DIAMETER

Description Glossary RFCs Publications Obsolete RFCs

Description:

Protocol suite: TCP/IP.
Protocol type:Application layer protocol.
Port:3868 (SCTP, TCP).
URI:aaa:, aaas:
MIME subtype:
SNMP MIBs:
Working groups: aaa, Authentication, Authorization and Accounting.
dime, Diameter Maintanence and Extensions.
Links: diameter.org
IANA: AAA AVPs.

RFC 3588:

The Diameter base protocol is intended to provide an Authentication, Authorization and Accounting (AAA) framework for applications such as network access or IP mobility. Diameter is also intended to work in both local Authentication, Authorization & Accounting and roaming situations. This document specifies the message format, transport, error reporting, accounting and security services to be used by all Diameter applications. The Diameter base application needs to be supported by all Diameter implementations.

The Diameter protocol consists of the Diameter header followed by one or more AVP structures.


MAC header IP header SCTP | TCP header Diameter header Data :::

Diameter header:

0001020304050607 0809101112131415 1617181920212223 2425262728293031
Version Message length
Flags Code
Application ID
Hop by Hop ID
End to End ID
AVP[] :::

Version. 8 bits.
Diameter protocol version.

Message length. 24 bits.
Size of the Diameter message including the header fields.

Flags. 8 bits.

0001020304050607
R P E T reserved

R, Request. 1 bit.
If set, the message is a request. Otherwise the message is an answer.

P, Proxiable. 1 bit.
If set, the message MAY be proxied, relayed or redirected. Otherwise the message MUST be locally processed.

E, Error. 1 bit.
If set, the message contains a protocol error, and the message will not conform to the ABNF described for this command. Messages with this bit set are commonly referred to as error messages. This bit MUST NOT be set in request messages.

T, Potentially retransmitted message. 1 bit.
This flag is set after a link failover procedure, to aid the removal of duplicate requests. It is set when resending requests not yet acknowledged, as an indication of a possible duplicate due to a link failure. This bit MUST be cleared when sending a request for the first time, otherwise the sender MUST set this flag. Diameter agents only need to be concerned about the number of requests they send based on a single received request. Retransmissions by other entities do not need to be tracked. Diameter agents that receive a request with the T flag set, MUST keep the T flag set in the forwarded request. This flag MUST NOT be set if an error answer message (e.g., a protocol error) has been received for the earlier message. It can be set only in cases where no answer has been received from the server for a request and the request is sent again. This flag MUST NOT be set in answer messages.

reserved. 4 bits.
Must be cleared to zero.

Code. 24 bits.

CodeDescriptionReferences
0
-
255
Radius command codes. 
256  
257CER; CEA. 
258RAR, Re-Auth-Request; RAA, Re-Auth-Answer. RFC 4005
259 
260AMR, AA-Mobile-Node-Request; AMA, AA-Mobile-Node-Answer. RFC 4004
261  
262HAR, Home-Agent-MIP-Request; HAA, Home-Agent-MIP-Answer. RFC 4004
263
264
  
265AAR, AA-Request; AAA, AA-Answer. RFC 4005
266
267
  
268DER, Diameter-EAP-Request; DEA, Diameter-EAP-Answer. RFC 4072
269
270
  
271ACR, Accounting-Request; ACA, Accounting-Answer. RFC 4005
272CCR, Credit-Control-Request; CCA, Credit-Control-Answer. RFC 4006
273  
274ASR, Abort-Session-Request; ASA, Abort-Session-Answer. RFC 4005
275STR, Session-Termination-Request; STA, Session-Termination-Answer. RFC 4005
276
-
279
  
280DWR; DWA.RFC 3588
281  
282DPR; DPA.RFC 3588
283UAR; UAA.RFC 4740
284SAR; SAA.RFC 4740
285LIR; LIA.RFC 4740
286MAR; MAA.RFC 4740
287RTR; RTA.RFC 4740
288PPR; PPA.RFC 4740
289
-
299
  
301
-
313
  
314PDR.
PDA.
RFC 5224
315PIR, Policy-Install-Request.
PIA, Policy-Install-Answer.
RFC 5431
316ULR, 3GPP-Update-Location-Request.
ULA, 3GPP-Update-Location-Answer.
RFC 5516
317CLR, 3GPP-Cancel-Location-Request.
CLA, 3GPP-Cancel-Location-Answer.
RFC 5516
   
16777215Experimental code.RFC 3588

Application ID. 32 bits.
Used to identify to which application the message is applicable for. The application can be an authentication application, an accounting application or a vendor specific application. The application ID in the header MUST be the same as what is contained in any relevant AVPs contained in the message.

