PFCP (Packet Forwarding Control Protocol)

Also known as: Packet Forwarding Control Protocol, Sx, N4 Protocol

PFCP is the 3GPP protocol (TS 29.244) between control and user plane functions on the Sxa/Sxb/Sxc interfaces (EPC CUPS) and the N4 interface in 5G. It lets the SMF program forwarding, QoS and usage-reporting rules into the UPF, and lets the SGW-C program the SGW-U. Exposed PFCP endpoints are a critical attack surface: manipulation can redirect user traffic, disable lawful intercept or exfiltrate session data.

Categories: Core NetworkProtocols and Standards

PFCP in context

The mobile core is where subscriber sessions, mobility and policy live. In 4G it is the EPC (MME, HSS, S/PGW); in 5G it is the Service-Based Architecture with AMF, SMF, UPF, AUSF, UDM and the NRF. Core exposure is the difference between a single-subscriber leak and a fleet-wide breach.

Telecom security is written into standards from 3GPP, GSMA, ETSI, IETF and ITU-T. Understanding which body owns which specification, and how the specs interlock (for example 3GPP TS 33.501 with GSMA FS.34 for 5G SBA security), is essential for both design and audit work.

To place PFCP in the wider telecom-security picture, review N4, PCF, DoT, SMF, ZIP and RANAP.

Related terms

Equipment

Session management (SMF, PGW-C, SGW-C)

Articles in the P1 mobile network security guide

More from the TelcoSec Glossary

Browse the full TelcoSec Glossary, the Ultimate Guide to Mobile Network Security, or the P1 Arsenal of telecom-security tools.