that preserve the MTP3/SCCP/TCAP/MAP application stack.](https://www.broadnet.me/reference/sigtran-overview)
- [Transport SCTP: Stream Control Transmission Protocol How SCTP works and why SIGTRAN uses it: message-oriented delivery, multi-streaming to avoid head-of-line blocking, multi-homing for path failover, the chunk-based packet format, and how it differs from TCP.](https://www.broadnet.me/reference/sctp-stream-control-transmission-protocol)
- [Adaptation M3UA: MTP3-User Adaptation layer How M3UA carries SCCP and ISUP over SCTP: the SG/ASP/AS roles, routing keys and routing contexts, message classes (Transfer, SSNM, ASPSM, ASPTM), and IPSP vs signalling-gateway modes.](https://www.broadnet.me/reference/m3ua-mtp3-user-adaptation)
- [Adaptation M2PA and SUA adaptation layers Two more SIGTRAN adaptation layers: M2PA (RFC 4165) replaces MTP2 to build IP-based STP links running full MTP3, and SUA (RFC 3868) carries SCCP-users (TCAP/MAP) directly over SCTP, bypassing MTP3.](https://www.broadnet.me/reference/m2pa-and-sua)
- [Architecture SIGTRAN deployment architecture: SG, ASP, AS How a SIGTRAN network is built: the signalling gateway bridging TDM and IP, application servers and their processes, SCTP associations, and the redundancy modes (override, load-share, broadcast) that give carrier-grade availability.](https://www.broadnet.me/reference/sigtran-deployment-architecture)

## SIP / VoIP

The Session Initiation Protocol behind programmable voice, SIP trunking and VoLTE call control, plus the media stack that rides alongside it.

- [Fundamentals SIP protocol overview What SIP is and how it works: a text-based request/response signalling protocol (RFC 3261) that sets up, modifies and tears down media sessions, its user agents, proxies and registrars, and its transactions and dialogs.](https://www.broadnet.me/reference/sip-protocol-overview)
- [Requests SIP methods and requests Every SIP request method and what it does: the six core RFC 3261 methods (INVITE, ACK, BYE, CANCEL, REGISTER, OPTIONS) and the common extensions (INFO, PRACK, UPDATE, SUBSCRIBE/NOTIFY, REFER, MESSAGE, PUBLISH).](https://www.broadnet.me/reference/sip-methods-and-requests)
- [Responses SIP response codes (1xx-6xx) The six classes of SIP response code and the ones that matter: 1xx provisional (100 Trying, 180 Ringing), 2xx success (200 OK), 3xx redirection, 4xx client error (404, 486), 5xx server error and 6xx global failure.](https://www.broadnet.me/reference/sip-response-codes)
- [Messages SIP headers: Via, From, To, Call-ID, CSeq, Contact The essential SIP headers and what they do: Via (with the branch parameter) for routing responses, From/To with tags, Call-ID, CSeq, Contact, Max-Forwards, and how dialogs and transactions are identified from them.](https://www.broadnet.me/reference/sip-headers)
- [Media SDP: the Session Description Protocol How SDP describes a media session inside SIP: the v=/o=/s=/c=/t=/m=/a= line structure, the offer/answer model (RFC 3264), codec negotiation via rtpmap, and media direction attributes.](https://www.broadnet.me/reference/sdp-session-description-protocol)
- [Media RTP and SRTP: the media stream How the media flows once SIP has set up a call: the RTP header and payload, RTCP quality reports, and SRTP encryption and authentication with keying via SDES or DTLS-SRTP.](https://www.broadnet.me/reference/rtp-and-srtp-media)
- [Call flow SIP call flow: INVITE to BYE A complete SIP call walked step by step: INVITE with SDP offer, 100 Trying, 180 Ringing, 200 OK with SDP answer, the three-way ACK, RTP media, and BYE/200 OK teardown — plus how CANCEL aborts a ringing call.](https://www.broadnet.me/reference/sip-call-flow)
- [Deployment SIP trunking and the session border controller What a SIP trunk is and the role of the session border controller (SBC): NAT traversal with STUN/TURN/ICE, topology hiding via B2BUA, security and admission control at the network border, and transcoding.](https://www.broadnet.me/reference/sip-trunking-and-sbc)

## DIAMETER

The AAA and signaling protocol behind 4G/5G mobility, policy and charging (S6a, Gx, Gy), IMS control (Cx/Sh) and Diameter roaming security at the IPX edge.

