GPRS Tunneling Protocol (GTP) is a group of IP-based mobile communication protocols defined by 3GPP used across various interfaces in roaming, RAN, and within the packet core of 3G and 4G networks to carry GPRS traffic over GSM (2G), UMTS (3G), LTE (4G), and 5G NR radio networks.

GTP establishes tunnels between GPRS Support Nodes (GSNs) or their LTE/5G equivalents (such as the Serving Gateway (SGW) and PDN Gateway (PGW)), enabling encapsulated user data and signaling messages to traverse the mobile core network.

Mobile Core Network Architecture

2G

Core Network

GSM Core + GPRS Core

Main Element

MSC - handles circuit-switched calls
HLR/VLR - subscriber and location data
SGSN
GGSN

Protocol

Interface	Between	Purpose	Protocol
Gn	SGSN <-> GGSN	Intra-PLMN	GTPv1-C (control), GTPv1-U (user)
Gp	SGSN <-> GGSN	Inter-PLMN, roaming	GTPv1-C (control), GTPv1-U (user)

3G

Core Network

UMTS Core (similar to 2G + improved packet support)

Main Elements

RNC (Radio Network Controller)
SGSN + GGSN - continue from GPRS
HLR, MSC

Protocol

Interface	Between	Purpose	Protocol
Gn	SGSN <-> GGSN	Intra-PLMN	GTPv1-C (control), GTPv1-U (user)
Gp	SGSN <-> GGSN	Inter-PLMN, roaming	GTPv1-C (control), GTPv1-U (user)
Gi	GGSN <-> Internet	External packet delivery	IP (user)

4G

Core Network

EPC, All-IP architecture, no circuit-switching, instead packet switching

Main Elements

eNodeB - combines base station & controller
MME (Mobility Management Entity) - manage mobility of UE and session control (GTPv2-C)
SGW
PGW
HSS – replace HLR

Protocol

Interface	Between	Purpose	Protocol
S1-MME	eNodeB <-> MME	Signaling, bearer setup	Control plane, SCTP, S1AP
S1-U	eNodeB <-> SGW	Carrier user IP packet	GTPv1-U (user)
S11	MME <-> SGW	Session management	GTPv2-C (control)
S5/S8	SGW <-> PGW	S5 for same PLMN, S8 different PLMN	GTPv2-C, GTPv1-U

5G (NR – New Radio)

Core Network

5G core

Main Elements

gNB – 5G base station
AMF – Access and Mobility Function
SMF – Session Management Function
UPF – User Plane Function (replace SGW/PGW)

Protocol

Interface	Between	Purpose	Protocol
N3	gNB <-> UPF	IP data transport	GTPv1-U (user)
N4	SMF <-> UPF	User plane session management	PFCP (on UDP/IP) (control)

GTP Sub-protocols

GTP-C (Control Plane)
Handles signaling for session management such as creating, modifying, and deleting tunnels. It is used between SGSN and GGSN in 3G networks, and between SGW and PGW in 4G networks to manage sessions. GTPv2-C is used for session management in LTE, while GTPv1-C is used for PDP context request/response in 3G. GTP-C packet is sent through the UDP port 2123. There are three available versions: GTPv0, GTPv1-C and GTPv2-C.
GTP-U (User Plane)
Used between the Radio Access Network (RAN) and the core network to carry user-plane IPv4 or IPv6 data encapsulated in GTP-U tunnels. GTP-U packet is sent through the UDP port 2152. There are one version: GTPv1-U.
GTP’ (GTP Prime)
Derived from GTP-C, it is used between the Charging Data Function (CDF) and the Charging Gateway Function (CGF) to carry charging information.

GTP tunnel setup in 4G (LTE)

1 Step: UE attachment & initial signaling

• UE connect eNodeB
• eNodeB sends Attach Request with APN (Access Point Name) to MME via S1-MME (uses S1AP over SCTP)

2 Step: MME Sends Create Session Request to SGW

• MME initiate EPS (Evolved Packet System) session creation
• S11 interface used in MME -> SGW for control signaling
• Send GTPv2-C message to SGW
• Message includes: UE IP, APN, IMSI, bearer QoS
• TEID (0x00000000 when not assigned)
• PGW address for forwarding

3 Step: SGW Forwards Create Session Request to PGW

• SGW acts as a proxy, forwarding request to PGW
• GTPv2-C over S5/S8 interface

4 Step: PGW Sends Create Session Response to SGW

• PGW allocates: UE IP address, TEID for signaling (TEID-C), TEID for data (TEID-U)
• Sends GTPv2-C Create Session Response back to SGW
• This response also includes: EPS bearer ID, QoS rules

5 Step: SGW Create Session Response to MME

• SGW maps its own TEIDs (for user and control planes)
• Sends Create Session Response (GTPv2-C) to MME

6 Step: MME Instructs eNodeB to Setup Bearer

• MME sends Initial Context Setup Request to eNodeB
• Includes eNodeB’s TEID and UE’s IP

7 Step: Bearer Setup Complete

• eNodeB responds back confirming bearer setup
• TEIDs are now established at all hops: S1-U (eNodeB ↔ SGW); S5/S8 (SGW ↔ PGW)

8 Step: User Plane Starts (GTP-U)

• User data flows using: GTPv1-U on: S1-U (eNodeB ↔ SGW); S5/S8 (SGW ↔ PGW)
• Packets encapsulated in GTP-U (type: 0xFF) using assigned TEIDs

Glossary

BSS (Base Station Subsystem): Consists of the Base Transceiver Station (BTS) and the Base Station Controller (BSC). Used in GSM networks for managing radio communication and control.

eNB (evolved Node B): The LTE base station that connects UE to EPC. It handles radio communication and control functions.

EPC (Evolved Packet Core): The core network in 4G LTE, responsible for data routing, mobility management, and connectivity to external networks.

GGSN (Gateway GPRS Support Node): connects to external packet networks.

GSM (Global System for Mobile Communications): A 2G cellular technology that provides mobile voice and data services. Key components include MS, BSS, and NSS.

IMSI (International Mobile Subscriber Identity): unique number to identify mobile subscriber on GSM, UMTS, or LTE network.

MS (Mobile Station): Consists of the mobile device and the SIM card, used by the subscriber to access the mobile network.

NSS (Network and Switching Subsystem): Includes core components like the Mobile Switching Center (MSC) and databases such as the Home Location Register (HLR) and Visitor Location Register (VLR).

PFCP (Packet Forwarding Control Protocol): Works between control plane and user plane in 5G. It operates on top of UDP/IP, with port 8805, and is crucial for establishing, modifying, and releasing sessions, as well as reporting session information. PFCP is used by the Session Management Function (SMF) to communicate with the User Plane Function (UPF).

PGW (Packet Data Network Gateway): Serves as the interface between the EPC and external IP networks. It handles IP address allocation, QoS, and packet filtering.

PLMN (Public Land Mobile Network): public cellular network within specific country (PLMN ID).

RAN (Radio Access Network): Part of the mobile network that uses radio waves to connect UEs to the core network. Includes transceivers like eNB.

SGW (Serving Gateway): Routes and forwards user data packets from UEs to the PGW, and acts as a mobility anchor during handovers between eNBs.

SGSN (Serving GPRS Support Node): packet-switched services.

UMTS (Universal Mobile Telecommunications System): A 3G mobile communication technology. It uses WCDMA as the radio access technology to transmit data over the air interface.