# MAP operations: SRI-SM, ForwardSM, UpdateLocation and more

> MAP (Mobile Application Part, 3GPP TS 29.002) is the SS7 application that carries GSM/UMTS services as TCAP operations. Key operations include SendRoutingInfoForSM and MT-ForwardSM (SMS delivery), UpdateLocation and CancelLocation (roaming), and ProvideSubscriberInfo and AnyTimeInterrogation (location/state) — each identified by a MAP operation code.

- Canonical URL: https://www.broadnet.me/reference/map-operations
- Language: en
- Last updated: 2026-07-18
- Publisher: BroadNet (https://www.broadnet.me)

The MAP operations that run mobile networks: SendRoutingInfoForSM and MT-ForwardSM for SMS, UpdateLocation for roaming, ProvideSubscriberInfo and AnyTimeInterrogation for location — with their TS 29.002 opcodes.

## What MAP does

MAP is the language spoken between the mobile core network entities — HLR/HSS, VLR, MSC, SGSN, SMSC, EIR and AUC. It handles mobility management (registering where a subscriber is), call handling (routing calls to a roaming subscriber), supplementary services, authentication, and short-message routing and delivery. Each MAP service maps to one or more TCAP operations invoked over SCCP, addressed by global title to the right node.

## SMS operations

Two operations carry a mobile-terminated SMS. SendRoutingInfoForSM (SRI-SM) asks the HLR, for a given MSISDN, to return the subscriber's IMSI and the address of the MSC/SGSN currently serving them. MT-ForwardSM then delivers the SMS-DELIVER TPDU to that serving node. MO-ForwardSM carries a mobile-originated message from the serving MSC to the SMSC. ReportSM-DeliveryStatus and AlertServiceCentre manage retries when the subscriber was unreachable.

*MAP SMS operations (TS 29.002)*

| Operation | Opcode | Purpose |
|---|---|---|
| sendRoutingInfoForSM | 45 | HLR returns IMSI + serving MSC/SGSN for an MSISDN |
| mt-ForwardSM | 44 | Deliver an MT short message to the serving MSC/SGSN |
| mo-ForwardSM | 46 | Carry a mobile-originated short message to the SMSC |
| reportSM-DeliveryStatus | 47 | SMSC informs HLR of delivery outcome / sets MWD |
| alertServiceCentre | 49 | HLR alerts the SMSC that a subscriber is reachable again |
| readyForSM | 66 | MSC/SGSN signals the subscriber is now available for SMS |

## Mobility and subscriber-data operations

When a subscriber roams into a new VLR, the VLR sends UpdateLocation to the HLR, which stores the new location and pushes the subscriber profile back with InsertSubscriberData, then issues CancelLocation to the old VLR. For an incoming call the GMSC uses SendRoutingInfo to ask the HLR where the subscriber is, and the HLR obtains a roaming number from the serving MSC via ProvideRoamingNumber. These operations are also the ones abused by location-tracking and interception attacks if not filtered.

*MAP mobility operations*

| Operation | Opcode | Purpose |
|---|---|---|
| updateLocation | 2 | VLR registers a roaming subscriber with the HLR |
| cancelLocation | 3 | HLR clears the subscriber from the previous VLR |
| provideRoamingNumber | 4 | HLR obtains an MSRN from the serving MSC for an incoming call |
| insertSubscriberData | 7 | HLR downloads the subscriber profile to the VLR |
| sendRoutingInfo | 22 | GMSC asks the HLR how to route an incoming call |
| sendAuthenticationInfo | 56 | VLR/SGSN fetches authentication vectors from the HLR/AUC |

## Interrogation operations

Several MAP operations exist to query a subscriber's state or location for legitimate network functions, and these are exactly the ones a signalling firewall watches most closely. AnyTimeInterrogation (ATI) lets an authorised entity ask the HLR for a subscriber's location and state at any time. ProvideSubscriberInfo (PSI) asks the serving MSC/VLR for cell-level location and reachability. Received across an interconnect from a foreign network, both are strong indicators of an attempted location-tracking attack.

*MAP interrogation operations*

| Operation | Opcode | Returns |
|---|---|---|
| anyTimeInterrogation | 71 | Subscriber location + state from the HLR (on request) |
| provideSubscriberInfo | 70 | Cell/location-area + subscriber state from the serving MSC/VLR |
| provideSubscriberLocation | 83 | Geographic location via the GMLC (LCS) |
| sendIMSI | 58 | IMSI for a given MSISDN from the HLR |
| anyTimeSubscriptionInterrogation | 62 | Subscription data from the HLR (on request) |

## Frequently asked questions

### What is SendRoutingInfoForSM used for?

SRI-SM (opcode 45) is the first step of MT-SMS delivery: the SMSC asks the recipient's HLR to return the subscriber's IMSI and the address of the MSC or SGSN currently serving them, so the message can be forwarded to the right node. It also leaks information attackers seek.

### What is the difference between MT-ForwardSM and MO-ForwardSM?

MT-ForwardSM (opcode 44) delivers a mobile-terminated message from the SMSC down to the serving MSC/SGSN for a handset. MO-ForwardSM (opcode 46) carries a mobile-originated message the other way — from the serving MSC up to the SMSC.

### What does UpdateLocation do?

UpdateLocation (opcode 2) is sent by a VLR to the subscriber's HLR when they roam into its area, registering the new serving node. The HLR then downloads the subscriber profile with InsertSubscriberData and cancels the old registration with CancelLocation. Spoofed UpdateLocation is a classic interception vector.

### Why are AnyTimeInterrogation and ProvideSubscriberInfo security-sensitive?

Both return a subscriber's location and state. Used inside a network they support legitimate services, but received from a foreign network over interconnect they are a hallmark of location tracking — which is why GSMA FS.11 classes them as messages to block or scrutinise at the SS7 border.

### Where are MAP operation codes defined?

In 3GPP TS 29.002, the MAP specification, which defines each operation, its arguments and errors, and the operation code used in the TCAP Invoke. The same document defines the application contexts negotiated in the TCAP dialogue portion.

## Sources

- [3GPP TS 29.002 — Mobile Application Part (MAP)](https://www.3gpp.org/dynareport/29002.htm)
- [3GPP TS 23.040 — SMS technical realization](https://www.3gpp.org/dynareport/23040.htm)

## Related

- [SS7 MT-SMS delivery flow](https://www.broadnet.me/reference/ss7-mt-sms-delivery-flow)
- [TCAP transactions and components](https://www.broadnet.me/reference/tcap-transactions)
- [SS7 security threats & GSMA FS.11](https://www.broadnet.me/reference/ss7-security-threats-fs11)
- [SS7 signalling security](https://www.broadnet.me/answers/ss7-signaling-security)
- [SS7 firewall (operators)](https://www.broadnet.me/operators/ss7-firewall)