THE SS7 FIELD MANUAL

What SS7 actually is

Signalling System No. 7 is a family of telecommunications control protocols, not a single protocol. It coordinates traditional telephone networks and major parts of 2G/3G mobile service.

SS7 carries control-plane information: call setup and release, routing queries, mobility, subscriber lookup, SMS routing, roaming, charging triggers, number translation, and service logic. Voice normally travels over a separate bearer path.

Why out-of-band signalling mattered

Earlier telephone systems often sent control tones through the same channel that later carried speech. SS7 introduced common-channel, out-of-band signalling: shared signalling links controlled many bearer circuits. That improved speed, capacity, service flexibility, and resistance to simple tone-based abuse.

Principal jobs

• Establishing, supervising, and releasing telephone calls
• Determining where mobile subscribers are registered
• Supporting domestic and international roaming
• Routing and delivering SMS
• Obtaining mobile authentication data
• Controlling call forwarding and other supplementary services
• Number portability and service-number translation
• Prepaid charging and intelligent-network services
• Interworking among mobile, fixed, IMS, and legacy networks

Why SS7 still matters

4G introduced Diameter for much mobile-core signalling. 5G introduced a service-based architecture using HTTP/2 APIs, TLS, authorization tokens, and SEPP protection at roaming boundaries. Yet mobile generations coexist, and interworking keeps SS7 relevant.

SS7 may still appear in 2G/3G roaming, circuit-switched fallback, SMS infrastructure, voice and SMS gateways, number portability, IoT fleets, international roaming, Diameter-to-MAP conversion, and IMS/PSTN interconnection.

Retiring 2G or 3G reduces exposure only when the operator also removes legacy core nodes, interworking paths, stale routes, and contractual dependencies. Roaming partners may preserve older technology after the home operator has modernized.

The machinery behind the signalling cloud

Any node participating directly in SS7 is a signalling point. It has a point code within its signalling domain. Node roles frequently overlap in modern software systems, but the classical functions remain useful.

The SS7 protocol stack

MTP levels 1–3

MTP1 defines physical transport. Historically this included dedicated 56/64-kbit channels on E1/T1 facilities. MTP2 adds frame delimiting, sequencing, error detection, retransmission, link alignment, and flow control. MTP3 routes between point codes and manages links, routes, congestion, and failover.

SCCP

The Signalling Connection Control Part extends MTP with global titles, Global Title Translation, subsystem numbers, and connectionless or connection-oriented service. It routes to an application, not merely a node.

TCAP

The Transaction Capabilities Application Part supports database-like dialogues containing operations, results, errors, and rejects. MAP, CAP, and INAP commonly use TCAP.

MAP

The Mobile Application Part supports location registration, authentication-data retrieval, subscriber-data insertion, call and SMS routing, handover procedures, supplementary services, and packet-domain location management. Its principal 3GPP specification is TS 29.002.

ISUP

The ISDN User Part controls circuit-switched calls: bearer-circuit selection, numbers, progress, answer, and release. A simplified lifecycle is IAM → ACM → ANM → REL → RLC.

CAP, INAP, TUP, and BSSAP

• CAP: CAMEL service logic, including prepaid control and roaming services.
• INAP: intelligent-network service control, especially in fixed networks.
• TUP: older telephone call-control protocol, largely superseded by ISUP.
• BSSAP: signalling between MSC and GSM radio-access infrastructure; includes BSSMAP and direct-transfer functions.

Numbers are not interchangeable

Correct security analysis must keep subscriber identity, device identity, telephone number, signalling address, node address, and temporary radio identity separate. A mapping may exist, but the values are not synonyms.

Links, linksets, routes, and translations

Signalling links are individual paths. A linkset groups links between the same adjacent signalling points. A route is a path through an adjacent node toward a destination; the available routes form a routeset.

The Signalling Link Selection field distributes traffic while helping preserve ordering. MTP3 network-management procedures handle link failure, route failure, congestion, transfer restrictions, and rerouting.

Global Title Translation

GTT can evaluate the numbering-plan indicator, nature-of-address indicator, translation type, and address digits. It chooses a destination, route, or next translation stage. A message may undergo several translations between domestic, international, and partner networks.

