1. The identifiers — who is who
| ID | What | Format / example | Where it lives |
|---|---|---|---|
| MSISDN | The phone number you dial (E.164) | +385 91 123 4567 = CC + NDC + SN (country code + national destination code + subscriber number), max 15 digits |
HLR/HSS/UDM, SMSC |
| IMSI | International Mobile Subscriber Identity — the SIM's permanent identity | MCC (3) + MNC (2–3) + MSIN e.g. 219 01 … (Croatia = 219) |
SIM, HLR, never meant to leave the radio unprotected |
| IMEI / IMEISV | International Mobile Equipment Identity — the phone hardware (15 digits; SV adds software version) | TAC (8) + serial (6) + check (1) |
Phone, EIR (blacklists stolen phones) |
| TMSI / P-TMSI / GUTI / 5G-GUTI | Temporary identity assigned by network to hide the IMSI over the air | VLR / SGSN / MME / AMF | |
| SUPI / SUCI | 5G permanent ID (≈ IMSI) / its encrypted form | UDM / sent by UE | |
| ICCID | Integrated Circuit Card Identifier — serial number of the SIM card (19–20 digits) | printed on the SIM | SIM |
| Ki / OPc | Secret key on SIM / operator variant key | 128-bit, never leaves the SIM and AuC/UDM | SIM, AuC |
| PIN / PUK | Personal Identification / Unblocking Key | SIM | |
| MCC / MNC / PLMN | Mobile Country Code / Mobile Network Code / the combination = a network ("Public Land Mobile Network") | MCC 219 = Croatia, 310 = USA, 262 = Germany, 234 = UK; MNC then picks the operator* | |
| LAI / RAI / TAI | Location / Routing / Tracking Area Identity (PLMN + area code) | ||
| CGI / ECGI / NCGI | Cell Global Identity (2G/3G) / E-UTRAN / NR | ||
| Point Code (PC) | SS7 node address in a country network | 14-bit (ITU) or 24-bit (ANSI) | |
| Global Title (GT) | SS7 node address in E.164 (+ type) | +38591xxxx |
|
| IMPI / IMPU | IMS Private / Public User Identity | sip:+385911234567@ims.mnc001.mcc219.3gppnetwork.org |
IMS |
| GRUU / SIP URI | Addressable instance / sip: address |
||
| APN / DNN | Access point / Data Network Name | internet, ims |
|
| E.164, E.212, E.214 | Numbering plans: phone numbers / IMSI / mobile global titles derived from IMSI | ||
| E.118 | ICCID numbering |
(MNC/operator assignments change over time — always verify in the ITU / GSMA MNC list before relying on one.)
Number portability
- MNP — Mobile Number Portability: you keep your number when changing operator.
- Implementation: a central or operator database; before routing calls/SMS the network checks the donor operator vs recipient operator. SMS needs MNP-SRF or an HLR lookup; calls need number-range-holder look-ups (ENUM / "onward routing" / "all-call-query").
- HLR Lookup — a commercial service that asks the HLR via SRI-SM whether a number exists, its current IMSI/MCC/MNC, roaming state and ported status. Used for number validation and SMS routing; also abused for reconnaissance.
