# Diameter S6a — the 4G equivalent of MAP

> Diameter S6a is the 3GPP-defined interface between a 4G MME (Mobility Management Entity) and an HSS (Home Subscriber Server). It carries authentication vectors, location updates, and — relevant for messaging — the Send-Routing-Info-for-SM equivalent used when SMS is delivered via SGs or SMS-over-IP. Diameter is to 4G what SS7 MAP is to 2G/3G.

- Canonical URL: https://www.broadnet.me/answers/diameter-s6a-explained
- Language: en
- Last reviewed: 2026-05-27
- Publisher: BroadNet (https://www.broadnet.me)

## How it relates to SMS

On 4G-only handsets, SMS uses either SGs (which falls back through MAP on the MSC) or SMS-over-IMS. In the SGs case the MME proxies signalling to the SMSC over the SGd interface, which is Diameter-encoded. The HSS exchange to find the serving MME for an MT delivery is over S6a.

## Diameter Edge Agent

Operators terminate inbound S6a from roaming partners at a Diameter Edge Agent (DEA), which acts as a firewall, topology hider, and rate-limiter. The DEA is to Diameter what the STP+firewall is to SS7. GSMA FS.19 is the reference document for Diameter signalling security.

## Common attacks and mitigations

Diameter is vulnerable to similar tracking and interception attacks as SS7 — Update-Location-Request can be abused to redirect a subscriber's signalling to an attacker-controlled MME. Mitigations: cross-check the realm and IMSI in the AVP, enforce roaming agreement whitelists at the DEA, alert on Update-Location bursts. BroadNet operates a Diameter firewall product alongside its SS7 firewall for operators that have moved A2P delivery to SMS-over-IP.

## What buyers should ask

If you are a messaging customer, you almost never see Diameter directly — your CPaaS speaks SMPP and the operator does the protocol translation. If you are an operator buying a firewall, demand that the vendor inspect both SS7 MAP and Diameter S6a/SGd in the same policy engine, with shared subscriber reputation. Split stacks create policy drift.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [What is IMS (IP Multimedia Subsystem)?](https://www.broadnet.me/answers/what-is-ims)
- [How does Diameter signaling security work?](https://www.broadnet.me/answers/diameter-signaling-security)
- [SS7 MAP — what it is and why messaging still depends on it](https://www.broadnet.me/answers/ss7-map-explained)
- [GSMA FS.07 and FS.11 — the SS7 signalling firewall standards](https://www.broadnet.me/answers/gsma-fs07-fs11-signaling-firewall)
- [SS7 Firewall](https://www.broadnet.me/operators/ss7-firewall)