Prowid logo — programming courses PROWIDIT Education Academy

2G/3G Mobile Networks: GSM, UMTS, MAP and SMS

The 2G/3G Mobile Networks: GSM, UMTS, MAP and SMS course — air interface, BSS/NSS, IMSI/SIM, MAP, CAMEL, GPRS/UMTS and Osmocom
98 lessons · 7 labs · project
3 practicums · 16 troubleshooting cases
After the NGN: Softswitch, H.248, SIGTRAN course
Individual
Per month 200 AZN
Group
Per month 150 AZN
Paying for the full course in a group
15% discount
Installments
50/50
Subscription
from 30 AZN a month
How a mobile network locates a moving subscriber, authenticates their SIM/USIM card and delivers calls or SMS anywhere in the world. This course covers the complete architecture and signaling of 2G (GSM/GPRS/EDGE) and 3G (UMTS/HSPA, 3GPP Release 4) mobile networks: radio waves, path loss and multipath fading, cellular frequency reuse, FDD/TDD duplexing, FDMA/TDMA/CDMA/OFDMA multiple access and handover principles; the GSM subsystems (MS, BSS: BTS/BSC/TRX/TRAU, NSS: MSC/VLR, HLR/AuC, EIR), Um, Abis, A (and AoIP) interfaces, the TDMA frame (8 timeslots, bursts), logical channels (TCH, BCCH, CCCH: PCH/RACH/AGCH, SDCCH, SACCH, FACCH), the speech path (FR/EFR/AMR → G.711, TFO/TrFO) and the RR/MM/CM + BSSAP (BSSMAP/DTAP) protocol stack. Identities and security: IMSI (ITU-T E.212: MCC 400 for Azerbaijan, MNC, MSIN), MSISDN, IMEI/IMEISV, TMSI, LAI, CGI, SIM/USIM internals (Ki, PIN/PUK), GSM authentication triplets (RAND, SRES, Kc, A3/A8), A5 air-interface ciphering and 3G UMTS AKA mutual authentication (quintets, AUTN). MAP over TCAP/SCCP (3GPP TS 29.002): Location Update, InsertSubscriberData, CancelLocation, PurgeMS, IMSI attach/detach, paging, MO and MT call flows (GMSC → SRI → HLR → PRN → VLR → MSRN), international roaming, intra-BSC/inter-BSC/inter-MSC handovers, GSM DTMF (START/STOP DTMF), supplementary services and USSD, call forwarding, ODB, mobile number portability (MNP), CDR/TAP billing, IREG/TADIG testing and Steering of Roaming (SoR). You will also master SMS architecture (SMSC, SMS-GMSC/IWMSC, MO/MT-ForwardSM, TPDU byte structure, GSM 7-bit and UCS-2 encodings, concatenated UDH SMS), CAMEL prepaid control (CAP, InitialDP, ApplyCharging), SS7 mobile security (GSMA FS.11, SMS Home Routing), 2G/3G packet core and R4 (SGSN, GGSN, GTPv1, NodeB, RNC, WCDMA, RANAP, MSC Server + MGW R4 on Huawei MSOFTX3000 + UMG8900) and hands-on Osmocom labs.

Enrollment for a new group is open — send a request to reserve your seat

Lessons are taught live in Azerbaijani and Russian.

Enroll in the course Free trial lesson

Or study on your own in your personal account → with a subscription from 30 AZN a month

Before you start

Complete SS7 Signalling: MTP, ISUP, SCCP, TCAP and NGN: Softswitch, H.248, SIGTRAN and TDM Interworking (Sections 1 and 3) first: E1 framing, G.711 and AMR codecs, MTP2/MTP3, ISUP call setup (IAM/ACM/ANM/REL/RLC), SCCP addressing and Global Title Translation (GTT), TCAP transactions, SIGTRAN (M3UA/SCTP) and MGC + MGW (H.248) decomposition are used here without repeating the fundamentals.