2. The SIM, USIM, eSIM
| Term | Meaning |
|---|---|
| UICC | Universal Integrated Circuit Card — the smart card hardware (what people call "the SIM") |
| SIM / USIM / ISIM | Application on it for 2G / 3G-4G-5G / IMS |
| Form factors | 1FF (credit-card), 2FF mini, 3FF micro, 4FF nano, MFF2 (soldered, M2M) |
| eSIM / eUICC | Embedded SIM; profile is downloaded remotely |
| SM-DP+ / SM-SR / LPA | Subscription Manager Data Preparation / Secure Routing / Local Profile Assistant — eSIM provisioning chain (GSMA SGP.22 for consumer, SGP.02 for M2M) |
| iSIM | SIM function integrated into the chip |
| Multi-IMSI / roaming SIM | One SIM with several operator profiles |
| SIM Toolkit (STK) / OTA | Small apps on the SIM; Over-The-Air updates of SIM using binary SMS (type 0 / class 2) — also an attack vector (e.g. SIMjacker) |
| SIM swap | Moving a number to a new SIM — legitimately or by fraud (account takeover) |
3. Services riding on the network
| Service | What it is | Notes |
|---|---|---|
| SMS | Short Message Service, 160 chars | Module 1 |
| MMS | Multimedia Messaging Service | MM1…MM7 interfaces, MMSC, carried over data (WAP, HTTP) |
| RCS | Rich Communication Services — modern chat with read receipts, groups, media over IMS/IP | Universal Profile (GSMA), Google Jibe; E2EE in newer versions |
| USSD | Unstructured Supplementary Service Data — *# menus, session-based on signalling |
*100#; real-time, runs on MAP |
| IVR | Interactive Voice Response — telephone menus | |
| Voicemail / visual voicemail | ||
| Call forwarding (CFU/CFB/CFNRy/CFNRc) | Unconditional / Busy / No-reply / Not-reachable | Set via USSD codes **21*number# |
| CLIP / CLIR / COLP | Calling Line Identification Presentation / Restriction | Caller ID show/hide |
| Call waiting / hold / conference (MPTY) | Supplementary services | |
| Emergency calls | 112 (EU), 911 (US). Works without SIM; location sent to PSAP; eCall in cars; AML (Advanced Mobile Location) | |
| Cell Broadcast / CBS / Public warning (EU-Alert, ETWS, CMAS) | Emergency alerts to all phones in an area | Not SMS — broadcast |
| LBS / positioning | Cell ID, Timing Advance, A-GNSS, OTDOA, E-CID | |
| Prepaid / postpaid, top-up | Charged in advance via OCS / billed afterwards | |
| Data services: APN, tethering, hotspot, VPN | ||
| Fixed Wireless Access (FWA) | 4G/5G as home broadband | |
| Private networks | Campus LTE/5G for industry | |
| M2M / IoT connectivity platforms | SIM/eSIM management for devices (CMP), billing per device | |
| A2P messaging | Application-to-Person bulk SMS (banks, OTP) over SMPP | |
| CPaaS | Communications Platform as a Service (Twilio, Infobip, Sinch …) | |
| OTT | Over-The-Top apps (WhatsApp, Viber, Signal) that bypass operator voice/SMS | |
| P2A / 2-way SMS, short codes, alphanumeric sender ID | Business messaging features | |
| SMS aggregator / hub / grey route | Middlemen that route traffic; legitimate (white) vs unauthorised (grey/black) |
4. Protocols quick map (what is used where)
| Domain | Protocols |
|---|---|
| Signalling in 2G/3G | SS7: MTP, SCCP, TCAP, MAP, CAP, INAP, ISUP, BSSAP, RANAP, SIGTRAN (M3UA/SCTP) |
| Signalling in 4G | Diameter (S6a, Gx, Rx, Cx…), GTPv2-C, S1AP, NAS, SIP |
| Signalling in 5G | HTTP/2 SBI, NGAP, PFCP, NAS, SIP |
| User plane | GTP-U over UDP, then IP |
| Transport of signalling | SCTP (SIGTRAN, S1AP, NGAP, Diameter often), TCP, UDP, TLS |
| Voice media | RTP/RTCP, SRTP, over UDP |
| Voice signalling | SIP, SDP |
| A2P / bulk | SMPP, HTTP/REST (CPaaS) |
| Between operators | SS7/SIGTRAN, Diameter via DEA/DRA (Diameter Edge/Routing Agent), GTP via GRX/IPX, SIP via SBC, N32 via SEPP |
| OAM | SNMP, NETCONF/YANG, gRPC/gNMI, syslog, Netflow/IPFIX |
| Security | IPsec, TLS, DTLS, SRTP, IKEv2 |
| Time sync | NTP, PTP |
| Lawful interception | ETSI X1/X2/X3, HI1/HI2/HI3 handover interfaces |
5. Lawful interception, emergency and regulation (briefly)
Every operator has to provide Lawful Interception (LI) to authorised agencies, Data Retention (national rules differ), emergency call routing and number portability. These are why signalling probes and mediation devices exist inside every network.
Remember this: know your six IDs — MSISDN (number), IMSI (SIM identity), IMEI (phone), TMSI/GUTI (temporary), GT (SS7 address), APN/DNN (data gate). Most telecom debugging starts with "which identifier am I looking at, and which node knows it?"