Before SMS and SS7, you need the map of the network. A mobile network has three big parts.
1. The radio access network (RAN) — the antennas
This is the part between the phone and the operator. It changes with every generation:
| Generation | Radio access | Controller | Core it connects to |
|---|---|---|---|
| 2G · GSM | BTS (antenna) | BSC | MSC / VLR |
| 3G · UMTS | NodeB | RNC | MSC/VLR (voice, SMS) · SGSN (data) |
| 4G · LTE | eNodeB (no separate controller) | — | MME (control) · SGW/PGW (data) |
| 5G · SA | gNB | — | AMF (control) · UPF (data) |
The key idea: the radio part is replaced every generation, but the logic of "find the subscriber, set up the call, deliver the SMS" stays the same. That logic lives in the core.
2. The core network — the brain
The core switches calls, delivers SMS, tracks where you are, checks your SIM and bills you. The core nodes you must know:
- MSC (Mobile Switching Centre) — the phone exchange. Connects calls, delivers SMS to phones in its area. Each MSC covers a geographic area.
- HLR (Home Location Register) — the master database of every subscriber. Permanent record: who you are, what you may use, and which MSC/VLR serves you right now.
- VLR (Visitor Location Register) — a temporary database, usually built into the MSC (the "MSC/VLR"). It holds a copy of your profile while you are in its area, like a hotel guest list.
- SMSC (Short Message Service Centre) — the SMS "post office". Stores a message and forwards it; retries if the phone is off.
- SCP (Service Control Point) — a database queried mid-call, e.g. for prepaid balance.
Across generations the subscriber database gets new names but the same job: HLR (2G/3G) → HSS (4G) → UDM (5G). In practice operators run one converged database with three "doors" (one speaking SS7, one Diameter, one HTTP/2), because a single phone constantly moves between generations.
3. The signalling network — how the core talks to itself
Every call and every SMS has two parts: - Content — your voice in a call, or the text of an SMS. This is what the customer cares about. - Control — the messages that set up the call, find the phone, start billing, free the line. The customer never sees these.
Signalling is the network talking to itself about the traffic. The international standard for this control is SS7 (and its successors Diameter for 4G and HTTP/2 for 5G). Much of this guide covers that control layer, because that is where SMS routing, HLR lookups, roaming and most fraud live.
Identities you must never confuse
| Name | What it identifies | Example | Pronounced |
|---|---|---|---|
| MSISDN | the phone number (E.164) | +385 91 234 5678 | — |
| IMSI | the SIM identity (MCC+MNC+MSIN) | 219 10 1234567890 | "IM-zee" |
| IMEI | the device (hardware) | 35-digit number | "I-M-E-I" |
| GT (Global Title) | an SS7 node's address, looks like a number | 385 91 000 0100 | — |
| Point Code | a node's local SS7 address inside one network | 2-110-4 | — |
How a voice call is set up (so SMS makes sense)
A call between two switches uses ISUP (ISDN User Part) and needs five messages: 1. IAM — "reserve a line, I'm calling this number" (carries the number + CIC, the circuit ID) 2. ACM — "found it, it's ringing" 3. ANM — "answered" → billing starts here 4. REL — "hang up" (+ a cause code) 5. RLC — "the circuit is free"
The voice itself travels on a separate path; these messages only control the call. For a call to a mobile, the network first asks the HLR where the phone is (MAP), then ISUP connects it. MAP finds the subscriber; ISUP connects the call.
Remember this (Module 0): A mobile network = radio (changes every generation) + core (MSC, HLR, VLR, SMSC — same logic forever) + signalling (SS7). Every call/SMS = content + control. MSISDN = number, IMSI = SIM, IMEI = device. A call is set up by ISUP in five messages; billing starts at ANM.