How the course works

One topic, one lesson: interactive slides, call-flow and mobility ladder diagrams, radio/TDMA animations, exercises with automated answer checking, and study notes in three languages (az, ru, en). Every lesson includes a worked example, a “What can go wrong and how to find it” section, practice tasks and a self-check. Hands-on labs cover manual decoding of IMSI/LAI and SMS PDUs, dissecting MAP (UpdateLocation, SRI/PRN) and CAP (CAMEL) traces, and running a virtual GSM core network with Osmocom (OsmoHLR, OsmoMSC, OsmoBSC, OsmoSTP).

Course outline

01

Radio and cellular fundamentals

  • evolution from 1G to 5G
  • radio wave physics (frequency, wavelength, dBm power)
  • spectrum bands and licensing (900, 1800, 2100 MHz)
  • propagation, path loss and multipath fading
  • cells, clusters and frequency reuse
  • FDD vs TDD duplexing, FDMA/TDMA/CDMA/OFDMA multiple access and the handover concept
02

GSM architecture and air interface

  • MS, BSS (BTS, BSC, TRX, TRAU) and NSS (MSC, VLR, HLR, AuC, EIR)
  • Um, Abis, A and MAP (B–G) interfaces
  • the TDMA frame (8 timeslots, bursts)
  • logical channels (TCH, BCCH, PCH, RACH, AGCH, SDCCH, SACCH, FACCH)
  • speech path (FR/EFR/AMR → TRAU → G.711)
  • TFO and TrFO transcoding-free modes
  • RR/MM/CM and BSSAP (BSSMAP, DTAP) protocol stack
  • A over IP and practicum
03

Identities and security

  • IMSI structure per ITU-T E.212 (MCC, MNC, MSIN with MCC 400 Azerbaijan examples)
  • MSISDN vs IMSI, hardware IMEI/IMEISV and EIR lists
  • temporary TMSI and location identifiers LAI and CGI
  • SIM and USIM architecture (Ki key, algorithms, PIN/PUK)
  • GSM authentication (RAND, SRES, Kc triplets and A3/A8)
  • A5 air-interface encryption
  • 3G UMTS AKA mutual authentication (quintets, AUTN) and an identity trace decoder lab
04

MAP and mobility management

  • MAP over TCAP/SCCP (3GPP TS 29.002) and operation catalog
  • Location Update (air interface and MAP UpdateLocation)
  • InsertSubscriberData profile push
  • CancelLocation and PurgeMS
  • IMSI attach/detach and periodic update
  • paging, mobile-originated (MO) call setup (CM Service Request → SETUP)
  • mobile-terminated (MT) call routing (GMSC → SendRoutingInfo → HLR → ProvideRoamingNumber → VLR → MSRN)
  • international roaming, intra-BSC/inter-BSC/inter-MSC handovers
  • DTMF in GSM (START/STOP DTMF)
  • supplementary services and USSD over MAP
  • call forwarding, call barring and ODB
  • emergency calls (112), 2 MAP trace labs and practicum
05

Subscribers and carrier operations

  • HLR subscriber data profile (bearer/teleservices, supplementary services, ODB, CAMEL CSI)
  • provisioning workflow from billing (BSS/OSS) to HLR
  • MSC number analysis, MSC in Pool (A-flex and NRI inside TMSI)
  • mobile number portability (MNP: All Call Query vs Onward Routing)
  • MSC CDR generation and roaming TAP files
  • roaming agreements (IREG/IR.24 testing and TADIG codes)
  • Steering of Roaming (SoR) and SIM Over-the-Air (OTA) overview
06

Short Message Service (SMS)

  • SMS architecture (SMSC, SMS-GMSC, SMS-IWMSC)
  • MO-SMS flow (MO-ForwardSM)
  • MT-SMS delivery (SendRoutingInfoForSM, MT-ForwardSM and AlertServiceCentre)
  • TPDU structure (SMS-SUBMIT and SMS-DELIVER)
  • GSM 7-bit septet packing and UCS-2 encoding
  • concatenated long SMS via User Data Header (UDH)
  • manual SMS PDU decoder lab and practicum
07