Hop by Hop ID. 32 bits, unsigned.
This field aids in matching requests and replies. The sender MUST ensure that the identifier in a request is unique on a given connection at any given time, and MAY attempt to ensure that the number is unique across reboots. The sender of an Answer message MUST ensure that this field contains the same value that was found in the corresponding request. The identifier is normally a monotonically increasing number, whose start value was randomly generated. An answer message that is received with an unknown identifier MUST be discarded.

End to End ID. 32 bits, unsigned.
This field is used to detect duplicate messages. Upon reboot implementations MAY set the high order 12 bits to contain the low order 12 bits of current time, and the low order 20 bits to a random value. Senders of request messages MUST insert a unique identifier on each message. The identifier MUST remain locally unique for a period of at least 4 minutes, even across reboots. The originator of an Answer message MUST ensure that the field contains the same value that was found in the corresponding request. This field MUST NOT be modified by Diameter agents of any kind. The combination of the Origin-Host and this field is used to detect duplicates. Duplicate requests SHOULD cause the same answer to be transmitted (modulo the Hop by Hop ID field and any routing AVPs that may be present), and MUST NOT affect any state that was set when the original request was processed. Duplicate answer messages that are to be locally consumed SHOULD be silently discarded.


AVP, Attribute Value Pair.
A structure used to encapsulate protocol specific data as well as authentication, authorization and accounting information.

0001020304050607 0809101112131415 1617181920212223 2425262728293031
AVP code
AVP flags AVP length
Vendor ID
Data :::

AVP code. 32 bits.
When combined with the Vendor ID the attribute is uniquely identified. AVP numbers 1 through 255 are reserved for backward compatibility with RADIUS, without setting the Vendor ID field. AVP numbers 256 and above are used for Diameter, which are allocated by IANA.

CodeDescriptionReferences
1
-
255
Radius attributes. 
256  
257Host-IP-Address. RFC 3588
258Auth-Application-Id. RFC 3588
259Acct-Application-Id. RFC 3588
260Vendor-Specific-Application-Id. RFC 3588
261Redirect-Host-Usage. RFC 3588
262Redirect-Max-Cache-Time.RFC 3588
263Session-Id.RFC 3588
264Origin-Host.RFC 3588
265Supported-Vendor-Id. 
266Vendor-Id. 
267Firmware-Version. 
268Result-Code. 
269Product-Name. 
270Session-Binding. 
271Session-Server-Failover. 
272Multi-Round-Time-Out. 
273Disconnect-Cause. 
274Auth-Request-Type. 
275  
276Auth-Grace-Period. 
277Auth-Session-State. 
278Origin-State-Id. 
279Failed-AVP. 
280Proxy-Host. 
281Error-Message. 
282Route-Record. 
283Destination-Realm. 
284Proxy-Info. 
285Re-Auth-Request-Type. 
286  
287Accounting-Sub-Session-Id.RFC 3588
288
-
290
  
291Authorization-Lifetime. 
292Redirect-Host. 
293Destination-Host. 
294Error-Reporting-Host. 
295Termination-Cause. RFC 4005
296Origin-Realm. 
297Experimental-Result. 
298Experimental-Result-Code. 
299Inband-Security-Id. 
300E2E-Sequence. 
301
-
317
   
318MIP-FA-to-HA-SPI. RFC 4004
319MIP-FA-to-MN-SPI. RFC 4004
320MIP-Reg-Request. RFC 4004
321MIP-Reg-Reply. RFC 4004
322MIP-MN-AAA-Auth. RFC 4004
323MIP-HA-to-FA-SPI. RFC 4004
324  
325MIP-MN-to-FA-MSA. RFC 4004
326MIP-FA-to-MN-MSA. RFC 4004
327  
328MIP-FA-to-HA-MSA. RFC 4004
329MIP-HA-to-FA-MSA. RFC 4004
330  
331MIP-MN-to-HA-MSA. RFC 4004
332MIP-HA-to-MN-MSA. RFC 4004
333MIP-Mobile-Node-Address. RFC 4004
334MIP-Home-Agent-Address. RFC 4004
335MIP-Nonce. RFC 4004
336MIP-Candidate-Home-Agent-Host. RFC 4004
337MIP-Feature-Vector. RFC 4004
338MIP-Auth-Input-Data-Length. RFC 4004
339MIP-Authenticator-Length. RFC 4004
340MIP-Authenticator-Offset. RFC 4004
341MIP-MN-AAA-SPI. RFC 4004
342MIP-Filter-Rule. RFC 4004
343MIP-Session-Key. RFC 4004
344MIP-FA-Challenge. RFC 4004
345MIP-Algorithm-Type. RFC 4004
346MIP-Replay-Mode. RFC 4004
347MIP-Originating-Foreign-AAA. RFC 4004
348MIP-Home-Agent-Host. RFC 4004
349
-
362
  
