Which messages flow between phone, MSC, and HLR during a GSM Location Update, and over which radio channels does it start?
The phone requests a channel on the RACH, receives a dedicated channel (SDCCH), and sends an MM Location Update; the MSC then talks MAP to the HLR (Send Authentication, Update Location, Insert Subscriber Data) before returning ACCEPT or REJECT.
* RACH to SDCCH to MM Location Update to MAP-to-HLR. *
The radio-side start:
- The MS sends a channel request over the RACH (Random Access Channel) — triggered when entering a new Location Area or by the periodic timer
- It immediately receives a channel assignment
- It sends the MM Location Update Request over the assigned dedicated channel (SDCCH)
The core-side message flow:
MS → BTS/BSC → MSC: MM Location Update
MSC → HLR: 1. MAP Send Authentication (fetch auth data)
2. MAP Update Location (record new location)
HLR → MSC: MAP Insert Subscriber Data (push subscriber profile)
MSC → MS: MM Location Update Response: ACCEPT (or REJECT)
Reading the protocol names: MM = Mobility Management (the phone↔network layer), MAP = Mobile Application Part (the core-network protocol between MSC and HLR, running over SS7). The Location Update is where these two protocol worlds meet — and the response can be REJECT, e.g. for forbidden networks or failed authentication.
Go deeper:
Harald Welte — What happens on a protocol level when I switch on my phone? (CCC, 2018) — watch this exact RACH → SDCCH → MM Location Update → MAP-to-HLR exchange traced live, message by message.
GSM procedures — the IMSI-attach call flow (Wikipedia) — the full ~19-step sequence: Channel Request on RACH, Immediate Assignment of an SDCCH, authentication triplets (RAND/Kc/SRES) from the AuC, cipher mode, TMSI assignment, then Update Location to the HLR.
GSM network architecture (Electronics Notes) — diagram of the MS↔BTS↔BSC↔MSC path plus HLR/VLR/AuC, so you can see which box each MAP message is travelling between.