An SMPP PDU cannot be transmitted unless the connection between the ESME and the SMSC is established. This is usually done by using the TCP 3-way handshake (SYN, SYN-ACK, ACK).
The address_range parameter is used in the bind_receiver and bind_transceiver command to specify a set of SME's (MS or ESME) addresses serviced by the ESME client. Messages addressed to any destination in this range shall be routed to the ESME. The range is specified using a regular expression, however, for IP addresses, it is only possible to specify a single IP address. Also, IPv6 is not currently supported in this version of the protocol.
That being said, almost all of the SMSC's ignore the addr_range field in the bind command as they will not relinquish routing control to an ESME for preventing of mis-routing messages. Hence, this field is mostly set to NULL.
Routing between an SMSC and an ESME is usually done using 'short codes'. The service provider (SMSC) assigns one unique short code to an ESME. The SMSC maintains a list of all bound ESME addresses and maps the corresponding short codes against them. Whenever a message is sent to a short code, the destination, i.e. the short code is translated to a valid ESME address which can be routed on the network.
Routing of SMS towards an MS-SME in cellular networks is performed by querying the Home Location Register (HLR) on the MAP/SS7(or SIGTRAN) interface for finding out the location of the subscriber.