- [Fundamentals Diameter base protocol: RFC 6733 explained How the Diameter base protocol works per RFC 6733: the 20-byte message header, command codes and R/P/E/T flags, the CER/CEA capabilities exchange, DWR/DWA watchdog and DPR/DPA disconnect, over SCTP or TCP/TLS.](https://www.broadnet.me/reference/diameter-base-protocol)
- [Message format Diameter AVPs, data types and Result-Code The anatomy of a Diameter AVP: code, V/M/P flags, length, optional Vendor-Id and data; the base data types (Enumerated, Unsigned32, OctetString, Address, Time); Grouped AVPs; and the Result-Code / Experimental-Result error model.](https://www.broadnet.me/reference/diameter-avps-and-message-format)
- [Fundamentals Diameter vs RADIUS: why Diameter replaced RADIUS Why Diameter (RFC 6733) superseded RADIUS (RFC 2865) for carrier AAA: reliable SCTP transport and failover, capability negotiation, a far larger 32-bit AVP space, peer discovery, richer error handling and stronger security — with a comparison table and migration notes.](https://www.broadnet.me/reference/diameter-vs-radius)
- [Mobility (HSS) Diameter S6a/S6d: LTE mobility to the HSS How LTE mobility and subscription management run over Diameter S6a (MME↔HSS) and S6d (SGSN↔HSS) per 3GPP TS 29.272: ULR/ULA, AIR/AIA, CLR/CLA, PUR/PUA and IDR/IDA, EPS-AKA authentication vectors, and the SS7 MAP operations they replace.](https://www.broadnet.me/reference/diameter-s6a-s6d-hss)
- [Policy & charging Diameter Gx and Gy: policy and charging control How Diameter carries Policy and Charging Control: Gx (PCEF↔PCRF, CCR/CCA installing PCC rules), Gy (online charging to the OCS with quota), and Rf (offline charging to the CDF) — plus the PCRF/PCEF/OCS/OFCS roles, QoS/QCI and Sy/Sd interfaces.](https://www.broadnet.me/reference/diameter-gx-gy-policy-charging)
- [IMS Diameter Cx/Dx and Sh: IMS registration and the HSS How IMS registration and authentication run over Diameter Cx/Dx (S-CSCF/I-CSCF↔HSS) per 3GPP TS 29.228/29.229 — UAR/UAA, MAR/MAA, SAR/SAA, LIR/LIA — plus the Sh interface (AS↔HSS) and how these tie to SIP REGISTER.](https://www.broadnet.me/reference/diameter-cx-dx-ims)
- [Security Diameter roaming security: DRA, DEA and the IPX border How Diameter routing and interconnect security work at the roaming border: the Diameter Routing Agent (DRA) and Diameter Edge Agent (DEA), realm-based routing, the FS.19 threat classes (info disclosure, location tracking, fraud), topology hiding and AVP filtering.](https://www.broadnet.me/reference/diameter-roaming-security-dra-dea)

## Messaging channels

The application-layer messaging channels enterprises send on: RCS Business Messaging / MaaP, WhatsApp Business Cloud API, MMS (MM1/MM4/MM7), verified & branded sender, and channel fallback orchestration.

