SCCP vs TCAP
SCCP (Signalling Connection Control Part) provides SS7 routing and addressing above MTP. TCAP (Transaction Capabilities Application Part) sits above SCCP and carries the actual MAP/CAP dialogues. Attacks and defenses can target either.
| Attribute | SCCP | TCAP |
|---|---|---|
| OSI position | Network layer (above MTP) | Transaction layer (above SCCP) |
| Addresses | Global Title, SSN | TCAP transaction IDs |
| Payload | TCAP or user data | MAP / CAP operations |
| Firewall use | GT screening, calling-party trust | Operation-code and IE filtering |
Verdict
A firewall that only screens at SCCP can be bypassed by spoofing calling-party GTs at the TCAP dialogue level. FS.11 categories only work when the firewall parses down to TCAP operation and MAP argument.