3GPP TS 29.274 V18 — GTPv2-C (Control Plane)

Q: What does the Scope section cover in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane)?

The Scope section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the GTPv2-C Overview section cover in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane)?

The GTPv2-C Overview section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the GTPv2-C Header Format section cover in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane)?

The GTPv2-C Header Format section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the Key Information Elements section cover in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane)?

The Key Information Elements section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane). This content is part of the BLACKLABS 3GPP Security Library.

Q: What does the GTPv2-C Procedures section cover in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane)?

The GTPv2-C Procedures section provides detailed technical specifications, security considerations, and implementation guidance as documented in 3GPP TS 29.274 V18 — GTPv2-C (Control Plane). This content is part of the BLACKLABS 3GPP Security Library.

BLACKLABS

3GPP TS 29.274

Evolved Packet System (EPS) — GTPv2-C Protocol on Control Plane Interfaces

V18.7.0 (2024-12) — Release 18 Protocol Specification

1. Scope

▶

Defines the GTPv2-C protocol used for signaling on control plane interfaces in EPC and for interworking with 5GC. GTPv2-C manages the lifecycle of GTP tunnels — creation, modification, and deletion of bearers/sessions — and carries mobility management signaling between core network nodes.

Key Distinction: GTPv2-C (this spec) is the signaling protocol that sets up and tears down tunnels. TS 29.281 (GTPv1-U) is the data plane protocol that carries user traffic through those tunnels.

5G Context: In 5G standalone, PFCP (TS 29.244) replaces GTPv2-C for SMF↔UPF signaling. However, GTPv2-C remains on S5/S8, S11, S10, S3, S4, S16 interfaces in EPC and is critical for 4G/5G interworking (N26 interface).

4. GTPv2-C Overview

▶

4.1 Control Plane Interfaces

▶

Interface	Endpoints	Function
S11	MME ↔ SGW	Bearer/session management, handover, paging
S5/S8	SGW ↔ PGW	Bearer creation/modification, PGW-initiated signaling
S10	MME ↔ MME	Inter-MME handover, context transfer
S3	MME ↔ SGSN	EPC ↔ GPRS interworking
S4	SGSN ↔ SGW	SGSN-based mobility to EPC
S16	SGSN ↔ SGSN	Inter-SGSN mobility
N26	AMF ↔ MME	5G↔4G interworking (idle/connected mode)
Sm/Sn	MBMS GW ↔ MME/SGSN	Multicast bearer management

4.2 Protocol Stack

▶

┌─────────────────────────────────────────────────────────────────┐ │ GTPv2-C Messages (IEs) │ ├─────────────────────────────────────────────────────────────────┤ │ GTPv2-C Header (12 bytes) │ ├─────────────────────────────────────────────────────────────────┤ │ UDP (port 2123) │ ├─────────────────────────────────────────────────────────────────┤ │ IP (v4 or v6) │ └─────────────────────────────────────────────────────────────────┘ EPC Architecture with GTPv2-C: UE ─── eNB ─── S1-MME ──► MME ════ S11 ════► SGW ════ S5 ════► PGW ║ ║ S1-U (GTP-U) SGi (native) ║ eNB ═══ = GTPv2-C signaling (UDP 2123) ═║═ = GTP-U data (UDP 2152)

5. GTPv2-C Header Format

▶

0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |Ver |P| T |MP | Spare | Message Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Message Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | TEID (if T=1) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Sequence Number | Spare | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Field	Bits	Description
Version	3	Must be 2
P (Piggybacking)	1	1 = piggybacked message follows
T (TEID flag)	1	1 = TEID field present (session-related); 0 = absent (path management)
MP (Message Priority)	1	Priority indicator (Rel-14+)
Message Type	8	Procedure type (see §7)
Message Length	16	Bytes after the TEID or Sequence Number field
TEID	32	Tunnel Endpoint Identifier (when T=1)
Sequence Number	24	Transaction identifier — matches request/response

6. Key Information Elements

▶

GTPv2-C uses TLV (Type-Length-Value) encoded Information Elements. IEs are grouped for bearer-level information.

IE Type	Name	Key Content
1	IMSI	Subscriber identity (BCD encoded)
2	Cause	Result code for responses (accept/reject/error)
3	Recovery	Restart counter for path management
71	APN	Access Point Name — identifies PDN
73	EBI	EPS Bearer Identity (5-15)
74	IP Address	Peer address for user plane (F-TEID)
77	Indication	Feature flags (dual address, handover, etc.)
80	Bearer QoS	QCI, ARP, MBR, GBR for the bearer
82	RAT Type	EUTRAN, NR, WLAN, etc.
83	Serving Network	MCC+MNC of serving PLMN
86	ULI	User Location Info (TAI, ECGI, NCGI)
87	F-TEID	Fully Qualified TEID — TEID + IP address for GTP-U endpoint
93	Bearer Context	Grouped IE containing per-bearer IEs (F-TEID, QoS, etc.)
99	PDN Address Allocation	IPv4/IPv6 address assigned to UE

F-TEID (IE Type 87) is the critical IE that binds signaling to data plane — it tells the peer which TEID and IP address to use for GTP-U traffic. A compromised F-TEID IE can redirect user traffic.

