Two databases: one knows who you are, the other knows where you are right now.
HLR — Home Location Register
- In your home network, always.
- One permanent record per subscriber — the master copy of the subscription.
- Knows which MSC/VLR serves you — not the exact cell.
- Asked by the SMSC before every mobile-terminated SMS.
VLR — Visitor Location Register
- In the network where you are now (home or abroad).
- Usually built into the MSC (the MSC/VLR).
- A temporary record, only while you are in its area.
- Holds a copy of your profile (from the HLR) plus local data.
- Knows your location area and pages the phone.
The HLR points to a VLR. The VLR points to an area of cells. Together they can find any phone in the world.
What an HLR record looks like (3GPP TS 23.008)
| Field | Example | Meaning |
|---|---|---|
| IMSI | 219 10 1234567890 | SIM identity: MCC 219 (Croatia), MNC 10, subscriber number |
| MSISDN | +385 91 234 5678 | The phone number people dial |
| Teleservices | TS11 voice · TS21 SMS-MT · TS22 SMS-MO | What the subscriber may use |
| Barring / ODB | none | Operator blocks (e.g. no roaming, no premium SMS) |
| MSC/VLR address (GT) | 385 91 000 0100 | Network address of the switch serving you now — looks like a number, isn't one |
| MWD · MNRF · MCEF | empty · not set · not set | SMS waiting list and "unreachable / memory full" flags |
What a VLR record looks like
| Field | Example | Meaning |
|---|---|---|
| IMSI | 219 10 1234567890 | Same SIM as in the HLR |
| TMSI | 4F2A 1C03 | Temporary ID sent over the air instead of IMSI (privacy) |
| LAI | 219-10-1201 | Location area (MCC-MNC-LAC) — where to page the phone |
| HLR address (GT) | 385 91 000 0001 | Network address of the home HLR |
| IMSI detached flag | attached | Phone on/off. Off → MT SMS fails as absent subscriber |
| Subscriber data | TS11 · TS21 · TS22, barrings | Copy received via InsertSubscriberData |
| Auth vectors | RAND · SRES · Kc | Fetched from HLR/AuC to check the SIM |
How the HLR learns where you are (location update, TS 23.012)
- Phone → new VLR: Location update request (phone switches on or enters a new area).
- VLR → HLR: UpdateLocation — "this IMSI is now with me".
- HLR → old VLR: CancelLocation — old VLR deletes its copy.
- HLR → new VLR: InsertSubscriberData — profile copied to the VLR.
- HLR → new VLR: UpdateLocation ack — the HLR pointer now names the new MSC/VLR.
Roaming example — Marko lands in Vienna and gets an SMS
- Phone on in Vienna → registers with the Austrian MSC/VLR (location update).
- Vienna VLR → HLR: UpdateLocation "IMSI 219 10… is now with me".
- HLR in Zagreb saves the new MSC/VLR address (43…) and sends the profile to the VLR.
- SMSC → HLR: SRI-SM → HLR answers with IMSI + MSC address in Vienna.
- Vienna MSC/VLR: MT-ForwardSM → pages the phone and delivers.
What changes in the databases: | Where | Before (Zagreb) | After (Vienna) | |---|---|---| | HLR · MSC/VLR address | 385 91 000 0100 | 43 664 000 0100 | | Zagreb VLR | record for IMSI 219 10… | deleted (CancelLocation) | | Vienna VLR | — | new record: TMSI, LAI, profile copy | | SRI-SM answer | MSC 385 91… | MSC 43 664… → roaming |
The MSC prefix in the SRI-SM answer shows the country. If the HLR bars roaming, UpdateLocation is rejected with roamingNotAllowed.
The HLR lookup (and why A2P uses it)
A lookup is an SRI-SM without the message. It is cheap compared to a failed SMS. A2P providers use it to: - Validate — is the number real and active? (unknown → don't send, don't pay) - Route correctly — which network owns the number today? (needed after porting) - Predict delivery — absent or roaming? expect delay; choose the right route and price.
An SRI-SM request/response, field by field:
REQUEST SMSC → HLR RESPONSE HLR → SMSC
msisdn: 385912345678 imsi: 219101234567890
sm-RP-PRI: true networkNode-Number: 436640000100
serviceCentreAddress: (or a MAP error)
385910001000
Read it as: imsi 219 10… → home network Croatia, operator MNC 10; networkNode-Number 43 664… → serving MSC in Austria → roaming; a MAP error instead → number unknown/absent/barred.
Number portability — the prefix can lie
| Step | Example | Result |
|---|---|---|
| Number | +385 91 234 5678 | Prefix 91 was originally A1 (MNC 10) |
| Marko ports | moves to Telemach, keeps the number | Prefix still says A1 |
| Lookup IMSI | 219 02 … | Real network = Telemach (MNC 02) |
| Routing | use the IMSI / NP database | Send to Telemach, not A1 |
Networks keep a number portability database; a signalling relay (MNP-SRF) forwards the SRI-SM to the new HLR. Without it: wrong route, wrong price, lost SMS. Important: portability applies to subscriber numbers (MSISDN), not to node GTs — an MSC/HLR GT always belongs to the operator that owns that number range.
MAP errors you will see (3GPP TS 29.002)
| Code | MAP error | Type | Typical meaning |
|---|---|---|---|
| 1 | unknownSubscriber | Permanent | Number not allocated in this HLR |
| 6 | absentSubscriberSM | Temporary | Phone off or out of coverage |
| 11 | teleserviceNotProvisioned | Permanent | SMS not in the subscription |
| 13 | callBarred | Policy | Barring active on the subscriber |
| 34 | systemFailure | Temporary | Problem in the network node |
Remember this (Module 2): HLR = who you are (permanent, at home); VLR = where you are now (temporary, at the serving MSC). Every MT SMS starts with SRI-SM to the HLR, which returns IMSI + serving MSC address. Roaming changes the MSC address; the prefix shows the country. Porting means the number prefix can lie — use the IMSI/NP database.