- [RCS RCS Business Messaging and the MaaP platform How RCS Business Messaging works: the GSMA Universal Profile (RCC.07), the Messaging-as-a-Platform architecture (RCC.71), verified agents, capability discovery, MO/MT flows and billing events — and how the RBM agent API differs from an SMPP bind.](https://www.broadnet.me/reference/rcs-business-messaging-maap)
- [WhatsApp WhatsApp Business Platform: Cloud API and templates How the WhatsApp Business Platform works: Cloud API vs On-Premises API, template (HSM) messages vs session messages, the 24-hour customer service window, the marketing/utility/authentication categories, webhooks, phone-number quality tiers and opt-in.](https://www.broadnet.me/reference/whatsapp-business-cloud-api)
- [MMS MMS architecture: the MM1, MM4 and MM7 interfaces How MMS works per 3GPP TS 23.140 and OMA MMS: the MMSC/relay-server, MM1 (handset↔MMSC over WAP/HTTP), MM4 (MMSC↔MMSC over SMTP for inter-carrier), MM7 (VASP↔MMSC over SOAP/XML), MIME/SMIL content, size limits and A2P MMS.](https://www.broadnet.me/reference/mms-mm1-mm4-mm7-interfaces)
- [Trust & branding Verified and branded sender messaging How brands prove who they are across channels: RCS Verified Sender and verified business agents, GSMA sender-ID registration and brand verification, and VMC certificates with BIMI for verified logos in email — the controls that fight spoofing and impersonation.](https://www.broadnet.me/reference/verified-and-branded-sender-messaging)
- [Decision matrix RCS vs SMS vs WhatsApp: a channel decision matrix A vendor-neutral comparison of RCS, SMS and WhatsApp for business messaging: features, reach and coverage, end-to-end encryption, read receipts and typing, rich media, cost models, fallback behaviour and regulatory constraints — with guidance on when to use which.](https://www.broadnet.me/reference/rcs-vs-sms-vs-whatsapp-channels)
- [Orchestration Channel fallback and omnichannel orchestration How omnichannel delivery cascades across channels: capability checks, RCS→SMS and WhatsApp→SMS fallback, least-cost versus best-experience routing, retry and timeout rules, and a unified delivery-receipt view that reconciles status across every channel.](https://www.broadnet.me/reference/channel-fallback-and-orchestration)
- [Interactive Rich cards and interactive messaging The interactive building blocks of RCS and WhatsApp: rich cards and carousels, suggested replies and actions, quick-reply buttons and list pickers — with example JSON payloads for each platform, plus UX and accessibility guidance.](https://www.broadnet.me/reference/rich-cards-and-interactive-messaging)

## Numbering & identity

The numbering and identity layer beneath every message and call: E.164 / MSISDN, MCC-MNC / PLMN codes, IMSI / IMEI subscriber identity, ENUM (E.164→URI) and mobile number portability routing.

- [Public numbering E.164 numbering and the MSISDN explained How the ITU-T E.164 international numbering plan works: country calling codes, national destination code (NDC) and subscriber number, the 15-digit maximum, MSISDN structure, and how to normalise numbers to E.164 for A2P messaging.](https://www.broadnet.me/reference/e164-numbering-and-msisdn)
- [Network identity MCC, MNC and PLMN codes explained (E.212) How the ITU-T E.212 identification plan works: the 3-digit Mobile Country Code (MCC) and 2–3-digit Mobile Network Code (MNC) that combine into a PLMN identity, how they identify the home network, test ranges, and how MCC-MNC differs from the MSISDN's NDC.](https://www.broadnet.me/reference/mcc-mnc-plmn-codes)
- [Subscriber identity IMSI, IMEI and subscriber identity explained The identities that distinguish a subscriber from a device: the IMSI (MCC+MNC+MSIN, E.212), the IMEI (TAC+serial), the Ki authentication key, temporary identities TMSI/GUTI, the SIM/USIM/eSIM (eUICC), and how the HLR maps MSISDN to IMSI.](https://www.broadnet.me/reference/imsi-imei-and-subscriber-identity)
- [Number routing ENUM: mapping E.164 numbers to URIs How ENUM (IETF RFC 6116) maps E.164 telephone numbers to URIs through DNS: the reversed-digit e164.arpa domain, NAPTR records with regexp rewrite, and the difference between public (user) and private (carrier/infrastructure) ENUM for SIP and VoIP routing.](https://www.broadnet.me/reference/enum-e164-to-uri-mapping)
- [Number routing Mobile number portability and routing How mobile number portability (MNP) breaks the link between a dialed number and its home network: routing numbers (RN), All-Call-Query vs Onward Routing, MNP databases and dips, and how HLR/MNP lookup drives least-cost routing and reliable delivery.](https://www.broadnet.me/reference/number-portability-and-routing)