7. GTPv2-C Procedures

▶

7.1 Create Session Request / Response

▶

Establishes a new PDN connection / bearer context. Triggered by initial attach or additional PDN connection.

UE eNB MME SGW PGW │ │ │ │ │ │─Attach──►│─────────►│ │ │ │ │ │─Create Session Req──────────────►│ │ │ │ (IMSI, APN, Bearer QoS, │ │ │ │ S11 F-TEID, RAT, ULI) │ │ │ │ │ │ │ │ │ │─Create Session Req──►│ │ │ │ │ (S5 F-TEID) │ │ │ │ │ │ │ │ │ │◄─Create Session Rsp──│ │ │ │ │ (S5 PGW F-TEID, │ │ │ │ │ PAA, Bearer Ctx) │ │ │ │◄─Create Session Rsp─────────────│ │ │ │ (S11 SGW F-TEID, │ │ │ │ S1-U SGW F-TEID, │ │ │ │ PAA, Bearer Ctx) │ │ │◄─────────│ │ │ │◄─────────│ │ │ │

Security-critical IEs in Create Session: IMSI (subscriber identity), F-TEIDs (data plane binding), PAA (IP allocation), APN (service selection). All must be validated and protected by IPsec on the GTPv2-C path.

7.2 Modify Bearer Request / Response

▶

Updates bearer context after handover or other mobility event. Key use cases:

Handover (X2/S1): Updates eNB F-TEID after UE moves to new cell
TAU without handover: Updates serving network and ULI
Serving GW relocation: Updates S5/S8 F-TEIDs

Security: Modify Bearer with a spoofed F-TEID can redirect user traffic to an attacker-controlled endpoint. This is a primary GTP-C injection attack vector.

7.3 Delete Session Request / Response

▶

Tears down a PDN connection and all associated bearers/tunnels:

Triggered by UE detach, PDN disconnect, or network-initiated release
Includes EBI to identify which bearer context to delete
PGW releases IP address, SGW deletes S1-U/S5 tunnels, MME updates context

Security: Spoofed Delete Session Requests can terminate active user sessions — a denial-of-service attack. Sequence number validation and IPsec are critical.

7.4 Create Bearer Request / Response

▶

PGW/PCRF-initiated procedure to establish a dedicated bearer with specific QoS (for VoLTE, video, etc.).

PGW sends Create Bearer Request with new bearer QoS and TFT (Traffic Flow Template)
Propagated via SGW to MME to UE for NAS bearer setup
Each dedicated bearer gets its own EBI and GTP-U tunnel (F-TEID pair)

8. Path Management

▶

Message	Type	Purpose
Echo Request	1	Path liveness probe (TEID=0)
Echo Response	2	Response with Recovery IE
Version Not Supported	3	Reject if GTP version mismatch

Same restart detection mechanism as GTP-U: Recovery IE counter change triggers deletion of all sessions on the failed path, followed by re-establishment via MME/SGSN.

9. Security Considerations

▶

GTPv2-C has no built-in security. Like GTP-U, the protocol itself provides no authentication, integrity, or confidentiality. All protection must come from the transport layer (IPsec) or network-level controls.

TR 33.926 §5.3.6.15 GTP control plane injection ▶

TR 33.926 §5.3.3 Man-in-the-middle on GTPv2-C ▶

TR 33.926 §5.3.5 Unauthorized signaling access ▶

GTPv2-C Attack Vectors

Attack	Technique	Impact	Mitigation
Session Hijacking	Spoofed Create/Modify Session with attacker's F-TEID	User traffic redirected to attacker	IPsec, F-TEID validation against source IP
Session Teardown	Spoofed Delete Session Request	DoS — valid sessions terminated	Sequence number validation, IPsec
Subscriber Tracking	Correlate IMSI in Create Session with ULI/TAI	Privacy violation, location tracking	Encrypt GTPv2-C (IPsec), minimize IMSI exposure
Billing Fraud	Modify Bearer QoS to get premium service at lower rate	Financial loss, unfair resource usage	QoS IE validation, PCRF enforcement
Path Reset Attack	Spoofed Echo Response with changed Recovery counter	Mass session deletion on entire path	IPsec, rate-limit recovery processing

Mandatory Security Measures

Measure	Spec	Scope
IPsec ESP on S11, S5/S8, S10	TS 33.210	All EPC GTPv2-C interfaces
IPsec on N26	TS 33.501 §9	5G↔4G interworking
GTP-C filtering at network borders	TS 33.117 §4.2.6	PLMN boundaries
Source IP validation on GTPv2-C messages	TS 33.117	All GTPv2-C recipients
IMSI/TEID correlation checks	Operator security policy	MME, SGW, PGW