GPRS Tunnelling Protocol

GPRS Tunnelling Protocol (GTP) is a group of IP-based communications protocols used to carry general packet radio service (GPRS) within GSM, UMTS, LTE and 5G NR radio networks. In 3GPP architectures, GTP and Proxy Mobile IPv6 based interfaces are specified on various interface points.
GTP can be decomposed into separate protocols, GTP-C, GTP-U and GTP'.
GTP-C is used within the GPRS core network for signaling between gateway GPRS support nodes (GGSN) and serving GPRS support nodes (SGSN). This allows the SGSN to activate a session on a user's behalf (PDP context activation), to deactivate the same session, to adjust quality of service parameters, or to update a session for a subscriber who has just arrived from another SGSN.
GTP-U is used for carrying user data within the GPRS core network and between the radio access network and the core network. The user data transported can be packets in any of IPv4, IPv6, or PPP formats.
GTP' ("GTP prime") uses the same message structure as GTP-C and GTP-U, but has an independent function. It can be used for carrying charging data from the charging data function (CDF) of the GSM or UMTS network to the charging gateway function (CGF). In most cases, this should mean from many individual network elements such as the GGSNs to a centralized computer that delivers the charging data more conveniently to the network operator's billing center.
Different GTP variants are implemented by RNCs, SGSNs, GGSNs and CGFs within 3GPP networks. GPRS mobile stations (MSs) are connected to a SGSN without being aware of GTP.
GTP can be used with UDP or TCP. UDP is either recommended or mandatory, except for tunnelling X.25 in version 0. GTP version 1 is used only on UDP.
General features.
All variants of GTP have certain features in common. The structure of the messages is the same, with a GTP header following the UDP/TCP header.
Header.
GTP version 1.
GTPv1 headers contain the following fields:
Next Extension Headers are as follows:
GTP version 2.
It is also known as evolved-GTP or eGTP. GTPv2-C headers contain the following fields: 
There is no GTPv2-U protocol, GTP-U in LTE also uses GTPv1-U.
Connectivity mechanisms.
Apart from the common message structure, there is also a common mechanism for verifying connectivity from one GSN to another GSN. This uses two messages.
As often as every 60 seconds, a GSN can send an echo request to every other GSN with which it has an active connection. If the other end does not respond it can be treated as down and the active connections to it will be deleted.
Apart from the two messages previously mentioned, there are no other messages common across all GTP variants meaning that, for the most part, they effectively form three completely separate protocols.
GTP-C - GTP control.
The GTP-C protocol is the control section of the GTP standard. When a subscriber requests a PDP context, the SGSN will send a "create PDP context request" GTP-C message to the GGSN giving details of the subscriber's request. The GGSN will then respond with a "create PDP context response" GTP-C message which will either give details of the PDP context actually activated or will indicate a failure and give a reason for that failure. This is a UDP message on port 2123.
The eGTP-C (or, GTPv2-C) protocol is responsible for creating, maintaining and deleting tunnels on multiple Sx interfaces. It is used for the control plane path management, tunnel management and mobility management. It also controls forwarding relocation messages; SRNS context and creating forward tunnels during inter LTE handovers.
GTP-U - GTP user data tunneling.
GTP-U is, in effect a relatively simple IP based tunnelling protocol which permits many tunnels between each set of end points. When used in the UMTS, each subscriber will have one or more tunnel, one for each PDP context that they have active, as well as possibly having separate tunnels for specific connections with different quality of service requirements.
The separate tunnels are identified by a TEID (Tunnel Endpoint Identifier) in the GTP-U messages, which should be a dynamically allocated random number. If this random number is of cryptographic quality, then it will provide a measure of security against certain attacks. Even so, the requirement of the 3GPP standard is that all GTP traffic, including user data should be sent within secure private networks, not directly connected to the Internet. This happens on UDP port 2152.
The GTPv1-U protocol is used to exchange user data over GTP tunnels across the Sx interfaces. An IP packet for a UE (user endpoint) is encapsulated in an GTPv1-U packet and tunnelled between the P-GW and the eNodeB for transmission with respect to a UE over S1-U and S5/S8 interfaces.
GTP' - charging transfer.
The GTP' protocol is used to transfer charging data to the Charging Gateway Function. GTP' uses TCP/UDP port 3386.
Within the GPRS core network.
GTP is the primary protocol used in the GPRS core network. It is the protocol which allows end users of a GSM or UMTS network to move from place to place whilst continuing to connect to the Internet as if from one location at the GGSN. It does this by carrying the subscriber's data from the subscriber's current SGSN to the GGSN which is handling the subscriber's session. Three forms of GTP are used by the GPRS core network.
GGSNs and SGSNs (collectively known as GSNs) listen for GTP-C messages on UDP port 2123 and for GTP-U messages on port 2152. This communication happens within a single network or may, in the case of international roaming, happen internationally, probably across a GPRS roaming exchange (GRX).
The "Charging Gateway Function" (CGF) listens to GTP' messages sent from the GSNs on TCP/UDP port 3386. The core network sends charging information to the CGF, typically including PDP context activation times and the quantity of data which the end user has transferred. However, this communication which occurs within one network is less standardized and may, depending on the vendor and configuration options, use proprietary encoding or even an entirely proprietary system.
Use on the IuPS interface.
GTP-U is used on the IuPS between the GPRS core network and the RAN, however the GTP-C protocol is not used. In this case, RANAP is used as a control protocol and establishes GTP-U tunnels between the SGSN and the radio network controller (RNC).
Protocol Stack.
GTP can be used with UDP or TCP. GTP version 1 is used only on UDP.
 there are three versions defined, versions 0, 1 and 2. Version 0 and version 1 differ considerably in structure. In version 0, the signalling protocol (the protocol which sets up the tunnels by activating the PDP context) is combined with the tunnelling protocol on one port. Versions 1 and 2 are each effectively two protocols, one for "control" (called GTP-C) and one for "user" data tunneling (called GTP-U). GTP version 2 is different to version 1 only in GTP-C. This is due to 3GPP defining enhancements to GTP-C for EPS in version 2 to improve bearer handling.
GTP-U is also used to transport user data from the RNC to the SGSN in UMTS networks. However, in this case signalling is done using RANAP instead of GTP-C.
Historical GTP versions.
The original version of GTP (version 0) had considerable differences from the current versions (versions 1,2):
The non-random TEID in version 0 represented a security problem if an attacker had access to any roaming partner's network, or could find some other way to remotely send packets to the GPRS backbone. Version 0 is going out of use and being replaced by version 1 in almost all networks. Fortunately, however the use of different port numbers allows easy blocking of version 0 through simple IP access lists.
GTP standardization.
GTP was originally standardized within ETSI (GSM standard 09.60 ). With the creation of the UMTS standards this was moved over to the 3GPP which, maintains it as 3GPP standard 29.060. GTP' uses the same message format, but its special uses are covered in standard 32.295 along with the standardized formats for the charging data it transfers.
Later versions of TS 29.060 deprecate GTPv1/v0 interworking such that there is no fallback in the event that the GSN does not support the higher version.
GTPv2 (for evolved packet services) went into draft in early 2008 and was released in December of that year. GTPv2 offers fallback to GTPv1 via the earlier "Version Not Supported" mechanism but explicitly offers no support for fallback to GTPv0.