Operationally, bad GTT data can cause outages, leaks, loops, or incorrect partner routing. Security controls therefore need change management and route validation, not only attack detection.

SIGTRAN carries SS7 over IP

SIGTRAN is the IETF family for transporting SS7-related signalling over IP. It normally uses SCTP, which preserves message boundaries and supports multi-streaming, multi-homing, ordered delivery, and path-failure detection.

Common logical roles are the Signalling Gateway, Application Server, Application Server Process, and IP Server Process.

Four simplified service flows

Incoming mobile call

1. A call reaches the subscriber’s home Gateway MSC.
2. The GMSC asks the HLR for routing information.
3. The HLR interacts with the serving MSC/VLR.
4. A temporary routing number may be allocated.
5. The HLR returns routing information to the GMSC.
6. ISUP establishes the call toward the serving MSC.
7. The serving MSC pages the handset and completes the call.

Location update

1. The handset attaches in a new visited area.
2. The serving MSC/VLR obtains the subscriber identity.
3. The visited network contacts the home HLR.
4. Authentication material and service permission are checked.
5. The HLR records the new serving node.
6. Subscriber data is inserted into the visited network.
7. The old VLR may be instructed to delete its record.

Mobile-terminated SMS

1. The SMSC accepts the message.
2. It asks the home network for the recipient’s serving route.
3. The home network returns serving-node information.
4. The SMSC forwards toward that node.
5. The serving network attempts handset delivery.
6. On failure, the SMSC can store and retry according to policy.

Roaming

1. The visited network identifies the home network from the IMSI.
2. Direct, hub, or IPX interconnect carries signalling.
3. The home network authenticates and authorizes service.
4. The visited network provides radio and local core access.
5. Usage records support wholesale settlement and retail billing.

There is no single global SS7 owner

SS7 is a federation of fixed and mobile operators, transit carriers, roaming hubs, IPX providers, MVNOs, SMS aggregators, number-portability systems, vendors, managed-service providers, regulators, and governments.

Access and interconnection

• Physical or IP interconnection
• Roaming and transit agreements
• Signalling-service contracts
• Point-code and global-title assignments
• Routing and screening configuration
• Billing, settlement, and fraud agreements

Roaming logistics

• Commercial roaming agreement
• IREG technical information exchange
• Network and service testing
• SIM and subscriber-profile tests
• Numbering, routing, and GTT provisioning
• TAP usage records and wholesale settlement
• Data and financial clearing
• Fraud controls and operational contacts
• Service-level and escalation procedures

The commercial customer, transport provider, apparent signalling origin, and true application initiator may be different organizations. Hubs and resellers lengthen the attribution chain.

Designed for a trusted club

The historical operating assumption was effectively: a message arriving from the signalling network came from an authorized carrier and was needed for service.

Legacy SS7 did not consistently provide cryptographic source authentication, end-to-end integrity, end-to-end confidentiality, fine-grained operation authorization, or non-repudiation.

Why the assumption collapsed

• Thousands of interconnected operators
• Roaming hubs, IPX transit, and aggregators
• MVNOs and outsourcing
• IP-based core transport
• Compromised carrier infrastructure
• Insiders and vendor access
• Misconfigured gateways
• Poorly governed global-title leasing or resale
• Inconsistent national regulation and filtering

Link encryption can protect traffic between two adjacent organizations. It does not prove that the application request is necessary, correctly attributed, or authorized for the subscriber.

An ordinary Internet connection is not SS7 access

Meaningful production attacks generally require a path through telecom infrastructure: a carrier or signalling-service relationship, a compromised network node, a malicious or negligent partner, an exposed gateway, insider access, or a chain of configuration failures.

Potential access paths include compromised STPs or signalling gateways, poorly secured SIGTRAN endpoints, abused SMS-provider relationships, partner resale, and test environments accidentally connected to production.

Nation-state services, surveillance vendors, advanced criminal groups, telecom insiders, and attackers who compromise operators are more plausible SS7 adversaries than ordinary consumers.

Threats to confidentiality, integrity, and availability

Location tracking

Signalling can reveal a serving MSC/VLR or SGSN, visited network, registration state, and sometimes cellular-area information. Precision varies from country/network-level to smaller service areas when additional context is available. SS7 does not inherently return GPS coordinates.

