# Diameter Signaling Fundamentals

- Canonical URL: https://www.broadnet.me/academy/diameter-signaling-fundamentals
- Language: en
- Last updated: 2026-07-18
- Publisher: BroadNet (https://www.broadnet.me)
- Markdown version of the page above, generated from the rendered page.

Signalling Advanced

The signalling protocol of 4G/LTE and IMS — the Diameter base protocol, AVPs, the S6a/HSS authentication interface, Gx/Gy policy and charging, Cx/IMS, and roaming DRA/DEA security.

5 lessons 5 min read Standards-based · self-paced

What you'll learn

- What Diameter is and why it replaced RADIUS for 4G/LTE and IMS
- The base protocol: peers, realms, request/answer, and reliable transport
- AVPs, command codes, and application IDs — how a Diameter message is built
- The S6a/S6d interface to the HSS for LTE authentication and subscription data
- Gx/Gy policy and charging, the Cx/IMS interface, and roaming DRA/DEA security

Course outline

1. 01What Diameter is
2. 02AVPs, command codes, and applications
3. 03S6a/S6d and the HSS
4. 04Gx and Gy — policy and charging
5. 05Cx/IMS and roaming DRA/DEA security
6. ★Key takeaways

[All courses](https://www.broadnet.me/academy)

Lesson 01

## What Diameter is

Diameter is the authentication, authorization, and accounting (AAA) signalling protocol that 4G/LTE and IMS networks use where earlier networks used SS7/MAP. Defined by the IETF in RFC 6733 (which obsoleted the original RFC 3588), it is the evolved successor to RADIUS — the name is an engineering pun, twice the RADIUS.

Unlike SS7, Diameter is an IP-native, peer-to-peer protocol that runs over a reliable transport (TCP or SCTP) and mandates transport-level security (TLS or IPsec). Every node is a Diameter peer identified by a Diameter Identity and grouped into a realm, and peers discover and connect to each other rather than routing over fixed point codes.

Messages come in request/answer pairs distinguished by an application. The base protocol handles the machinery — capability exchange (CER/CEA), keepalives (DWR/DWA), and disconnect (DPR/DPA) — while each 3GPP interface (S6a, Gx, Gy, Cx) is a Diameter application layered on top. Understanding the base is the prerequisite for every interface that follows.

Lesson 02

## AVPs, command codes, and applications

A Diameter message is a header plus a list of Attribute-Value Pairs (AVPs). The AVP is the fundamental unit of data: each carries an AVP code, flags (including the mandatory 'M' bit), a length, and a value, and AVPs can be grouped to nest structured data. Vendor-specific AVPs (3GPP is vendor 10415) extend the standard set for mobile use.

The header carries a Command Code that names the operation and an Application-Id that scopes it. A request and its answer share the same command code and hop-by-hop and end-to-end identifiers, which is how a node correlates an answer to the request it sent and detects duplicates.

Result-Code AVPs report outcome in classes mirroring HTTP intent — 2xxx success, 3xxx protocol errors, 4xxx transient failures, 5xxx permanent failures — so an integrator reads the class first, then the specific code. Getting the mandatory AVPs and their exact grouping right is the difference between an interface that interworks and one an operator's peer silently rejects.

Lesson 03

## S6a/S6d and the HSS

S6a is the Diameter interface between the MME (Mobility Management Entity) and the HSS (Home Subscriber Server) in an LTE core; S6d is the equivalent toward the SGSN. It is the LTE analogue of the SS7/MAP interface to the HLR, and the HSS is the evolved, IMS-aware successor to the HLR.

The core exchanges are subscriber authentication and location management. The MME requests authentication vectors with Authentication-Information-Request/Answer (AIR/AIA), registers the subscriber's location with Update-Location-Request/Answer (ULR/ULA) and receives the subscription profile, and the HSS can push changes or force a detach with Insert- and Cancel-Location messages. These are specified in 3GPP TS 29.272.

Because S6a carries authentication material and subscriber identity, it is a high-value target at network borders — the Diameter counterpart to the SS7 abuses that drove signalling firewalls. That is why roaming Diameter traffic is filtered and screened at the edge, covered in the roaming-security lesson.