CAMEL, SS7 security and SIGTRAN in the mobile core

  • CAMEL architecture (gsmSCF, CAP protocol, O-CSI and T-CSI triggers)
  • prepaid voice call control (InitialDP, ApplyCharging, RequestReportBCSMEvent, Continue/Connect)
  • CAP trace analysis lab
  • SS7 threat classes in mobile networks
  • defense-in-depth protection (SMS Home Routing, STP screening, SS7 Firewall per GSMA FS.11) and MAP over SIGTRAN (M3UA/SCTP) in modern cores
08

2G/3G packet data and 3GPP Release 4

  • GPRS architecture (SGSN, GGSN; Gb, Gn, Gi interfaces)
  • GPRS Attach and PDP Context Activation (APN, IP allocation, QoS)
  • GTPv1 tunneling (GTPv1-C and GTPv1-U, TEID)
  • 3G UMTS radio access network (NodeB, RNC; Iub, Iu-CS, Iu-PS)
  • WCDMA air interface (OVSF/scrambling codes, fast power control and Soft Handover)
  • RANAP over Iu, HSPA/HSPA+ evolution and 3GPP Release 4 split architecture (MSC Server + MGW on Huawei MSOFTX3000 + UMG8900, Nc and Mc interfaces)
09

Osmocom laboratory (advanced)

  • building a virtual GSM core network with Osmocom (OsmoSTP, OsmoHLR, OsmoMSC, OsmoBSC) from official documentation and provisioning a subscriber in OsmoHLR to execute test registration
  • voice calls and SMS with Wireshark packet capture
10

Problems, solutions and final project

  • 16 real-world troubleshooting cases (Location Update rejected with IMSI Unknown in HLR or Roaming Not Allowed, SRES/AKA authentication failure, MT call failure on PRN/MSRN routing, subscriber registered but not responding to paging, inter-MSC handover drops, undelivered MT-SMS, garbled SMS encoding, out-of-order multipart SMS, USSD menu timeouts, CAMEL prepaid failure in roaming, call forwarding loops, MNP misrouting, SS7 SMS spoofing, GPRS PDP Context reject on APN, and poor voice quality from double transcoding without TFO/TrFO)
  • systematic 2G/3G troubleshooting methodology and the roaming prepaid call/SMS capstone project
How do we teach?

Learning stages

01

Webinar

Students join the lesson live. At the end of each lesson, students are sent a video recording of the class.

02

Homework

Every assignment is based on the topic covered in the webinar. Homework helps you reinforce the material and understand it better.

03

Working with a mentor

The teacher stays in touch with the group both during the course and outside class. Any questions get answered right away.

04

Portfolio

During the course you'll complete several projects on different topics — they'll show employers what you can do.

Self-paced learning

The full curriculum in your personal account

98 topics with theory, examples and practice. The first 4 are free, the rest come with a subscription. Interactive lessons with slides and coding trainers: 97.

