The PLMN full form is the public land mobile network.  A PLMN is the area of land covered by a mobile operator for voice and data services to a mobile subscriber using a SIM card.  A PLMN connects to other PLMNs for providing inter operators roaming services. Identified by the Mobile Country Code (MCC ) and Mobile network code (MNC), the MCC and MNC combination is PLMN id. From the IMSI of a SIM card, home PLMN can be identified. The home PLMN of a mobile subscriber is called HPLMN, which has subscription profiles of subscribers in the HLR.  A mobile operator may multiple PLMNs in a country with a different mobile network code or MCC.


Every SIM card has an HPLMN, where the subscriber profile is configured.  While roaming, subscriber changes the location, this may change in roaming PLMN. The new one may be the same as HPLMN or its other network’s PLMN.  If an Airtel sim card is purchased from New Delhi, India. Subscriber’s  HPLMM is New Delhi, India.

HLR is the node in HPLMN,  where a new subscriber has all subscription information (SMS, Data, Voice), and the sim card keeps updating its location to the HLR during roaming.  The home network has message and billing nodes.

The SMSC is for messging and IN-SCP is for real time chanrging.


In roaming,  a subscriber attaches to the core network via the access network. The roaming core network belongs to a PLMN. This is called Visiting Public Land Mobile Network or VPLMN.  The VPLMN and HPLMN can be the same or different, depends upon the location of the mobile phone and the serving mobile operator. A mobile operator has VPLMN based changing and roaming policies.

PLMN network id:

For any network, there is an identifier. PLMN network id for a mobile network identifies the roaming location uniquely. An integer value contains MCC and MNC.  To transfer vale on the wire, fixed decoding is done.  Decoding is defined in the 3GPP spec.


MCC Digit1 MCC Digit1
MNC Digit 3 MCC Digit1
MNC Digit 2 MNC Digit 1

The 3GPP has specified a diameter AVP called Visited PLMN id, contains the MCC-MNC in encoded format. Whenever a UE attaches to the LET network over the 3GPP s6a interface.  Messages from MME to the HSS over diameter protocol have Visited PLMN Id AVP.

In the case of 3G, the PLMN id is present with roaming VLR information.

The HPLMN network id is derived from the IMSI, and VPLMN network id is derived from the roaming information present in information while subscriber attaches to the network.

Now how to decode PLMN id?

For a typical user, it is not possible to get MCC and MNC from an encoded value. Here we are showing an example program in C++ for getting MCC and MNC from an encoded buffer.

#include <iostream>
#include <string>

using namespace std;

int main ()

unsigned char plmn_id[] = {0x31, 0xf4, 0x01}; /* Encoded PLMN Id */
string mcc, mnc;
unsigned char ch = 0;
int i;

/* First Digit of MNC */
ch = plmn_id[0] & 0xf;
mcc.push_back(ch + '0');

ch = (plmn_id[0] & 0xf0) >> 4;
mcc.push_back(ch + '0');

ch = plmn_id[1] & 0xf;
mcc.push_back(ch + '0');

/* DEcoding MNC 8 */

ch = plmn_id[2] & 0xf;
mnc.push_back(ch + '0');

ch = (plmn_id[2] & 0xf0) >> 4;
mnc.push_back(ch + '0');

ch = (plmn_id[1] & 0xf0) >> 4;
if(ch != 0x0f)
/* If MNC is 3 digits log */
mnc.push_back(ch + '0');
cout << "MCC = "<< mcc <<":" << "MNC = " << mnc << endl;

return 0;

After compilation and execution the display will be :
#g++ -o plmndecoded decodePlmnId.cpp
# ./plmndecoded
MCC = 134:MNC = 10

Elements of PLMN: 

There are multiple components of a public land mobile network. These can be divided into two groups. One is the access network, and the other is the core network.

Access network connects the phone to the core network.  The phone connects to the access network over wireless or radio interface.  The core network connects to the access network over a wired interface. The common access network is used to packet-switched and circuit-switched services. Each generation of mobile telephony has a different access network.  The following mentions the generation and access network types.

GERAN, 2G access network. BTS and BSC are nodes that cover the access network.

UTRAN: This the access network for 3G. RAN and NodeB are two nodes in the UTRAN access network.

E-UTRAN: Its the access network for LTE. eNodeB is the node that is in the access network.

Core network, does the signaling for setup voice and mobile internet communication.  A signaling network is the control plane, and the actual data or voice network is the user plane.  In 2G/3G, there are separate nodes for circuit and packet services.  MSC is for circuit switching or voice and SGSN for packet switching or the internet in 2G and 3G. While attaching to a VPLMN, SIM card sends authentication and update location request to the HPLNM.  The home PLMN has the configuration of the subscriber for authentication, billing, roaming, and messaging.

Home PLMN may have inbound roamers or outbound roamers. If a mobile subscriber roaming in another PLMN, then its called inbound roamer for the roaming network. It is an inbound roamer from the mobile SIM provider’s home network.  Both network operators should have a roaming agreement.

Call Barring Outside Home PLMN:

Mobile operators can block the incoming or outgoing calls if a subscriber is roaming outside the home network. There are two supplementary services described in GSM. HLR has provisioning information for the services.  The following is the detailed description.

Barring of all incoming calls when roaming outside HPLMN.

This disables a mobile subscriber to make a call when VPLMN is different from HPLMN. This is useful where national roaming needs to control. In national roaming, MCC remains the same, but MNC code changes.

Barring of outgoing calls not directed to Home PLMN country: Supplementary service blocks all outgoing calls those are not dialed to the home country. This service comes into picture when subscribers roam to another country.

Leave a Comment