MAP (Mobile Application Part, 3GPP TS 29.002) is the SS7 application that carries GSM/UMTS services as TCAP operations. Key operations include SendRoutingInfoForSM and MT-ForwardSM (SMS delivery), UpdateLocation and CancelLocation (roaming), and ProvideSubscriberInfo and AnyTimeInterrogation (location/state) — each identified by a MAP operation code.
What MAP does
MAP is the language spoken between the mobile core network entities — HLR/HSS, VLR, MSC, SGSN, SMSC, EIR and AUC. It handles mobility management (registering where a subscriber is), call handling (routing calls to a roaming subscriber), supplementary services, authentication, and short-message routing and delivery. Each MAP service maps to one or more TCAP operations invoked over SCCP, addressed by global title to the right node.
SMS operations
Two operations carry a mobile-terminated SMS. SendRoutingInfoForSM (SRI-SM) asks the HLR, for a given MSISDN, to return the subscriber's IMSI and the address of the MSC/SGSN currently serving them. MT-ForwardSM then delivers the SMS-DELIVER TPDU to that serving node. MO-ForwardSM carries a mobile-originated message from the serving MSC to the SMSC. ReportSM-DeliveryStatus and AlertServiceCentre manage retries when the subscriber was unreachable.
| Operation | Opcode | Purpose |
|---|---|---|
| sendRoutingInfoForSM | 45 | HLR returns IMSI + serving MSC/SGSN for an MSISDN |
| mt-ForwardSM | 44 | Deliver an MT short message to the serving MSC/SGSN |
| mo-ForwardSM | 46 | Carry a mobile-originated short message to the SMSC |
| reportSM-DeliveryStatus | 47 | SMSC informs HLR of delivery outcome / sets MWD |
| alertServiceCentre | 49 | HLR alerts the SMSC that a subscriber is reachable again |
| readyForSM | 66 | MSC/SGSN signals the subscriber is now available for SMS |
Mobility and subscriber-data operations
When a subscriber roams into a new VLR, the VLR sends UpdateLocation to the HLR, which stores the new location and pushes the subscriber profile back with InsertSubscriberData, then issues CancelLocation to the old VLR. For an incoming call the GMSC uses SendRoutingInfo to ask the HLR where the subscriber is, and the HLR obtains a roaming number from the serving MSC via ProvideRoamingNumber. These operations are also the ones abused by location-tracking and interception attacks if not filtered.
| Operation | Opcode | Purpose |
|---|---|---|
| updateLocation | 2 | VLR registers a roaming subscriber with the HLR |
| cancelLocation | 3 | HLR clears the subscriber from the previous VLR |
| provideRoamingNumber | 4 | HLR obtains an MSRN from the serving MSC for an incoming call |
| insertSubscriberData | 7 | HLR downloads the subscriber profile to the VLR |
| sendRoutingInfo | 22 | GMSC asks the HLR how to route an incoming call |
| sendAuthenticationInfo | 56 | VLR/SGSN fetches authentication vectors from the HLR/AUC |
Interrogation operations
Several MAP operations exist to query a subscriber's state or location for legitimate network functions, and these are exactly the ones a signalling firewall watches most closely. AnyTimeInterrogation (ATI) lets an authorised entity ask the HLR for a subscriber's location and state at any time. ProvideSubscriberInfo (PSI) asks the serving MSC/VLR for cell-level location and reachability. Received across an interconnect from a foreign network, both are strong indicators of an attempted location-tracking attack.
| Operation | Opcode | Returns |
|---|---|---|
| anyTimeInterrogation | 71 | Subscriber location + state from the HLR (on request) |
| provideSubscriberInfo | 70 | Cell/location-area + subscriber state from the serving MSC/VLR |
| provideSubscriberLocation | 83 | Geographic location via the GMLC (LCS) |
| sendIMSI | 58 | IMSI for a given MSISDN from the HLR |
| anyTimeSubscriptionInterrogation | 62 | Subscription data from the HLR (on request) |
Frequently asked
What is SendRoutingInfoForSM used for?
SRI-SM (opcode 45) is the first step of MT-SMS delivery: the SMSC asks the recipient's HLR to return the subscriber's IMSI and the address of the MSC or SGSN currently serving them, so the message can be forwarded to the right node. It also leaks information attackers seek.
What is the difference between MT-ForwardSM and MO-ForwardSM?
MT-ForwardSM (opcode 44) delivers a mobile-terminated message from the SMSC down to the serving MSC/SGSN for a handset. MO-ForwardSM (opcode 46) carries a mobile-originated message the other way — from the serving MSC up to the SMSC.
What does UpdateLocation do?
UpdateLocation (opcode 2) is sent by a VLR to the subscriber's HLR when they roam into its area, registering the new serving node. The HLR then downloads the subscriber profile with InsertSubscriberData and cancels the old registration with CancelLocation. Spoofed UpdateLocation is a classic interception vector.
Why are AnyTimeInterrogation and ProvideSubscriberInfo security-sensitive?
Both return a subscriber's location and state. Used inside a network they support legitimate services, but received from a foreign network over interconnect they are a hallmark of location tracking — which is why GSMA FS.11 classes them as messages to block or scrutinise at the SS7 border.
Where are MAP operation codes defined?
In 3GPP TS 29.002, the MAP specification, which defines each operation, its arguments and errors, and the operation code used in the TCAP Invoke. The same document defines the application contexts negotiated in the TCAP dialogue portion.
Source specifications
The published standards this page is grounded in. Opens in a new tab.