SMS interception or redirection

Routing or subscriber-state manipulation can expose or divert messages through unexpected nodes. This has historically threatened SMS one-time passwords.

Call interception or redirection

Call-forwarding or routing manipulation may send calls through attacker-controlled infrastructure. Signalling access alone does not automatically provide bearer audio; interception also requires a way to receive, bridge, or capture the traffic.

Subscriber-information disclosure

Queries may expose IMSI, serving-network identity, registration state, reachability, and other network metadata.

Authentication-material abuse

Legacy mobile procedures can request authentication material. Weak controls may assist impersonation or radio attacks. This is not equivalent to simply reading the SIM’s long-term secret.

Denial of service

Abuse can cancel or corrupt registration, interrupt calls and SMS, force repeated mobility procedures, exhaust resources, or create signalling storms.

Fraud

Threats include roaming fraud, premium-rate and call-forwarding fraud, charging manipulation, artificial traffic, prepaid abuse, SMS monetization, and subscriber impersonation.

Reconnaissance

Adversaries can attempt to infer valid address ranges, HLR boundaries, roaming relationships, topology, firewall policy, vendor behavior, and accepted operation types.

Implementation exploitation

Malformed or unusual messages may trigger parser or state-machine vulnerabilities in STPs, HLRs, SMSCs, firewalls, gateways, monitoring probes, and vendor protocol stacks. This is distinct from abusing valid protocol semantics.

SMS is a weak authentication channel

SS7 is only one risk. SMS authentication can also fail through SIM swapping, number-porting fraud, compromised carrier accounts, malware, notification leakage, cloud message synchronization, social engineering, recycled numbers, carrier insiders, or aggregator compromise.

Preferred order for MFA

1. Passkeys or FIDO2 hardware security keys
2. Authenticator-app TOTP
3. Push authentication with number matching
4. SMS only when stronger methods are unavailable

Subscriber precautions

• Add a port-out lock or carrier account PIN.
• Harden carrier-account recovery and remove weak methods.
• Use a separate number for high-value accounts where practical.
• Store service recovery codes offline.
• Do not treat possession of an SMS code as strong identity proof.

SS7 is not every mobile attack

Real operations can combine domains—for example, telecom metadata for targeting, social engineering for a SIM swap, then SMS-based account recovery.

Defensive architecture

Stateful signalling firewall

A strong firewall evaluates operation type, point code, global titles, partner identity, home network, current roaming state, request/response correlation, rate, geography, transaction sequence, known threat infrastructure, and whether the requesting party needs the data.

Industry guidance commonly separates messages that should never arrive externally, messages legitimate only under constrained conditions, and externally valid messages requiring contextual analysis. Exact categorization and policy should follow the operator’s current GSMA FS.11 implementation.

SCCP and GTT screening

• Validate calling and called global-title ranges.
• Restrict translation types, destination subsystems, and routes.
• Detect inconsistency between point code, global title, contract, and network role.
• Reject unexpected route changes and malformed addressing.

Topology hiding

Boundary STPs and gateways should avoid unnecessary exposure of internal addresses and structure. Normalization and controlled address rewriting reduce reconnaissance value.

SMS firewall and home routing

SMS controls can address spoofing, gray routes, spam, flooding, malformed traffic, suspicious routing queries, and misclassified application traffic. Home routing keeps more control in the home network and can conceal serving information, though it is not a complete solution.

Roaming-context validation

Sensitive requests should align with actual registration and partner relationships. Impossible travel, unrelated networks, stale location state, and implausible operation sequences should trigger blocking or escalation.

Allowlisting and rate controls

Permit high-risk operations only from necessary partners, expected node classes, registered addresses, known services, and valid contexts. Detect sequential range queries, abnormal subscriber fan-out, repeated failures, and sudden partner behavior changes.

Segmentation

Separate internal core signalling, domestic and international interconnect, roaming hubs, SMS providers, test systems, management networks, and Internet-facing infrastructure. Application access should not imply unrestricted MAP access.