## HTTP API & webhooks

The HTTP/REST layer above the wire protocols: REST messaging API design, webhook delivery & HMAC signature verification, status/inbound payloads, auth & signing, idempotency, rate limiting and problem+json errors — standards-grounded (RFC 9457/8288/6749, IETF drafts).

- [API design REST messaging API design: resources, methods, status codes How a standards-based REST messaging API is modelled: a messages collection, HTTP methods and status-code semantics per RFC 9110, synchronous vs asynchronous send (202 Accepted plus a status callback), content negotiation and URL-vs-header versioning — with a REST-vs-SMPP tradeoff table.](https://www.broadnet.me/reference/rest-messaging-api-design)
- [Webhooks Webhook delivery and reliability: retries, ordering, dead-letter The standard webhook/callback architecture and its reliability model: at-least-once delivery, exponential backoff with jitter on retries, delivery timeouts, ordering guarantees, dead-letter queues, idempotent consumers and endpoint health / circuit-breaking to protect a failing receiver.](https://www.broadnet.me/reference/webhook-delivery-and-reliability)
- [Security Webhook signature verification: HMAC-SHA256 and replay protection How to verify a webhook is authentic and untampered: HMAC-SHA256 over the raw body, the signature and timestamp headers, replay protection with a timestamp tolerance and nonce, constant-time comparison to defeat timing attacks, and safe secret rotation with overlapping keys.](https://www.broadnet.me/reference/webhook-signature-verification)
- [Webhooks Message status (DLR) and inbound (MO) webhook payloads The payload schemas for the two core messaging callbacks: the delivery-status (DLR) event with its message id, status enum, error reason and timestamps, and the inbound (MO) message event — plus an event-type taxonomy and how an HTTP DLR maps onto an SMPP deliver_sm receipt.](https://www.broadnet.me/reference/message-status-and-inbound-webhooks)
- [Security API authentication and request signing: tokens, HMAC, OAuth, mTLS The standard ways to authenticate an HTTP messaging API: bearer tokens and API keys in the Authorization header, HMAC request signing over a canonical request, key scoping and rotation, mutual TLS, and OAuth 2.0 client-credentials for machine-to-machine access.](https://www.broadnet.me/reference/api-authentication-and-signing)
- [Reliability Idempotency and rate limiting: keys, 429, Retry-After, RateLimit Two standards-track HTTP patterns for safe, well-behaved clients: the Idempotency-Key header (IETF draft) for exactly-once submission with a dedup window and response replay, and rate limiting — 429 with Retry-After, the RateLimit / RateLimit-Policy headers (IETF draft), token buckets and client backpressure.](https://www.broadnet.me/reference/idempotency-and-rate-limiting)
- [API design API errors (problem+json) and pagination (cursor, Link header) Two standards that keep an HTTP API predictable: RFC 9457 problem+json for machine-readable errors (type, title, status, detail, instance) with a retryable-vs-terminal taxonomy, and pagination — cursor vs offset, the RFC 8288 Link header for next/prev, and page-size limits.](https://www.broadnet.me/reference/api-errors-and-pagination)

Build on it

## From the spec to the wire.

These references describe the protocols BroadNet has operated at carrier grade since 2003 — across 200+ countries and 1,000+ operator connections. When you are ready to send, the docs and tools below take you from reading to shipping.

[Developer docs](https://www.broadnet.me/developers) [SMPP PDU decoder](https://www.broadnet.me/tools/smpp-pdu-decoder)