GTP and the Mobile Packet Core

Introduction¶

GTP (GPRS Tunnelling Protocol) is how the mobile packet core moves a subscriber's IP traffic between network nodes. Every mobile data session is one or more GTP tunnels. It has two planes:

• GTP-C (control) — signalling: create/modify/delete sessions and bearers. Port 2123/UDP.
• GTP-U (user) — the actual data packets, encapsulated. Port 2152/UDP.

Tunnels and TEIDs¶

A GTP tunnel is identified by a TEID (Tunnel Endpoint Identifier) — a 32-bit value chosen by the receiving node. Each direction of a tunnel has its own TEID.

A GTP-U packet: [ outer IP ][ UDP:2152 ][ GTP-U header: TEID ][ the subscriber's original IP packet ]. The node receiving it looks up the TEID → knows which subscriber/bearer → decapsulates and forwards toward the internet (or the RAN).

Bearers and PDN connections¶

• PDN connection — a subscriber's connectivity to one APN (internet, ims), with one IP address. A phone can have several (one per APN).
• Bearer — a tunnel with a specific QoS within a PDN connection:
• Default bearer — created at attach, best-effort (non-GBR), stays for the life of the PDN connection.
  • Dedicated bearer — added on demand for specific traffic with guaranteed QoS (QCI 1 for VoLTE voice — see VoLTE flow). Each bearer = a GTP-U tunnel end to end (eNodeB ↔ S-GW ↔ P-GW).

Session creation (4G, simplified)¶

UE attaches --> MME
MME --Create Session Request (GTP-C, S11)--> S-GW
S-GW --Create Session Request (GTP-C, S5/S8)--> P-GW
   P-GW allocates the UE IP, sets up charging/policy (Gx to PCRF),
   picks a GTP-U TEID for the uplink
P-GW --Create Session Response (its TEID)--> S-GW
S-GW --Create Session Response (its TEIDs)--> MME
MME --sets up the radio bearer, tells eNodeB the S-GW's GTP-U TEID + address
   eNodeB tells MME its own GTP-U TEID
MME --Modify Bearer Request--> S-GW  (now S-GW knows the eNodeB side)
   <==== GTP-U tunnels established: eNodeB <-> S-GW <-> P-GW ====>

Now uplink data: the eNodeB encapsulates the UE's packets in GTP-U toward the S-GW's TEID; the S-GW swaps to the P-GW's TEID; the P-GW decapsulates and routes to the internet. Downlink reverses it.

Handover = updating the eNodeB-side TEID/address as the UE moves cells, via GTP-C Modify Bearer — the S-GW/P-GW tunnels stay, only the RAN endpoint changes (that's the S-GW's job as the mobility anchor).

GTP across generations¶

• 2G/3G (GPRS/UMTS) — GTP between SGSN and GGSN (Gn/Gp interface). GTPv0 then GTPv1.
• 4G (LTE/EPC) — GTPv2-C for signalling (S11, S5/S8), GTPv1-U for user plane (S1-U, S5/S8-U). (S5 = S-GW↔P-GW same operator; S8 = roaming, home P-GW.)
• 5G — the SBI (HTTP/2) replaces GTP-C for signalling, but GTP-U is still the user-plane protocol between gNodeB ↔ UPF (N3) and UPF ↔ UPF (N9). The SMF controls the UPF via PFCP (N4) instead of GTP-C.

So GTP-U outlived GTP-C — it's the enduring "carry subscriber packets" format.

Security — GTP firewalls¶

GTP on roaming interfaces (Gp/S8) between operators has weak authentication, similar to SS7:

• GTP-C attacks — spoofed Create/Delete Session to hijack or drop a subscriber's session, or exhaust P-GW resources; information disclosure (query a subscriber's location/IMSI).
• GTP-U attacks — injecting packets into a tunnel (if you can guess/learn a TEID) to spoof traffic or bypass charging; overbilling attacks (send junk into a victim's tunnel so they're charged).
• GTP-in-GTP — nesting to bypass filters.

A GTP firewall at the border (GRX/IPX edge) validates: GTP message types allowed per peer, TEID/sequence sanity, IMSI/APN whitelists, rate limits, anti-spoofing (source vs claimed), and blocks GTP-C message types that should never come from a roaming partner. GSMA IR.88 / FS.20 cover the recommendations.

Verification and troubleshooting¶

tshark -i any -O gtp -f 'udp port 2123 or udp port 2152'
# GTP-C: message type (Create Session Request/Response = 32/33), cause, TEID, F-TEID IEs
# GTP-U: TEID, and the inner IP packet

• Attach succeeds, no data — GTP-U tunnel not fully established: the Modify Bearer didn't complete (eNodeB↔S-GW TEID exchange), an F-TEID with the wrong IP/interface, or a firewall dropping UDP 2152 between eNodeB and S-GW.
• Data works, then stops after a handover — the S-GW/eNodeB TEID update failed; the old tunnel is torn down but the new one's endpoint is wrong.
• Create Session Response cause = "No resources available" / "Context not found" — P-GW capacity, APN not configured, or a stale session with the same IMSI/EBI not cleaned up.
• Overbilling / unexpected data charges for a subscriber — possible GTP-U injection into their tunnel from a roaming partner; a GTP firewall with source validation and idle-tunnel handling mitigates it.
• Roaming data fails — S8 GTP between visited S-GW and home P-GW blocked at the IPX, or the GTP firewall's peer/APN whitelist doesn't include the roaming partner.
• GTPv1 vs GTPv2 mismatch — an old SGSN (GTPv1) talking to an S-GW expecting GTPv2 on a combined node; needs the right interface (Gn vs S4/S11) and version.

Related tools and reading¶

• On-site: Port Checker (2123, 2152), Subnet Calculator.
• Related posts: Core telco architecture: 2G to 5G in one read, SS7 security and signalling firewalls.