# SCCP, global title translation and subsystem numbers

> SCCP (Signalling Connection Control Part, ITU-T Q.711–Q.714) sits above MTP3 and adds richer addressing and services. It lets a node be reached by a Global Title — usually an E.164 number — instead of a point code, resolves it with Global Title Translation, and uses a Subsystem Number to select the application (HLR, VLR, MSC) at the destination.

- Canonical URL: https://www.broadnet.me/reference/sccp-and-global-title
- Language: en
- Last updated: 2026-07-18
- Publisher: BroadNet (https://www.broadnet.me)

How SCCP extends MTP3 with global-title addressing: the Called/Calling Party Address, Global Title Translation (GTT), subsystem numbers (HLR/VLR/MSC), and connectionless vs connection-oriented classes.

## Why SCCP is needed above MTP3

MTP3 can only route to a point code, and a point code alone cannot say which application inside that node should receive the message. SCCP solves both problems. It carries a Called Party Address and Calling Party Address that can each be a point code, a subsystem number, a global title, or a combination — so an SMSC can address 'the HLR that owns this MSISDN' without knowing that HLR's point code. SCCP also multiplexes several applications at one point code by subsystem number.

## The SCCP address: GT, PC and SSN

An SCCP address is built from up to three elements, selected by the Address Indicator. The Global Title (GT) is a routable digit string, almost always an E.164 number, with a translation type, numbering plan and nature-of-address indicator describing how to interpret it. The Point Code (PC) is the MTP3 destination. The Subsystem Number (SSN) identifies the target application. A message may carry any combination; GT-only addressing is what makes SS7 roaming and SMS interworking possible across operators.

*Called/Calling Party Address elements*

| Element | Meaning |
|---|---|
| Global Title (GT) | Routable digits (usually E.164 MSISDN/SC address) + translation type/NP/NAI |
| Point Code (PC) | MTP3 destination signalling point |
| Subsystem Number (SSN) | Application at the destination (HLR, VLR, MSC, SMSC…) |
| Routing Indicator (RI) | Route on GT (needs translation) or route on PC+SSN (already resolved) |

## Subsystem numbers

The SSN names the application. ITU-T Q.713 defines the core set and 3GPP allocates the mobile-network ones. An SMSC issuing SendRoutingInfoForSM addresses SSN 6 (HLR); the resulting MT-ForwardSM addresses SSN 8 (MSC). Wrong SSNs are a common cause of 'unequipped subsystem' failures.

*Common SCCP subsystem numbers*

| SSN | Application |
|---|---|
| 1 | SCCP management |
| 5 | MAP (Mobile Application Part) |
| 6 | HLR (Home Location Register) |
| 7 | VLR (Visitor Location Register) |
| 8 | MSC (Mobile Switching Centre) |
| 9 | EIR (Equipment Identity Register) |
| 10 | AUC (Authentication Centre) |
| 146 | CAP (CAMEL Application Part) |
| 147 | gsmSCF (CAMEL service control) |
| 149 | SGSN |
| 150 | GGSN |

## Global Title Translation (GTT)

GTT is the lookup an STP performs to turn a global title into a routing decision. The STP matches the GT digits (and translation type) against a translation table and returns a point code and SSN — and often a new GT — for the next hop. GTT can be done in stages across successive STPs, which is how an inbound roaming message is progressively steered toward the correct home network node. Because GTT is where an operator decides who may reach which subsystem, it is also the natural enforcement point for SCCP-level firewalling.

*GTT resolving an SRI-SM toward an HLR*

```text
Called Party Address (before): GT=44770900XXXX  RI=route-on-GT  TT=0  SSN=6(HLR)
STP global title translation table lookup on 44770900XXXX →
Result: DPC=2-101-3  SSN=6  (RI=route-on-PC/SSN)
MTP3 now routes the SCCP message to point code 2-101-3, subsystem HLR
```

## Connectionless and connection-oriented classes

SCCP offers four protocol classes. Classes 0 and 1 are connectionless: class 0 is pure datagram (no sequencing), class 1 adds in-sequence delivery via a sequencing parameter. Classes 2 and 3 are connection-oriented, establishing a signalling connection (with flow control in class 3) for longer exchanges. MAP and most TCAP traffic use connectionless class 0/1 carried in Unitdata (UDT/XUDT) messages; connection-oriented classes are used by applications such as some BSSAP/RANAP interfaces.

*SCCP protocol classes*

| Class | Type | Guarantees |
|---|---|---|
| 0 | Connectionless | Basic datagram, no sequencing |
| 1 | Connectionless | In-sequence delivery (sequence control) |
| 2 | Connection-oriented | Signalling connection, no flow control |
| 3 | Connection-oriented | Connection + flow control and expedited data |

## Frequently asked questions

### What is a global title in SS7?

A global title is a routable address — almost always an E.164 number such as an MSISDN or SMSC address — that SCCP uses instead of a point code. An STP performs Global Title Translation to resolve it to the point code and subsystem number of the destination node.

### What is Global Title Translation (GTT)?

GTT is the STP function that looks up global-title digits in a translation table and returns the next-hop point code and subsystem number (and sometimes a rewritten GT). It lets networks route by phone number without every node knowing every point code, and is the key screening point for SS7 security.

### What subsystem number is the HLR?

The HLR is subsystem number 6. Related mobile subsystems include VLR (7), MSC (8), EIR (9) and AUC (10). An SMS SendRoutingInfoForSM is addressed to SSN 6, and the follow-up MT-ForwardSM to SSN 8.

### What is the difference between connectionless and connection-oriented SCCP?

Connectionless classes 0 and 1 send self-contained Unitdata messages with no session — used by MAP/TCAP for SMS and roaming. Connection-oriented classes 2 and 3 set up a signalling connection with sequencing and (class 3) flow control, used for sustained exchanges like some radio-access interfaces.

### Why does my message get 'unequipped subsystem'?

SCCP returns an unequipped/unavailable subsystem error when the target point code has no application registered for the requested SSN. Usually the SSN is wrong for the operation, or the destination node genuinely does not host that subsystem — check the SSN against the operation (HLR 6, MSC 8).

## Sources

- [ITU-T Q.713 — SCCP formats and codes](https://www.itu.int/rec/T-REC-Q.713)
- [ITU-T Q.714 — SCCP procedures](https://www.itu.int/rec/T-REC-Q.714)

## Related

- [SS7 stack overview](https://www.broadnet.me/reference/ss7-stack-overview)
- [TCAP transactions and components](https://www.broadnet.me/reference/tcap-transactions)
- [MAP operations reference](https://www.broadnet.me/reference/map-operations)
- [Point codes and SS7 addressing](https://www.broadnet.me/reference/point-codes-addressing)
- [SS7 firewall (operators)](https://www.broadnet.me/operators/ss7-firewall)