PLMN full form is the public land mobile network.  Is the area or land covered by a mobile operator for voice and data services to a mobile subscriber using SIM card.  A PLMN connects to other PLMNs for providing inter operators roaming services. Identified by the Mobile Country Code (MCC ) and Mobile network code (MNC), the mcc and mnc combination is plmnid. From the IMSI of a SIM card , its base PLMN can be identified. The base PLMN of a mobile subscriber is called HPLMN or home  plmn. A mobile operator may multiple PLMNs in a country with different mobile network code or MCC.


Every SIM card have an HPLMN, where the subscriber profile is configured.  While roaming, subscriber changes the location, this may change in roaming plmn. The new one may be same as hplmn or its other network's plmn.  If an Airtel sim card is purchased from New Delhi, India. Subscriber's  HPLMM is New Delhi, India.

HLR is the node in HPLMN,  where a new subscriber is configured and sim card updates its location to the HLR during roaming.  Home network have messaging and billing nodes. For messaging , SMSC and for charging IN-SCP.


In roaming,  a subscriber attaches to the core network via access network. Roaming core network belongs to a PLMN. This is called Visiting Public Land Mobile Network or VPLMN.  The VPLMN and HPLMN can be the same or different, depends upon the location of mobile phone and the serving mobile operator. A mobile operator have VPLMN based changing and roaming policies.

PLMN network id:

For any network there is an identifier. PLMN network id for a mobile network, identifies the roaming location uniquely. An integer value,  contains MCC and MNC.  To transfer vale on wire, a fix decoding is done.  Decoding is defined in 3GPP spec .


MCC Digit1 MCC Digit1
MNC Digit 3 MCC Digit1
MNC Digit 2 MNC Digit 1

The 3GPP have specified a diameter AVP called Visited PLMN id, contains the mcc mnc in encoded format. Whenever an UE attaches to the LET network over 3GPP s6a interface.  Messages from MME to the HSS over diameter protocol have Visited PLMN Id avp.

In case of 3G , the PLMN id is present with roaming VLR information.

The HPLMN network id is derived from the IMSI and VPLMN network id is derived from the roaming information present in information while subscriber attaches to the network.

Now how to decode PLMN id ?

For a common user it is not possible to get MCC and MNC from a encoded value. Here we are showing an example program in C++ for getting MCC and MNC from encoded buffer.

#include <iostream>
#include <string>

using namespace std;

int main ()

unsigned char plmn_id[] = {0x31, 0xf4, 0x01}; /* Encoded PLMN Id */
string mcc, mnc;
unsigned char ch = 0;
int i;

/* First Digit of MNC */
ch = plmn_id[0] & 0xf;
mcc.push_back(ch + '0');

ch = (plmn_id[0] & 0xf0) >> 4;
mcc.push_back(ch + '0');

ch = plmn_id[1] & 0xf;
mcc.push_back(ch + '0');

/* DEcoding MNC 8 */

ch = plmn_id[2] & 0xf;
mnc.push_back(ch + '0');

ch = (plmn_id[2] & 0xf0) >> 4;
mnc.push_back(ch + '0');

ch = (plmn_id[1] & 0xf0) >> 4;
if(ch != 0x0f)
/* If MNC is 3 digits log */
mnc.push_back(ch + '0');
cout << "MCC = "<< mcc <<":" << "MNC = " << mnc << endl;

return 0;

After compilation and execution the display will be :
#g++ -o plmndecoded decodePlmnId.cpp
# ./plmndecoded
MCC = 134:MNC = 10

Elements of PLMN: 

There are multiple components of a public land mobile network. These can be divided into two groups. One is access network and other is the core network.

Access network connects the phone to the core network.  The phone connects to access network over wireless or radio interface.  Core network connects to the access network over wired interface. The common access network is used to packet switched and circuit switched services. Each generation of mobile telephony has different access network.  Following mentions the generation and access network types.

GERAN, 2G access network. BTS and BSC are nodes which covers the access network.

UTRAN: This the access network for 3G. RAN and NodeB are two nodes in UTRAN access network.

E-UTRAN : Its the access network for LTE. ENodeB is the node which is in access network.

Core network, does the signaling for setup voice and mobile internet communication.  The signaling network is control plane and the actual data or voice network is the user plane.  In 2G/3G there are separate nodes for circuit and packet services.  MSC is for circuit switching or voice and SGSN for packet switching or internet in 2G and 3G. While attaching to a VPLMN ,  SIM card sends authentication and update location request to the HPLNM.  The home plmn have configuration of the subscriber for authentication, billing ,roaming and messaging.

Home plmn may have inbound roamers or outbound roamers. If mobile subscriber roaming in another PLMN , then its called inbound roamer for the roaming network. It is inbound roamer from the mobile SIM provider's home network.  Both network operators should have roaming agreement.

Call Barring Outside Home PLMN:

A mobile operators can block the incoming or outgoing calls , if a subscriber is roaming outside the home network. There are two supplementary services described in GSM. HLR have the provisioning information for the services.  Following is the detail description.

Barring of all incoming calls when roaming outside HPLMN. This disable a mobile subscriber to make a call when VPLMN is different from HPLMN. This is useful where national roaming needs to control. In national roaming, MCC remains same , but MNC code changes.

Barring of outgoing calls not directed to Home PLMN country: Supplementary service blocks all outgoing calls those are not dialed to the home country. This services comes into picture when subscribers roams to another country.

Leave a Comment

Your email address will not be published. Required fields are marked *