IMSI, MSISDN, and the Protocols That Connect Them

A MSISDN (Mobile Station ISDN Number) is simply a subscriber's phone number — the string of digits you dial or share with someone. The name comes from ISDN, an older digital telephone standard, but in practice a MSISDN is what every carrier uses to route calls and SMS to a specific subscriber.

Every MSISDN is structured in three parts defined by the ITU-T E.164 standard. Click each segment to explore its role:

The full MSISDN is at most 15 digits. In international format it is prefixed with + — for example, +15551234567.

An IMSI (International Mobile Subscriber Identity) is the true internal identifier for a subscriber. It is a 15-digit number stored on the SIM card and never normally visible to the subscriber or to outside parties. Every time your phone registers on a network, it presents its IMSI.

IMSI anatomy — click each segment to explore:

Where it lives: The IMSI is stored in the SIM card's secure element and in the carrier's subscriber database. It does not change when you get a new phone, but it does change when you get a new SIM.

A subscriber can change their phone number (MSISDN) without getting a new SIM, and can get a new SIM (new IMSI) while keeping the same number. The carrier's subscriber database bridges the two.

The database responsible for mapping MSISDN → IMSI (and tracking where a subscriber currently is) is called the:

• HLR (Home Location Register) — used in 2G (GSM) and 3G (UMTS) networks
• HSS (Home Subscriber Server) — used in 4G (LTE) and 5G networks; functionally the same concept with a Diameter interface instead of SS7

When a call or SMS arrives for +15551234567, the network queries the HLR to find:

1. Which IMSI owns that number
2. Which serving node the subscriber is currently attached to — the network equipment closest to where the phone is right now. The node type depends on the network generation:

SS7 (Signaling System No. 7) is the protocol suite that has run the world's telephone networks since the 1970s. It handles call setup, teardown, SMS routing, and subscriber database lookups. Despite being decades old, SS7 still underpins most carrier infrastructure worldwide and interconnects 2G, 3G, and 4G networks at the roaming layer.

SS7 uses a sub-protocol called MAP (Mobile Application Part) for interactions between mobile network nodes. Two MAP operations are particularly relevant here.

Originally designed to route incoming calls to a subscriber, MAP-SRI asks the HLR: "I want to route a call to this phone number — where is the subscriber and what is their IMSI?"

The HLR responds with:

• The subscriber's IMSI
• The address of the subscriber's current MSC

Similar to MAP-SRI but designed for SMS routing. It asks the HLR where to deliver an SMS for a given phone number. The response again includes the IMSI and the current serving node.

Diameter is the protocol that replaced SS7's MAP for 4G/LTE network signaling. Where SS7 uses a layered stack of protocols (MTP for raw transport → SCCP for routing → TCAP for transactions → MAP for mobile operations), Diameter is an IP-based protocol designed for telecom-grade reliability and scalability — think of it as a purpose-built messaging system where network nodes send structured request/response messages to each other over TCP or SCTP (Stream Control Transmission Protocol — a transport similar to TCP but designed for telecom signaling, with built-in multi-path support).

In 4G networks the HSS exposes its MSISDN → IMSI mapping through two Diameter interfaces:

• Sh interface — connects Application Servers (IMS, LCS) to the HSS so they can look up subscriber data; the application knows only a phone number, and the HSS returns the underlying IMSI.
• S6a interface — connects the MME (the 4G node that manages which cell a phone is attached to) to the HSS. Every time a phone turns on or moves to a new area, the MME asks the HSS over S6a to authenticate the subscriber and download their profile — a process that also exchanges the IMSI.

The Send-Routing-Info command on the Sh interface is functionally equivalent to MAP-SRI: given a phone number, it returns the subscriber's IMSI and routing information.

Putting it all together, here is the end-to-end path from a known phone number to a retrieved IMSI. Press Play to trace the lookup flow step by step:

Because the IMSI is the internal handle for all subscriber operations, uncontrolled access to this lookup exposes several capabilities the protocol was never designed to guard against:

• Location disclosure — the IMSI can be used to query MAP-ATI (AnyTimeInterrogation) or Provide Subscriber Info against the serving MSC, returning a cell tower ID and approximate location
• SMS routing manipulation — a rogue node can register a fake MSC for that IMSI, redirecting incoming SMS
• Call signaling redirection — combined with IMSI-level roaming messages, call routing can be altered at the signaling layer