GTP-C Spoofing

In telecommunications, GTP-C Spoofing is the forging of GTP control-plane messages (Create Session Request, Delete Session Request, Modify Bearer) on S5/S8/S11 or N4/N11-equivalent interfaces to hijack subscriber sessions, exhaust bearer resources, or trigger billing anomalies. Mitigation relies on GTP firewalls validating source PLMN, IMSI ranges, and TEID consistency.

Categories: Radio Access NetworkSignalingIdentity and Subscriber

GTP-C Spoofing in context

The radio access network is the layer where mobile devices attach to the operator's infrastructure. Attacks in this layer include IMSI catching, rogue base stations, downgrade attacks and jamming, and defenses hinge on mutual authentication, integrity-protected signaling and Open RAN supply-chain hygiene.

Signaling protocols carry the control-plane instructions that set up calls, register subscribers, hand over sessions and route SMS. SS7, Diameter, GTP-C and SIP are the four dominant families, and interconnect exposure of any of them is treated by GSMA FS.11 / FS.19 / FS.20 as a top-tier telecom risk.

To place GTP-C Spoofing in the wider telecom-security picture, review OFCS, SUPI Catcher, Cleartext (Plain Text), TCAP Abuse, TEID and UMTS.

Related terms

Related topic hubs

  • GTP Security GTP-C/GTP-U threats across S5/S8, N3/N9 and GRX/IPX borders under GSMA FS.20.
  • GTP Firewall GSMA FS.20 GTP-C/GTP-U screening on GRX/IPX borders.
  • Signaling Firewall Unified SS7/Diameter/GTP/SMS signaling firewall framework.
  • SS7 Firewall GSMA FS.11 category 1/2/3 SS7 message screening at the STP edge.

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.