Start for free Subscription from 30 AZN a month
Radio and cellular principles8 topics
  1. Mobile generations 1G → 5G: what changed
  2. Radio waves: frequency, wavelength, power, and dBm
  3. Frequency bands and spectrum licensing: 900, 1800, and 2100 MHz
  4. Propagation, path loss, and multipath fading
  5. Cells, clusters, and frequency reuse
  6. FDD and TDD duplexing: uplink and downlink
  7. Multiple access schemes: FDMA, TDMA, CDMA, and OFDMA
  8. The handover concept: switching base stations without dropping the call
GSM: architecture and air interface13 topics
  1. GSM architecture: MS, BSS, NSS, and OSS
  2. Base Station Subsystem: BTS, BSC, TRX, and TRAU
  3. Switching and visitor location register: MSC, VLR, and GMSC
  4. Core network databases: HLR, AuC, and EIR
  5. GSM interfaces: Um, Abis, A, and MAP (B, C, D, E, F, G)
  6. GSM TDMA frame: 8 timeslots, burst types, and Timing Advance
  7. GSM logical channels: TCH, BCCH, CCCH (PCH, RACH, AGCH), SDCCH, SACCH, and FACCH
  8. The GSM speech path: FR, EFR, and AMR → TRAU → G.711 on the A interface
  9. TFO and TrFO: avoiding double transcoding in mobile-to-mobile calls
  10. The GSM protocol stack: RR, MM, CM, and BSSAP (BSSMAP, DTAP)
  11. BSSMAP procedures: channel establishment, Assignment, Handover, and Clear
  12. A interface over IP (AoIP): BSSAP over SIGTRAN and RTP
  13. Practicum: GSM nodes, interfaces, and channels
Identities and security8 topics
  1. IMSI: MCC, MNC, and MSIN structure (ITU-T E.212)
  2. MSISDN and IMEI/IMEISV: subscriber number and equipment identity
  3. TMSI, LAI, and CGI: temporary identity and location coordinates
  4. SIM and USIM: architecture, Ki key, algorithms, and PIN/PUK
  5. GSM authentication: RAND, SRES, Kc, A3/A8, and triplets
  6. A5 ciphering in GSM: protecting the air interface
  7. 3G UMTS security: mutual authentication (AKA) and quintets
  8. Lab: decoding IMSI, MSISDN, LAI, and CGI from signaling traces
MAP and mobility management19 topics
  1. MAP protocol (3GPP TS 29.002): stack over TCAP/SCCP and interfaces
  2. MAP operations catalog: groups, operation codes, and purpose
  3. Location Update: air-interface and MAP UpdateLocation procedure
  4. InsertSubscriberData: loading the subscriber profile into the VLR
  5. CancelLocation and PurgeMS: cleaning up old VLRs and handling inactivity
  6. IMSI attach/detach and periodic location updating (T3212)
  7. Paging: how the network locates a phone across a Location Area
  8. Mobile-Originated (MO) call: CM Service Request → SETUP → conversation and release
  9. Mobile-Terminated (MT) call: GMSC → SendRoutingInfo → HLR → ProvideRoamingNumber → VLR → MSRN
  10. Roaming: VLR in a visited network and call routing
  11. Handover in GSM: Intra-BSC, Inter-BSC, and Inter-MSC
  12. DTMF in GSM: START DTMF / STOP DTMF and in-network tone generation
  13. Supplementary services and USSD over MAP
  14. Call forwarding in GSM: registration, activation, and call routing
  15. Call barring and Operator Determined Barring (ODB)
  16. Emergency calls in GSM
  17. Lab: analyzing a Location Update signaling trace
  18. Lab: analyzing an incoming call trace (SRI and PRN)
  19. Practicum: reconstructing procedures from MAP messages
Subscribers and operator processes9 topics
  1. Subscriber data in the HLR: services, supplementary services, ODB, and CAMEL subscription
  2. Subscriber provisioning: from billing and CRM to the HLR
  3. Number analysis and call routing in the MSC
  4. MSC in Pool (A-flex): load sharing and high availability
  5. Mobile Number Portability (MNP) in mobile networks
  6. CDR generation in the MSC and TAP files in roaming
  7. Roaming agreements, IREG testing, and TADIG codes — overview
  8. Steering of Roaming (SoR)
  9. Over-the-Air (OTA) SIM management — overview
