# Diameter vs RADIUS: why Diameter replaced RADIUS

> Diameter replaced RADIUS for operator-scale AAA because RADIUS runs over unreliable UDP with no failover, a 1-octet attribute space and weak security. Diameter adds reliable SCTP/TCP transport, explicit capability negotiation, a 32-bit AVP space, peer discovery, per-message error codes and TLS/IPsec — while keeping the same AVP-based model, so translation agents can bridge the two.

- Canonical URL: https://www.broadnet.me/reference/diameter-vs-radius
- Language: en
- Last updated: 2026-07-18
- Publisher: BroadNet (https://www.broadnet.me)

Why Diameter (RFC 6733) superseded RADIUS (RFC 2865) for carrier AAA: reliable SCTP transport and failover, capability negotiation, a far larger 32-bit AVP space, peer discovery, richer error handling and stronger security — with a comparison table and migration notes.

## Where RADIUS fell short

RADIUS (RFC 2865) was designed in the 1990s for dial-up network access: a client sends an Access-Request over UDP and hopes for an Access-Accept. That model does not scale to a mobile core. UDP gives no reliable delivery, so loss detection and retransmission are left to the application. There is no server-initiated message, so a network cannot proactively terminate or re-authorize a session. The attribute Type field is a single octet (256 values), the shared-secret security is weak, and there is no built-in failover between servers. As LTE demanded server-initiated re-auth, reliable transport and a much larger attribute space, RADIUS ran out of room.

## What Diameter added

Diameter kept the AVP idea but rebuilt the protocol around operator requirements. It runs over reliable SCTP or TCP, so delivery, ordering and retransmission are handled by the transport, and it defines explicit failover between peers using the watchdog. It negotiates capabilities at connection time (CER/CEA) so peers agree on applications before traffic flows. Its AVP Code is 32 bits with a vendor space, giving effectively unlimited attributes. It supports server-initiated messages (Re-Auth, Abort-Session). And it defines a structured error model with distinct transient and permanent result codes, plus TLS/DTLS and IPsec for security.

## Diameter vs RADIUS at a glance

The two protocols share a lineage but differ on every property that matters for a carrier control plane. The table below summarises the practical differences an operator weighs when moving AAA from RADIUS to Diameter.

*Diameter (RFC 6733) vs RADIUS (RFC 2865)*

| Property | RADIUS | Diameter |
|---|---|---|
| Transport | UDP (unreliable) | SCTP or TCP (reliable) |
| Delivery / failover | Application-level, no standard failover | Transport-reliable + watchdog failover (RFC 3539) |
| Attribute space | 1-octet Type (256 values) | 32-bit AVP Code + vendor space |
| Attribute size | 1-octet length (max 255 octets) | 24-bit length (large values, Grouped AVPs) |
| Capability negotiation | None | CER/CEA at connection setup |
| Server-initiated messages | No (CoA/Disconnect added later, RFC 5176) | Yes — Re-Auth (RAR), Abort-Session (ASR) |
| Peer discovery | Static configuration | Realm routing + dynamic discovery (DNS/SRV) |
| Error handling | Implicit (accept/reject) | Explicit Result-Code ranges 1xxx–5xxx |
| Security | Shared secret, MD5 hiding | TLS / DTLS / IPsec |

## Realm routing and peer discovery

RADIUS proxies by static configuration. Diameter routes on the Destination-Realm AVP: a node forwards a message toward the realm that owns the user, using a realm-based routing table, and can discover peers dynamically through DNS NAPTR/SRV records rather than hand-configured hosts. This realm model is what makes inter-operator Diameter roaming work — a visited network routes an S6a request to the home realm without knowing the home HSS's address in advance — and it is the same routing that Diameter Routing Agents and Edge Agents police at the border.

## Migration and translation agents

Because both protocols are AVP-based, Diameter was designed to interwork with RADIUS through a translation agent that maps RADIUS attributes to Diameter AVPs and back, so an operator can migrate incrementally rather than in a single cutover. A common pattern keeps RADIUS at the access edge (Wi-Fi, fixed broadband) while the core AAA, policy and charging run on Diameter, with a translation gateway between them. New LTE, IMS and 5G interfaces are Diameter-native, so over time the RADIUS footprint shrinks to legacy access.

## Frequently asked questions

### Why did Diameter replace RADIUS?

Because RADIUS runs over unreliable UDP, has only a 256-value attribute space, offers no capability negotiation or standard failover, and no server-initiated messages. Diameter adds reliable SCTP/TCP transport, watchdog failover, a 32-bit AVP space, CER/CEA capability negotiation, server-initiated re-auth, realm routing and TLS/IPsec — everything a mobile core needs.

### Is Diameter backward-compatible with RADIUS?

Not on the wire — they are different protocols — but Diameter was designed to interwork through a translation agent that maps RADIUS attributes to Diameter AVPs and back. This lets operators keep RADIUS at the access edge while running Diameter in the core, migrating incrementally rather than in one cutover.

### What transport does Diameter use instead of UDP?

Diameter runs over SCTP or TCP, both reliable, with SCTP preferred for signalling because of multi-streaming and multi-homing. Reliable transport plus the RFC 3539 watchdog gives Diameter the delivery guarantees and peer failover that RADIUS over UDP never had.

### How is the Diameter AVP space bigger than RADIUS attributes?

RADIUS uses a single-octet attribute Type (256 values) and a single-octet length (max 255 octets). Diameter uses a 32-bit AVP Code with a vendor namespace and a 24-bit length, plus Grouped AVPs, giving effectively unlimited attributes and large, structured values.

### Can Diameter and RADIUS run in the same network?

Yes. A typical deployment keeps RADIUS at the access edge (Wi-Fi, fixed broadband) and runs Diameter for core AAA, policy (Gx) and charging (Gy), with a translation gateway between them. LTE, IMS and 5G interfaces are Diameter-native, so the RADIUS footprint gradually shrinks to legacy access.

## Sources

- [IETF RFC 6733 — Diameter Base Protocol](https://datatracker.ietf.org/doc/html/rfc6733)
- [IETF RFC 2865 — Remote Authentication Dial In User Service (RADIUS)](https://datatracker.ietf.org/doc/html/rfc2865)

## Related

- [Diameter base protocol (RFC 6733)](https://www.broadnet.me/reference/diameter-base-protocol)
- [Diameter AVPs and message format](https://www.broadnet.me/reference/diameter-avps-and-message-format)
- [Diameter S6a/S6d to the HSS](https://www.broadnet.me/reference/diameter-s6a-s6d-hss)
- [Diameter roaming security (DRA/DEA)](https://www.broadnet.me/reference/diameter-roaming-security-dra-dea)
- [Developers](https://www.broadnet.me/developers)