Transport protection

• Private interconnection and hardened routing
• IPsec or equivalent protection where applicable
• Strict SCTP endpoint controls and anti-spoofing
• Mutual authentication at modern gateways
• DDoS protection, access lists, and management-plane isolation

Observability

• Boundary signalling metadata and transaction correlation
• Synchronized time and adequate retention
• Firewall decision logs and partner attribution
• Fraud, identity, and SIEM integration
• Threat-intelligence sharing and rapid blocking
• Strict protection of signalling captures, which contain private metadata

Why filtering cannot solve everything

• Many dangerous operations are operationally legitimate in the correct context.
• Roaming state changes constantly.
• Apparent senders can be spoofed, proxied, or relayed.
• Partners may share infrastructure and global-title ranges.
• Aggressive blocking can break calls, SMS, and roaming.
• Legacy components may provide incomplete context.
• Vendor implementations differ.
• Attack activity can be distributed across origins.
• A legitimate partner can be compromised.
• Transit routing can obscure the initiator.
• No single operator always sees the entire transaction.
• Commercial incentives may conflict with strict blocking.

Security testing without harming subscribers

Required controls

• Written authorization and named system owners
• Explicit point-code, global-title, operation, and service scope
• Dedicated test IMSIs and MSISDNs
• Defined time window and transaction-rate limits
• Emergency-stop contacts and rollback procedures
• Carrier and transit-provider coordination
• Logging on both sides and post-test validation

Safe laboratory

An isolated lab may contain SCTP/M3UA endpoints, simulated HLR/MSC/SMSC functions, test subscriber identities, packet analysis, and a firewall under evaluation. It must have no uncontrolled production routes.

What to validate

• Source and address validation
• GTT and SCCP screening
• Stateful transaction correlation
• Roaming-context enforcement
• Rate and fan-out controls
• Malformed-message handling and parser resilience
• Logging, alert latency, and blocking procedures
• Fail-open versus fail-closed behavior
• Redundant firewall consistency and configuration drift

Incident response

Operator sequence

1. Preserve STP, firewall, HLR/HSS, IPX, and gateway records.
2. Identify calling global title, point code, route, transit provider, and contractual owner.
3. Correlate transactions by subscriber, time, and dialogue.
4. Determine whether location, forwarding, routing, authentication, or profile state changed.
5. Review call, SMS, and account-authentication events.
6. Block narrowly enough to contain abuse without creating a broader outage.
7. Notify origin and transit partners; involve fraud, privacy, legal, and regulators as required.
8. Search retrospectively for matching origins, patterns, targets, and route changes.
9. Share indicators through trusted telecom-security channels.
10. Correct the policy, contract, or architecture that allowed the traffic.

Subscriber sequence

• Contact the carrier fraud/security team, not only retail support.
• Record unexplained loss of service and carrier notifications.
• Review call-forwarding and carrier-account settings.
• Replace SMS authentication on critical accounts.
• Change carrier credentials and strengthen the account PIN.
• Request a port freeze where supported.
• Review account sessions, recovery methods, and recent changes.
• Preserve suspicious messages and exact timestamps.

A new telephone number may be part of a wider reset, but changing the number alone does not repair compromised accounts or carrier credentials.

Lawful interception is not synonymous with SS7 abuse

Lawful interception is a regulated operator capability normally implemented through dedicated mediation interfaces, legal authorization, controls, and auditing. Unauthorized SS7 manipulation or subscriber querying is technically and legally distinct.

A government organization may possess both legal-intercept authority and telecom-network access, but institutional overlap does not make the mechanisms equivalent. Applicable law varies by jurisdiction, and metadata access may carry its own authorization and notification requirements.

Metadata maps a life

Signalling metadata can reveal relationships, travel patterns, home and workplace, meeting locations, border crossings, device activity, reachability, and political, journalistic, professional, or personal associations.

Repeated coarse observations can be more revealing than one precise observation because movement and association patterns emerge over time. Encrypted application content does not erase all telecom metadata.

National-scale failure modes

SS7 supports critical communications. Threats include signalling storms, loss of STP pairs, bad GTT updates, route leakage, congestion cascades, software defects, failed migrations, malicious bulk queries, roaming-hub compromise, supply-chain flaws, transport loss, and interworking failures.