Short Message Service (SMS)7 topics
  1. SMS architecture: SMSC, SMS-GMSC, and SMS-IWMSC
  2. Mobile-Originated SMS (MO-SMS): air interface and MAP MO-ForwardSM
  3. Mobile-Terminated SMS (MT-SMS): SendRoutingInfoForSM, MT-ForwardSM, and alert mechanism
  4. SMS TPDU format: SMS-SUBMIT and SMS-DELIVER fields
  5. SMS encodings (GSM 7-bit and UCS-2) and concatenated long SMS (UDH)
  6. Lab: manual byte-by-byte decoding of an SMS PDU
  7. Practicum: tracing SMS end-to-end across signaling traces
CAMEL, SS7 security, and SIGTRAN in the mobile core6 topics
  1. CAMEL architecture: gsmSCF, CAP, O-CSI, and T-CSI
  2. Prepaid call flow with CAMEL: InitialDP, ApplyCharging, and Continue/Connect
  3. Lab: analyzing a CAP (CAMEL) signaling trace
  4. SS7 threats in mobile networks: attack classes at the conceptual level
  5. Protection: SMS Home Routing, STP screening, SS7 Firewall, and GSMA FS.11
  6. MAP and CAP over M3UA/SCTP in the modern mobile core
2G/3G packet data and Release 4 architecture8 topics
  1. GPRS and EDGE architecture: SGSN, GGSN, and the Gb, Gn, and Gi interfaces
  2. GPRS Attach and PDP Context Activation
  3. GTPv1-C and GTPv1-U: control plane and user plane tunneling
  4. 3G UMTS architecture: NodeB, RNC, and the Iub, Iu-CS, and Iu-PS interfaces
  5. WCDMA air interface: codes, fast power control, and soft handover
  6. RANAP on the Iu interface: RAB Assignment, Security Mode, and SRNS Relocation
  7. HSPA and HSPA+ evolution: HSDPA, HSUPA, AMC, HARQ, and NodeB scheduling
  8. 3GPP Release 4 (R4): MSC Server + MGW, and the Nc and Mc interfaces
Osmocom Lab (advanced level)2 topics
  1. Lab: virtual GSM network on Osmocom (OsmoSTP, OsmoHLR, OsmoMSC, OsmoBSC, OsmoMGW)
  2. Lab: provisioning a subscriber in OsmoHLR, making a call and SMS, and capturing traffic
Troubleshooting and real-world cases18 topics
  1. Case study: Location Update reject — IMSI Unknown in HLR
  2. Case study: Roaming Not Allowed and the Forbidden PLMN (FPLMN) trap
  3. Case study: authentication failure — key, algorithm, SRES mismatch, or SQN out-of-sync
  4. Case study: incoming calls fail — PRN errors and MSRN routing mismatch
  5. Case study: subscriber appears attached but does not respond to paging
  6. Case study: Inter-MSC handover failures and dropped calls on borders
  7. Case study: SMS not delivered — SRI-for-SM errors and subscriber reachability
  8. Case study: garbled characters in SMS — GSM 7-bit vs. UCS-2 encoding mismatch
  9. Case study: long concatenated SMS arrive as separate or incomplete parts
  10. Case study: USSD menu timeout or session drop
  11. Case study: prepaid calls fail in roaming — CAMEL phase mismatch and O-CSI handling
  12. Case study: call forwarding loop and maximum redirection counter
  13. Case study: misrouting of ported numbers (MNP) for calls and SMS
  14. Case study: SMS spoofing over SS7 and mitigation with an SS7 firewall
  15. Case study: PDP Context Activation reject — APN, subscription, and DNS issues
  16. Case study: muffled voice quality due to double transcoding (TFO/TrFO breakdown)
  17. Systematic troubleshooting methodology in 2G/3G mobile networks
  18. Capstone project: incoming call and SMS to a prepaid roamer — MAP/CAP/ISUP ladder, node matrix, and checklist

Group and individual classes include a teacher, homework review and a certificate. The subscription gives you materials, exercises and progress tracking at your own pace, without teacher feedback.

2G/3G Mobile Networks: GSM, UMTS, MAP and SMS: how to enroll

Fill in the form and we will tell you the start date of the next group, the schedule and payment terms. Or come to a free trial lesson first.

+994 77 333 38 36 Or message us on WhatsApp right away info@prowid.com

By submitting the form, you agree that your data will be used only to contact you.

WhatsApp