Everything worth knowing, nothing that isn't.
How it relates to SMS
On 4G-only handsets, SMS uses either SGs (which falls back through MAP on the MSC) or SMS-over-IMS. In the SGs case the MME proxies signalling to the SMSC over the SGd interface, which is Diameter-encoded. The HSS exchange to find the serving MME for an MT delivery is over S6a.
Diameter Edge Agent
Operators terminate inbound S6a from roaming partners at a Diameter Edge Agent (DEA), which acts as a firewall, topology hider, and rate-limiter. The DEA is to Diameter what the STP+firewall is to SS7. GSMA FS.19 is the reference document for Diameter signalling security.
Common attacks and mitigations
Diameter is vulnerable to similar tracking and interception attacks as SS7 — Update-Location-Request can be abused to redirect a subscriber's signalling to an attacker-controlled MME. Mitigations: cross-check the realm and IMSI in the AVP, enforce roaming agreement whitelists at the DEA, alert on Update-Location bursts. BroadNet operates a Diameter firewall product alongside its SS7 firewall for operators that have moved A2P delivery to SMS-over-IP.
What buyers should ask
If you are a messaging customer, you almost never see Diameter directly — your CPaaS speaks SMPP and the operator does the protocol translation. If you are an operator buying a firewall, demand that the vendor inspect both SS7 MAP and Diameter S6a/SGd in the same policy engine, with shared subscriber reputation. Split stacks create policy drift.