I'm trying to determine if it should be possible for a cell phone app to relay custom data along with a phone call. By "should be possible" I mean that I'm not trying to learn how to do it in iOS/Android/whatever, I'm just trying to determine if:

  • It is permitted by standards: the standards for the metadata that initiates a phone call allow for it to be extended. (I found all kinds of information about high level phone call APIs and CDRs which are kept after a phone call is made, but nothing in the "this is the data header that leaves your phone when you make a call" category).
  • I can be sure that my custom data will be forwarded intact by the cellular network nodes.
  • This type of functionality is typically available to apps (from my research: some cellular functionality is implemented by firmware, other functionality has legal issues and its APIs are restricted to privileged users).

In short, what I would ideally like to hear is something along the lines of: "When you initiate a phone call, the phone generates this header. This part of the header can be used to send custom data, and cellular network nodes won't mess with it. The API for this should be available; for example on iOS/Android/whatever we have xyz()".

  • I'd start by poking into caller id spoofing and looking at what data is there (and the associated protocols that it uses). – user40980 Sep 16 '14 at 22:31
  • 1
    Also, what are the restrictions on the caller and callee? An analog telephone isn't going to have caller id for example, but it appears you have some minimum client requirements in mind. – J Trana Sep 17 '14 at 1:55
  • Isn't that what SIP does? Wouldn't you use instant messaging for private data? – david.pfx Sep 17 '14 at 5:05
  • 1
    "I can be sure that my custom data will be forwarded intact by the cellular network nodes." - it's not just the cellular network you'd need to worry about. Depending on where the recipient is, the call could pass over any arbitrarily-poor-quality POTS, which I would guess would guarantee that there's no sideband guaranteed to be available. This is however just a guess. – AakashM Sep 17 '14 at 12:46
  • 1
    Won't this depend on the technology used? I would be surprised if GSM, UMTS and IS-95 all had the same headers. – svick Sep 20 '14 at 12:03

If you want a canonical answer, I think you may need to go to the various standards that define the cell phone network, such as ITU-T, 3GPP, UMTS, etc. They're not light reading and some of them are fairly expensive to obtain.

My understanding is that in classic GSM/3G/ISDN/UMTS/etc. call initiation, there is very little metadata beyond the dialed phone number: there might be a call type (voice/data), an extension/subaddress/DID, possibly an indication of what ring pattern to use, things like that. (And of course in POTS there's no metadata at all.) 3GPP TS 24.008 might be a good place to start looking; it contains the formats of the actual radio packets that are sent and received to set up or tear down a voice call.

I'm not familiar with the newer (4G, LTE, etc) interfaces and they might be able to carry more call metadata, but whether metadata sent by one handset will make it across the network to another handset, or whether any phones have APIs to send or receive that data, is another question.


The metadata of a call will only be the bare minimum data required to make the call. So the capabilities of the origination point and the intended endpoint.

Everything else would be added by the network and including any extra data should be stripped to avoid XSS attacks like this one on Who.Is.


So I went and looked at 3GPP TS 24.008 and I found :

For mobile stations supporting eMLPP basic calls may optionally have an associated priority level as defined in 3GPP TS 23.067 [88]. This information may also lead to specified qualities of service to be provided by the MM sublayer.

That led me to http://www.scribd.com/doc/59337149/Enhanced-Multi-Level-Precedence-and-Preemption ; it appears that this feature already exists. Finding a network that will let you use it is probably another matter.

The actual payload messages are right there in the 3GPP document, e.g. p371 "Table 9.70a/3GPP TS 24.008: SETUP message content (mobile station to network direction)". It looks at first glance there may be exploitable fields for mobile-mobile calls such as the "user-user" field.

It is pretty much guaranteed that you won't be able to alter these messages without hacking the baseband software of your mobile phone. Doing so will invalidate its network certification. It definitely will not be available to apps.


My understanding is that the switching that happens in the background uses nothing but the phone number and a short prefix. The prefix generally contains routing information.

When a switch receives a number, it strips the prefix and parses it, decides on where to route the call and passes it on. It may or may not add another prefix it expects the next router in the chain to understand.

Given the above, I'm not sure how you could fit metadata into the call.

Source: my experience writing software that manages VOIP dialing campaigns and wholesale route sales.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.