Resilience practices

• Geographically separated STP and gateway pairs
• Diverse transport and power paths
• Capacity headroom and congestion control
• Controlled, peer-reviewed configuration deployment
• Route testing and rapid rollback
• Management-plane isolation and vendor-access monitoring
• Disaster-recovery exercises and cross-carrier coordination
• Dependency maps covering hubs, clearing providers, and interworking gateways

Configuration mistakes can produce more immediate damage than advanced intrusion. A bad route or translation update can affect vast transaction volumes within minutes.

Diameter and 5G improve the model—without erasing it

Diameter

Diameter improved extensibility, peer management, and support for authenticated or encrypted transport in 4G/EPC. It can still be abused for location disclosure, subscriber-data access, session manipulation, fraud, denial of service, and interworking attacks.

An authenticated Diameter peer is not automatically authorized for every operation on every subscriber. The federated partner-trust problem survives.

5G service-based architecture

5G introduces network-function APIs, TLS, OAuth-style service authorization, concealed permanent subscriber identifiers, and Security Edge Protection Proxies for inter-operator N32 communication.

Residual 5G risk

• SS7 and Diameter interworking
• 2G/3G fallback and roaming dependencies
• Misconfigured or overprivileged APIs
• Compromised network functions or SEPPs
• Cloud, orchestration, and supply-chain compromise
• Certificate and key-management failures
• Malicious or compromised roaming partners
• Legacy SMS paths and implementation defects

Common misconceptions

Where to verify the facts

Foundational specifications

• ITU-T Q.700 — Introduction to Signalling System No. 7
• ITU-T Q.701–Q.707 — Message Transfer Part
• ITU-T Q.711–Q.714 — SCCP
• ITU-T Q.761–Q.764 — ISUP
• ITU-T Q.771–Q.775 — TCAP
• 3GPP TS 29.002 — Mobile Application Part
• IETF RFC 4165 — M2PA
• IETF RFC 4666 — M3UA
• IETF RFC 9260 — SCTP
• 3GPP TS 33.501 — 5G security architecture and procedures

Security guidance and public assessments

• GSMA Interworking Security knowledge base — entry point for SS7, Diameter, and 5G interconnect guidance.
• GSMA: Securing a Legacy Protocol in a Modern Threat Landscape.
• ENISA: Signalling Security in Telecom—SS7/Diameter/5G.
• FCC DA 24-308 (2024) — request for information on provider countermeasures against SS7 and Diameter location tracking.

Source discipline

This site distinguishes standards-defined function from possible abuse. Exact network behavior varies by implementation, policy, deployment, regional SS7 variant, and software release. Some current GSMA security documents are available only to members; operators should use the latest controlled versions rather than relying on secondary summaries.

Glossary

AuC

Authentication Centre.

CAP

CAMEL Application Part.

EIR

Equipment Identity Register.

GMSC

Gateway Mobile Switching Centre.

GTT

Global Title Translation.

HLR

Home Location Register.

IMEI

International Mobile Equipment Identity.

IMSI

International Mobile Subscriber Identity.

INAP

Intelligent Network Application Part.

IPX

IP Exchange for carrier interconnection.

ISUP

ISDN User Part.

MAP

Mobile Application Part.

MCC / MNC

Mobile Country Code / Mobile Network Code.

MSC

Mobile Switching Centre.

MSISDN

Subscriber’s callable mobile number.

MTP

Message Transfer Part.

SCCP

Signalling Connection Control Part.

SCTP

Stream Control Transmission Protocol.

SEPP

Security Edge Protection Proxy.

SGSN

Serving GPRS Support Node.

SIGTRAN

IETF suite for signalling transport over IP.

SLS

Signalling Link Selection.

SMSC

Short Message Service Centre.

SSN

Subsystem Number.

SSP

Service Switching Point.

STP

Signal Transfer Point.

TCAP

Transaction Capabilities Application Part.

TMSI

Temporary Mobile Subscriber Identity.

VLR

Visitor Location Register.

The one-paragraph conclusion

SS7 is not merely an old protocol with one bug. It is a global authorization and trust problem embedded in a federation of carriers, transit providers, roaming partners, databases, and legacy-modern gateways. Effective risk reduction requires strict interconnect governance, stateful firewalls, contextual authorization, route control, segmentation, monitoring, fraud correlation, partner accountability, secure Diameter/5G interworking, deliberate retirement of legacy dependencies, and removal of SMS from high-value account authentication.