In short
Global Title filtering evaluates signaling sources and destinations using Global Title information and operator-defined policies. It can help identify unauthorised networks, unexpected routing behaviour, spoofing attempts and suspicious signaling sources, because the Global Title is the closest thing SS7 has to a statement of where a message came from.
What a Global Title actually asserts
A Global Title is an E.164-style address carried in the SCCP calling and called party fields. It identifies the node that is sending or should receive the signaling — an SMSC, an HLR, an STP. Because international SMS routing depends on GT translation, the calling-party GT is effectively the sender's claim about which network it belongs to.
The important word is claim. SS7 has no cryptographic binding between a node and the address it presents, which is why filtering exists at all.
How filtering policy is built
Effective GT policy is built from what the operator actually knows about its interconnects rather than from a generic blocklist:
- Allowed GT ranges per interconnect partner and per roaming agreement
- Expected operation types from each source — a partner with no SMS agreement should not be issuing MT-ForwardSM
- Expected country and network correspondence between the GT and the traffic it carries
- Volume and velocity envelopes per GT, so a normally quiet source raises an alert when it surges
- Consistency between the originating GT and the Sender IDs and destinations present in the traffic
Where GT evidence is decisive
GT analysis is the clearest evidence available for two specific bypass patterns. The first is unauthorised termination, where commercial traffic arrives from a network with no A2P agreement in place. The second is GT spoofing, where a forged calling-party address is used to impersonate a network that does have one.
In the second case the forgery usually fails on correspondence rather than on the address itself: the claimed network does not normally send this Sender ID, at this hour, to these destinations, at this volume.
Its limits
GT filtering says nothing about content, and it is weakest against traffic that enters legitimately and is abused afterwards — an authorised partner reselling capacity to an aggregator the operator has never approved. It is a necessary control, not a sufficient one, which is why route testing exists to confirm what actually reached the handset.