Diameter for Dummies

Diameter protocol is the successor of the Radius protocol. Somebody thought it’d be interesting to call the feature rich successor  of RADIUS (which of course is an acronym that stands for Remote Authentication Dial-In User Service) as diameter.

Diameter is a AAA protocol for computer networks. (AAA = authentication, authorization, and accounting)

There is a base diameter protocol and protocols that extend the base protocol. The base protocol provides basic mechanisms for reliable transport, message delivery, and error handling.

Diameter Applications

Extended ones are called Diameter Applications. Don’t be deceived by the word application. They are just some more protocols defining new command codes and/or new mandatory AVPs. (More on AVPs later)  For example Diameter Credit-Control Application
is a protocol that can be used to implement real-time credit-control for a variety of end user services such as network access, Session Initiation Protocol (SIP) services, messaging services, and download services.
Each application relies on the common functionality provided by of the base protocol.

• Diameter Mobile IPv4 Application
• Diameter Network Access Server Application
• Diameter Extensible Authentication Protocol Application
• Diameter Credit-Control Application
• Diameter Session Initiation Protocol Application

Diameter Message

Diameter is a byte based protocol. Each message has a fixed structure, which consists of two parts: header and payload. There are two types of messages, Requests and Answers. Every answer message carries a Result-Code AVP.

A Diameter message looks like this.

Message Headers

Version	Indicates the Diameter protocol version. This value is always set to 1.
Message Length	Indicates the Diameter message length, including the header fields.
Flags	Composed by eight bits, to provide information regarding the message. T he first four bits in the flags octet have the following meaning: Flag 1 0 R The message is a request The message is an answer P The message is proxiable and may be proxied, relayed or redirected The message must be processed locally E Error message Regular message T Message is potentially being re-transmitted Message is being sent for the first time The last four bits are reserved for future use, and should be set to 0.
Command Code	Indicates the command associated with the message. Command Code in diameter message is used to determine the action that is to be taken for a particular message. AA-Request AAR 265 AA-Answer AAA 265 Credit-Control-Request CCR 272 Credit-Control-Answer CCA 272
Application-ID	Identifies the application to which the message is applicable for. The application is an authentication, accounting, or vendor specific application. The application-id in the header must be the same as what is contained in any relevant AVPs in the message.
Hop-by-Hop ID	A unique ID, which is used to match requests and answer. The header field of the answer message must contain the same value present in the corresponding request. This is how answers are routed back to the peer that sent the message.
End-to-End ID	A time-limited unique ID that is used to detect duplicate messages. The ID must be unique for at least four minutes. The answer message originator must ensure that this header contains the same value present in the corresponding request.

AVP
AVPs, Attribute-Value Pairs, are used to send across information in a Diameter message and are included in the message payload. Apart from the standard AVPs that are defined in diameter base protocol and diameter applications, custom AVPs can be defined making diameter easy to extend.

AVP Code	Uniquely identifies the AVP. AVP numbers 1 to 255 are reserved for RADIUS backwards compatibility.
Flags	Flags octets have the following structure: V M P r r r r r. V:  Vendor Specific M: Mandatory P: Protected The last 5 bits are reserved for future use, and should be set to 0.
AVP Length	Indicates the number of octets in the AVP.
Vendor-ID	An optional octet that identifies the AVP in application space. AVP code and AVP Vendor-ID create a unique identifier for the AVP.

Each AVP has a similar structure: a header, and encoded data and data can be various data types.
Diameter defines data types of;
• Integer32
• Unsigned32
• Integer64
• Unsigned64
• Float32
• Float64
• Float128
• OctetString
• Grouped

A Grouped AVP is an AVP whose data is a sequence of AVPs.

Following derived data formats are also defined.
• Enumerated
• DiameterIdentity
• time
• UTF8String
• IPFilterRule
• QosFilterRule

Every Diameter message carries the Diameter Identity of the originating Diameter process in the Origin-Host AVP and the realm of the originating Diameter process in the Origin-Realm AVP.

Message Flow
A Diameter node is a host process that implements the Diameter protocol and acts as either a client, an agent, or a server. Two Diameter nodes sharing a direct TCP or SCTP transport connection are called Diameter peers.

The communication between two diameter peers starts with the establishment of a transport connection (TCP or SCTP). The initiator then sends a Capabilities-Exchange-Request (CER) to the other peer, which responds with a Capabilities-Exchange-Answer (CEA).
Diameter security is provided by IPsec or TLS. If TLS (Transport Layer Security) is used TLS negotiation will happen as well.

The connection is then ready for exchanging application messages.

If no messages have been exchanged for some time either side may send a Device-Watchdog-Request (DWR) and the other peer must respond with Device-Watchdog-Answer.

Either side may terminate the communication by sending a Disconnect-Peer-Request (DPR) which the other peer must respond to with Disconnect-Peer-Answer. After that the transport connection can be disconnected.