Lesson 04

## Gx and Gy — policy and charging

Policy and charging control (PCC) is where Diameter shapes what a subscriber's session is allowed to do. The Gx interface connects the PCEF (Policy and Charging Enforcement Function, in the PDN gateway) to the PCRF (Policy and Charging Rules Function), which installs PCC rules governing bandwidth (QoS), gating, and per-application treatment via Credit-Control-Request/Answer (CCR/CCA) exchanges.

Gy is the online-charging interface between the PCEF and the OCS (Online Charging System). It uses the Diameter Credit-Control Application (RFC 4006) to reserve, grant, and debit quota in real time — the mechanism behind prepaid data, where a session is cut off or throttled the moment its allowance is exhausted.

Offline charging uses the Rf interface toward the CGF/CDF, producing charging records for post-processing rather than real-time control. The distinction — Gy reserves credit before the fact, Rf records usage after it — is the practical dividing line between prepaid and postpaid handling.

Lesson 05

## Cx/IMS and roaming DRA/DEA security

In IMS, Diameter's Cx interface connects the I-CSCF and S-CSCF call-session control functions to the HSS, handling user registration, authentication (multimedia auth via MAR/MAA), and server assignment (SAR/SAA). This is what lets IMS authenticate a subscriber and locate the serving node for VoLTE and other IMS services, complementing the SIP signalling that controls the session itself.

At the network edge, the Diameter Routing Agent (DRA) provides central routing so nodes need not maintain a full peer mesh, and the Diameter Edge Agent (DEA) is the border element that terminates and screens inbound roaming Diameter traffic. The DEA is where topology hiding, rate limiting, and message screening are enforced.

The security concern mirrors SS7: the original trust-every-peer assumption fails on an open interconnect, so GSMA guidance (the FS.19 Diameter interconnect security profile) defines category-based filtering — which messages may legitimately arrive from a roaming partner versus only from inside the home network. A Diameter edge that skips this screening is exposed to the same location-tracking and interception abuses that signalling firewalls were built to stop.

Key takeaways

- Diameter (RFC 6733) is the IP-native AAA signalling protocol of 4G/LTE and IMS, the evolved successor to RADIUS.
- Messages are AVPs under a command code and application id; result-code classes (2xxx–5xxx) report outcome.
- S6a/S6d carry LTE authentication and subscription data between MME/SGSN and the HSS (the evolved HLR).
- Gx/Gy handle policy and online charging; Cx serves IMS; DRA/DEA plus GSMA FS.19 screening secure roaming.

Keep going

### Related answers, products & tools

- [Diameter base protocol](https://www.broadnet.me/reference/diameter-base-protocol)
- [Diameter AVPs & message format](https://www.broadnet.me/reference/diameter-avps-and-message-format)
- [Diameter S6a/S6d & the HSS](https://www.broadnet.me/reference/diameter-s6a-s6d-hss)
- [Diameter Gx/Gy policy & charging](https://www.broadnet.me/reference/diameter-gx-gy-policy-charging)
- [Diameter Cx/Dx & IMS](https://www.broadnet.me/reference/diameter-cx-dx-ims)
- [Diameter roaming security (DRA/DEA)](https://www.broadnet.me/reference/diameter-roaming-security-dra-dea)
- [SS7 Firewall (operators)](https://www.broadnet.me/operators/ss7-firewall)

References

- [RFC 6733 — Diameter Base Protocol](https://datatracker.ietf.org/doc/html/rfc6733)
- [3GPP TS 29.272 — MME/SGSN–HSS (S6a/S6d) Diameter](https://www.3gpp.org/dynareport/29272.htm)

Up next in the curriculum

[Beginner · Foundations Introduction to CPaaS What a Communications Platform as a Service is, the building blocks it exposes, and how an API call becomes a message on a handset.](https://www.broadnet.me/academy/introduction-to-cpaas) [Beginner · Foundations SMS Fundamentals How an SMS is built, encoded, and segmented — from the 160-character limit and GSM 03.38 to delivery receipts and A2P vs P2P.](https://www.broadnet.me/academy/sms-fundamentals)

Put it into practice

## Build with what you just learned.

Talk to a real engineer about your use case, or open the developer docs and send a message across the routes this course describes.

[Talk to engineering](https://www.broadnet.me/contact) [Developer docs](https://www.broadnet.me/developers)

Why learn from BroadNet

- Since 2003
- Countries 200+
- Operator links 1,000+