How does LTE configure the control plane and the data-plane tunnels for a mobile in a visited network?
Control plane: the mobile talks to the local MME, which uses the IMSI to contact the home HSS and retrieve authentication, encryption, and service data. Data plane: two GTP tunnels — S-GW to base station (endpoint swapped on every cell change) and S-GW to home P-GW (the indirect-routing leg).
* GTP tunnelling: the user's datagram rides inside GTP, inside UDP, inside an outer IP datagram. *
Control-plane configuration:
- The mobile communicates with the local MME via the base station's control-plane channel
- The MME uses the mobile's IMSI to contact the home HSS and retrieve authentication, encryption, and network service information
- The home HSS now knows the mobile is resident in the visited network
- Base station and mobile select parameters for the data-plane radio channel
Data-plane tunnels (two of them):
| Tunnel | Purpose |
|---|---|
| S-GW ↔ base station | When the mobile changes base stations, the network simply changes the tunnel's endpoint IP address — handover made cheap |
| S-GW ↔ home P-GW | The implementation of indirect routing — traffic still flows via the home network's gateway |
The encapsulation: tunneling uses GTP (GPRS Tunneling Protocol) — the mobile's datagram to a server is encapsulated using GTP, inside UDP, inside an IP datagram. (Yes, the protocol name still says GPRS — 2.5G's tunneling protocol lives on inside 4G.)
Key insight: the two-tunnel design splits mobility into two independent problems: local movement (re-point tunnel 1) and reachability from home (tunnel 2 stays put).
Go deeper:
The Linux kernel GTP tunnelling module (kernel.org) — a primary, implementation-level reference: GTP-U vs GTP-C, the TEID, and why the receiver demuxes tunnels purely by TEID.- GPRS Tunnelling Protocol (Wikipedia) — the GTP-C/GTP-U split and how the same protocol carries user traffic across GSM, UMTS, LTE and 5G cores.