363Accounting-Input-Octets. RFC 4005
364Accounting-Output-Octets. RFC 4005
365Accounting-Input-Packets. RFC 4005
366Accounting-Output-Packets. RFC 4005
367MIP-MSA-Lifetime. RFC 4004
368SIP-Accounting-Information.RFC4740
369SIP-Accounting-Server-URI.RFC4740
370SIP-Credit-Control-Server-URI.RFC4740
371SIP-Server-URI.RFC4740
372SIP-Server-Capabilities.RFC4740
373SIP-Mandatory-Capability.RFC4740
374SIP-Optional-Capability.RFC4740
375SIP-Server-Assignment-Type.RFC4740
376SIP-Auth-Data-Item.RFC4740
377SIP-Authentication-Scheme.RFC4740
378SIP-Item-Number.RFC4740
379SIP-Authenticate.RFC4740
380SIP-Authorization.RFC4740
381SIP-Authentication-Info.RFC4740
382SIP-Number-Auth-Items.RFC4740
383SIP-Deregistration-Reason.RFC4740
384SIP-Reason-Code.RFC4740
385SIP-Reason-Info.RFC4740
386SIP-Visited-Network-Id.RFC4740
387SIP-User-Authorization-Type.RFC4740
388SIP-Supported-User-Data-Type.RFC4740
389SIP-User-Data.RFC4740
390SIP-User-Data-Type.RFC4740
391SIP-User-Data-Contents.RFC4740
392SIP-User-Data-Already-Available.RFC4740
393SIP-Method.RFC4740
394
-
399
  
400NAS-Filter-Rule. RFC 4005
401Tunneling. RFC 4005
402CHAP-Auth. RFC 4005
403CHAP-Algorithm. RFC 4005
404CHAP-Ident. RFC 4005
405CHAP-Response. RFC 4005
406Acounting-Auth-Method. RFC 4005
407QoS-Filter-Rule. RFC 4005
408Origin-AAA-Protocol. RFC 4005
409  
410  
411CC-Correlation-Id. RFC 4006
412CC-Input-Octets. RFC 4006
413CC-Money. RFC 4006
414CC-Output-Octets. RFC 4006
415CC-Request-Number. RFC 4006
416CC-Request-Type. RFC 4006
417CC-Service-Specific-Units. RFC 4006
418CC-Session-Failover. RFC 4006
419CC-Sub-Session-Id. RFC 4006
420CC-Time. RFC 4006
421CC-Total-Octets. RFC 4006
422Check-Balance-Result. RFC 4006
423Cost-Information. RFC 4006
424Cost-Unit. RFC 4006
425Currency-Code. RFC 4006
426Credit-Control. RFC 4006
427Credit-Control-Failure-Handling. RFC 4006
428Direct-Debiting-Failure-Handling. RFC 4006
429Exponent. RFC 4006
430Final-Unit-Indication. RFC 4006
431Granted-Service-Unit. RFC 4006
432Rating-Group. RFC 4006
433Redirect-Address-Type. RFC 4006
434Redirect-Server. RFC 4006
435Redirect-Server-Address. RFC 4006
436Requested-Action. RFC 4006
437Requested-Service-Unit. RFC 4006
438Restriction-Filter-Rule. RFC 4006
439Service-Identifier. RFC 4006
440Service-Parameter-Info. RFC 4006
441Service-Parameter-Type. RFC 4006
442Service-Parameter-Value. RFC 4006
443Subscription-Id. RFC 4006
444Subscription-Id-Data. RFC 4006
445Unit-Value. RFC 4006
446Used-Service-Unit. RFC 4006
447Value-Digits. RFC 4006
448Validity-Time. RFC 4006
449Final-Unit-Action. RFC 4006
450Subscription-Id-Type. RFC 4006
451Tariff-Time-Change. RFC 4006
452Tariff-Change-Usage. RFC 4006
453G-S-U-Pool-Identifier. RFC 4006
454CC-Unit-Type. RFC 4006
455Multiple-Services-Indicator. RFC 4006
456Multiple-Services-Credit-Control. RFC 4006
457G-S-U-Pool-Reference. RFC 4006
458User-Equipment-Info. RFC 4006
459User-Equipment-Info-Type. RFC 4006
460User-Equipment-Info-Value. RFC 4006
461Service-Context-Id. RFC 4006
462EAP-Payload. RFC 4072
463EAP-Reissued-Payload. RFC 4072
464EAP-Master-Session-Key. RFC 4072
465Accounting-EAP-Auth-Method. RFC 4072
466
-
479
  
