MSISDN vs IMSI
MSISDN is the E.164 phone number a subscriber is called on. IMSI is the internal subscriber identity used inside the network. Mapping between them (SRI-SM, SRI, ATI) is one of the most abused SS7 operations.
| Attribute | MSISDN | IMSI |
|---|---|---|
| Format | E.164, +CC + NDC + SN | MCC + MNC + MSIN |
| Where used | Call routing, SMS, external dialing | Internal signaling, HLR/HSS |
| Change on port | Portable between networks | Changes when subscriber changes operator |
| Abuse vector | SIM swap, number porting fraud | IMSI catcher, location tracking |
| Firewall use | MSISDN-to-IMSI mapping request screening | Home-network affiliation checks |
Verdict
MSISDN and IMSI are not interchangeable. Attacks that need the IMSI (location, key derivation) always start with an MSISDN-to-IMSI lookup — which is precisely what FS.11 Cat 2 screens.