GTP-C vs GTP-U
GTP (GPRS Tunneling Protocol) has two variants in the same family. GTP-C carries control-plane signaling — bearer creation, updates, teardown. GTP-U carries the tunneled user-plane traffic itself. GSMA FS.20 treats them as separate firewall targets.
| Attribute | GTP-C | GTP-U |
|---|---|---|
| Plane | Control plane | User plane (data) |
| UDP port | 2123 | 2152 |
| Purpose | Create/modify/delete bearers, sessions | Encapsulate subscriber IP packets in tunnels |
| Key IE | TEID-C, IMSI, APN | TEID-U |
| Typical attack | GTP-in-GTP, malformed IE, session flood | Overbilling, TEID hijack, user impersonation |
| Firewall focus | FS.20 message screening, rate limiting | FS.20 TEID validation, payload sanity |
Verdict
A GTP firewall that only inspects one plane is half a firewall. Real deployments filter both, correlate GTP-C session state with GTP-U tunnels, and enforce APN and TEID consistency at every roaming border.