480Accounting-Record-Type.RFC 3588
481
482
  
483Accounting-Realtime-Required.RFC 3588
484  
485Accounting-Record-Number.RFC 3588
486MIP6-Agent-Info.RFC 5447
487MIP-Careof-Address.RFC 5778
488MIP-Authenticator.RFC 5778
489MIP-MAC-Mobility-Data.RFC 5778
   
581
-
0xFFFFFF
  

AVP flags. 8 bits.

0001020304050607
V M P reserved

V, Vendor specific. 1 bit.
If set, the Vendor ID field is present.

M, Mandatory. 1 bit.
If set, support of this AVP is required.

P. 1 bit.
If set, encryption for end to end security is needed.

reserved. 5 bits.
Must be cleared to zero.

AVP length. 24 bits.
Total size of the AVP header and data in bytes.

Vendor ID. 32 bits.
This field is present if the V bit is set in the AVP Flags field. This field contains the IANA assigned "SMI Network Management Private Enterprise Codes" value, encoded in network byte order. Any vendor wishing to implement a vendor-specific Diameter AVP MUST use their own Vendor ID along with their privately managed AVP address space, guaranteeing that they will not collide with any other vendor's vendor-specific AVP(s), nor with future IETF applications. A value of zero corresponds to the IETF adopted AVP values, as managed by the IANA. Since the absence of this field implies that the AVP in question is not vendor specific, implementations MUST NOT use the zero value.


Application ID.

IDDescriptionReferences
0 Diameter common message.RFC 3588
    
16777256 ITU-T Rw.RFC 5431

Glossary:

Diameter Agent.
A Diameter node that provides either relay, proxy, redirect or translation services.

Diameter Client.
A device at the edge of the network that performs access control. An example of a Diameter client is a Network Access Server (NAS) or a Foreign Agent (FA).

Diameter Node.
A host process that implements the Diameter protocol, and acts either as a Client, Agent or Server.

Diameter Peer.
A Diameter Node to which a given Diameter Node has a direct transport connection.

Diameter Security Exchange.
A process through which two Diameter nodes establish end-to-end security.

Diameter Server.
A Diameter Server is one that handles authentication, authorization and accounting requests for a particular realm. By its very nature, a Diameter Server MUST support Diameter applications in addition to the base protocol.

Home Realm.
The administrative domain with which the user maintains an account relationship.

Local Realm.
The administrative domain providing services to a user. An administrative domain MAY act as a local realm for certain users, while being a home realm for others.

NAI, Network Access Identifier.
Used to extract the identity and realm of a user. The identity is used to recognize the user during authentication and/or authorization, while the realm is used for message routing purposes.

Realm.
The string in the NAI that immediately follows the '@' character. NAI realm names are required to be unique, and are piggybacked on the administration of the DNS namespace. Diameter makes use of the realm, also loosely referred to as domain, to determine whether messages can be satisfied locally, or whether they must be routed or redirected. In RADIUS, realm names are not necessarily piggybacked on the DNS namespace but may be independent of it.


RFCs:

[RFC 2924] Accounting Attributes and Record Formats.

[RFC 3127] Authentication, Authorization, and Accounting: Protocol Evaluation.

[RFC 3588] Diameter Base Protocol.

[RFC 3589] Diameter Command Codes for Third Generation Partnership Project (3GPP) Release 5.

[RFC 3955] Evaluation of Candidate Protocols for IP Flow Information Export (IPFIX).

[RFC 4004] Diameter Mobile IPv4 Application.

[RFC 4005] Diameter Network Access Server Application.

[RFC 4006] Diameter Credit-Control Application.

[RFC 4072] Diameter Extensible Authentication Protocol (EAP) Application.

[RFC 5431] Diameter ITU-T Rw Policy Enforcement Interface Application.

[RFC 5447] Diameter Mobile IPv6: Support for Network Access Server to Diameter Server Interaction.


Publications:


Obsolete RFCs:


Description Glossary RFCs Publications Obsolete RFCs