Diameter (IETF RFC 6733) is the AAA and signalling protocol for LTE, IMS and 5G interworking. It carries request/answer command pairs — each a 20-byte header plus AVPs — over SCTP or TCP with TLS. Peers negotiate capabilities with CER/CEA, monitor liveness with DWR/DWA, and close down cleanly with DPR/DPA.
What Diameter is
Diameter is the authentication, authorization and accounting (AAA) base protocol defined by the IETF in RFC 6733, and the transport 3GPP chose for the LTE and IMS control plane. It replaced RADIUS for large operator networks and is the peer, on the packet side, of SS7/MAP on the legacy side — carrying subscription and mobility management (S6a to the HSS), policy and charging (Gx, Gy), and IMS registration (Cx/Dx). Everything runs as request/answer command pairs between named peers identified by a Diameter Identity (an FQDN) and grouped into realms.
The message header
Every Diameter message starts with a fixed 20-octet header followed by a variable list of AVPs. The header carries a Version (always 1), a 24-bit Message Length, a Command Flags octet, a 24-bit Command Code, a 32-bit Application-Id that names the application the message belongs to, and two identifiers. The Hop-by-Hop Identifier matches a request to its answer between two adjacent peers and is rewritten by each proxy; the End-to-End Identifier is set by the originator, preserved unchanged across the path, and used to detect duplicates.
0 1 2 3
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version=1 | Message Length (24) |
| Command Flags | Command Code (24) |
| Application-Id (32) |
| Hop-by-Hop Identifier (32) |
| End-to-End Identifier (32) |
| AVPs ... |
Command Flags: R P E T r r r rCommand flags and command codes
A Command Code plus the Application-Id names the operation; the answer reuses the same command code with the Request bit cleared. Four command flags carry the message semantics. R (Request) distinguishes a request from an answer. P (Proxiable) says the message may be proxied, relayed or redirected rather than handled locally. E (Error) marks a protocol-error answer. T (potentially re-transmitted) marks a request re-sent after a link failover so the receiver can guard against duplicates. The base protocol defines the housekeeping commands; applications such as S6a, Gx and Cx define their own command codes on top.
| Command | Code | Purpose |
|---|---|---|
| CER / CEA | 257 | Capabilities-Exchange — negotiate supported applications at connect |
| DWR / DWA | 280 | Device-Watchdog — peer liveness / keepalive (RFC 3539) |
| DPR / DPA | 282 | Disconnect-Peer — orderly connection shutdown |
| RAR / RAA | 258 | Re-Auth — server asks the client to re-authorize a session |
| STR / STA | 275 | Session-Termination — client ends an authorized session |
| ASR / ASA | 274 | Abort-Session — server forces a session to end |
| ACR / ACA | 271 | Accounting-Request/Answer (base accounting) |
Capabilities exchange: CER / CEA
Immediately after a transport connection opens, the two peers exchange a Capabilities-Exchange-Request and Answer (command 257, Application-Id 0). Each side advertises its Origin-Host and Origin-Realm, its Host-IP-Address, a Vendor-Id, and — crucially — the set of applications it supports via Auth-Application-Id, Acct-Application-Id and Vendor-Specific-Application-Id AVPs. If the peers share no common application the connection is refused. CER/CEA is how a node learns whether the peer can speak S6a, Gx or Cx before any application traffic flows, and it happens exactly once per connection.
Keepalive and shutdown: DWR / DPR
Diameter uses the RFC 3539 watchdog to detect a dead peer faster than the transport would on its own. When a connection is idle, a peer sends a Device-Watchdog-Request (command 280) and expects a Device-Watchdog-Answer within the watchdog interval; repeated misses move the peer to a failed state and traffic reroutes to an alternative. To close a connection deliberately — for maintenance or reconfiguration — a peer sends a Disconnect-Peer-Request (command 282) carrying a Disconnect-Cause (REBOOTING, BUSY or DO_NOT_WANT_TO_TALK_TO_YOU), letting the other side decide whether to reconnect.
Transport: SCTP and TCP with TLS
RFC 6733 mandates support for both SCTP (RFC 4960) and TCP, with SCTP preferred for signalling because its multi-streaming avoids head-of-line blocking and its multi-homing gives path redundancy. The well-known port is 3868. Security is provided by TLS over TCP or DTLS over SCTP; inside a trusted operator domain many deployments run IPsec at the network layer instead. Diameter has no in-band message authentication of its own, which is why the transport security and edge filtering discussed under Diameter roaming security matter.
Frequently asked
What is the Diameter base protocol?
It is the AAA and signalling protocol defined in IETF RFC 6733, used as the control-plane transport for LTE, IMS and 5G interworking. It carries request/answer command pairs — a 20-byte header plus AVPs — over SCTP or TCP with TLS, and defines capabilities exchange, watchdog keepalive and orderly disconnect.
What do the R, P, E and T flags mean?
R marks a Request (cleared in the answer). P marks the message as Proxiable — it may be relayed, proxied or redirected. E marks an Error answer. T marks a request as potentially re-transmitted after a failover, so the receiver can detect a duplicate using the End-to-End Identifier.
What is the difference between the Hop-by-Hop and End-to-End Identifiers?
The Hop-by-Hop Identifier matches a request to its answer between two adjacent peers and is rewritten by each proxy. The End-to-End Identifier is set once by the originator, preserved unchanged across the whole path, and used to detect duplicate messages after a re-transmission.
What is the CER/CEA exchange for?
Capabilities-Exchange-Request/Answer (command 257) runs once when a connection opens. Peers advertise their identity and the Diameter applications they support (Auth-Application-Id, Vendor-Specific-Application-Id). If no application is shared the connection is refused, so both sides know up front whether they can speak S6a, Gx or Cx.
What port and transport does Diameter use?
Diameter uses well-known port 3868 over SCTP or TCP, with SCTP preferred for signalling because of multi-streaming and multi-homing. Security is TLS over TCP or DTLS over SCTP; within a trusted operator domain IPsec at the network layer is common instead.
How does a Diameter peer detect that its partner has failed?
It uses the RFC 3539 device watchdog: on an idle connection a peer sends a Device-Watchdog-Request (command 280) and expects a Device-Watchdog-Answer within the watchdog interval. Repeated missed answers move the peer to a failed state and traffic is rerouted to an alternative peer.
Source specifications
The published standards this page is grounded in. Opens in a new tab.