SMSC Basics for Sysadmins

Introduction¶

An SMSC (Short Message Service Centre) is the node that accepts, stores, and delivers SMS. SMS is store-and-forward: if the recipient is unreachable the SMSC holds the message and retries, unlike the real-time USSD or voice paths.

Message paths¶

A person-to-person text is MO then MT. An OTP is AO then MT. An inbound "STOP" to a shortcode is MO then AT.

MT delivery over SS7 (the classic path)¶

SMSC --- MAP sendRoutingInfoForSM ---> HLR        (where is this subscriber?)
SMSC <-- IMSI + serving MSC/SGSN address --
SMSC --- MAP MT-ForwardSM ---> MSC/VLR ---> handset (SMS-DELIVER)
SMSC <-- delivery ack / failure ---

If the MSC says the subscriber is absent (phone off, no coverage), the HLR sets the MNRF/MNRG (Mobile Not Reachable Flag) and adds the SMSC to the Message Waiting Data list. When the subscriber comes back, the MSC tells the HLR, which sends an Alert-SC to every waiting SMSC — they then retry immediately.

In LTE this path is SGd/S6c Diameter to the MME instead of MAP to the MSC, or SMS-over-IMS (SIP MESSAGE with a 3GPP-encoded payload via the IP-SM-GW).

Retry / validity¶

• Each message has a validity period (default often 24–72h, max 63 weeks in the encoding). After that, expired → EXPIRED DLR, dropped.
• Retry schedule is SMSC config: e.g. 1m, 5m, 15m, 30m, 1h, 2h, 4h… backing off, plus immediate retry on Alert-SC.
• First Delivery Attempt (FDA) — some SMSCs try direct delivery before storing, for latency.

Numbering and encoding¶

• SMSC address / SCA — the E.164 of the SMSC, provisioned in the SIM; MO messages carry it.
• TP-DCS — GSM 7-bit (default), 8-bit (binary/WAP push), or UCS-2 (non-Latin).
• Segmentation — >160 GSM-7 chars → concatenated parts with a UDH; the handset reassembles.
• Sender / originator — MSISDN, shortcode, or alphanumeric (max 11 GSM-7 chars); alphanumeric senders can't receive replies and are regulated per country.

Running one — Kannel (open source)¶

Kannel is a gateway (SMS + WAP), often used as an SMSC-facing gateway or a small SMSC for testing.

# kannel.conf (abridged)
group = core
admin-port = 13000
smsbox-port = 13001
admin-password = "..."
log-file = "/var/log/kannel/bearerbox.log"

group = smsc
smsc = smpp
host = smsc.operator.net
port = 2775
smsc-username = "myacct"
smsc-password = "..."
system-type = ""
transceiver-mode = true

group = smsbox
bearerbox-host = 127.0.0.1
sendsms-port = 13013

group = sendsms-user
username = app
password = "..."

Send:

curl "http://127.0.0.1:13013/cgi-bin/sendsms?username=app&password=...&to=94771234567&text=hello"

Receive (MO/AT) is delivered to a URL you configure per sms-service group.

Verification and troubleshooting¶

# Kannel status
curl "http://127.0.0.1:13000/status?password=..."
tail -f /var/log/kannel/bearerbox.log

# SS7 side
tshark -i any -O gsm_map,gsm_sms -d sctp.port==2905,m3ua

• MT never delivered, no error — HLR sendRoutingInfoForSM failed (subscriber unknown, barred, or SCCP GT for the HLR unreachable), or the MSC address returned is stale. Check the SRI-SM response.
• Messages stuck "waiting" — recipient absent; SMSC is waiting for Alert-SC. If they're reachable and it still waits, the HLR didn't register this SMSC in the MWD (SMSC address mismatch), or Alert-SC routing is broken.
• EXPIRED on everything to one operator — interconnect down, or your originating address is being filtered (SMS firewall / anti-spam on their side).
• Concatenated SMS arrive as separate garbled messages — UDH not set, or the reference number collides (use a rolling ref per destination).
• Alphanumeric sender rejected / replaced — country rules; the operator substitutes a shortcode. Register the sender ID.
• Kannel SMSC ... connection failed — SMPP credentials, IP allow-list on the operator SMSC, or transceiver-mode not supported (use separate receive-port / transmitter+receiver).
• Duplicate MT — retry fired while the first attempt's ack was in flight; the handset dedups by TP-MR but cross-segment or cross-SMSC dups can slip through.

Related tools and reading¶

• On-site: Port Checker (2775).
• Related posts: SMPP: bind types and message flow, SS7 vs SIGTRAN.