SS7 vs Diameter

Introduction¶

Diameter is the AAA (Authentication, Authorization, Accounting) protocol that carries control-plane signalling in LTE (EPC) and IMS. It took over the roles that SS7/MAP and CAMEL played in 2G/3G. It's an evolution of RADIUS — TCP/SCTP transport, request/answer pairs, extensible via "applications".

SS7/MAP vs Diameter — the mapping¶

The nodes renamed too: HLR→HSS, and new ones (PCRF, PGW/SMF, OCS).

The base protocol¶

• Messages: Request/Answer pairs. Each has a Command Code (e.g. 316 = Update-Location) and carries AVPs (Attribute-Value Pairs) — typed key-value fields, nestable (Grouped AVPs).
• Transport: SCTP (preferred, multi-homed) or TCP, usually with TLS/IPsec on inter-operator links. Port 3868.
• Peers and the peer table: each node has direct peer connections; a capabilities exchange (CER/CEA) on connect negotiates supported applications.
• Realms: identities are user@realm (e.g. an IMSI-derived nai at epc.mnc012.mcc345.3gppnetwork.org). Routing is realm-based — a node looks up the destination realm + application in its routing table.
• Watchdog (DWR/DWA) keeps idle connections alive and detects failure fast.

DRA / DEA¶

A Diameter Routing Agent (DRA) is the equivalent of an SS7 STP: a central router so nodes don't need full-mesh peering. It routes by Destination-Realm + Application-Id, load-balances across servers, and can do topology hiding. A Diameter Edge Agent (DEA) sits at the network border for roaming (IPX/Diameter roaming), doing security and mediation — the counterpart of an STP at the SS7 border.

Interworking with SS7¶

During the long 2G/3G↔4G overlap, an IWF (Interworking Function) translates:

• S6a (Diameter) ↔ MAP (SS7) — so an LTE MME can update location in a legacy HLR, or a 4G HSS can serve a 2G/3G subscriber. Maps Update-Location-Request ↔ MAP-UpdateLocation, authentication vectors, etc.
• Ro/Gy ↔ CAP — Diameter charging to a CAMEL-based OCS.
• SGd ↔ MAP for SMS.

This is stateful, AVP-by-parameter mapping — a real product (an "SS7-Diameter IWF" / signalling controller), not a config toggle.

Verification and troubleshooting¶

ss --sctp -a | grep 3868
tshark -i any -f "port 3868" -O diameter
# freeDiameter (test/lab)
freeDiameterd -dd

• Peer won't connect / CER-CEA fails — no common Application-Id (one side doesn't advertise S6a), Origin-Host/Origin-Realm mismatch vs the peer table, or TLS/IPsec not established. Result-Code in the CEA says why (DIAMETER_NO_COMMON_APPLICATION 5010).
• DIAMETER_UNABLE_TO_DELIVER (3002) — the DRA has no route to the Destination-Realm/Application, or all matching peers are down.
• DIAMETER_REALM_NOT_SERVED (3003) — realm typo, or the routing table doesn't have an entry (and no default route).
• Auth works, then session drops — watchdog (DWR/DWA) failing on a NAT'd or firewalled path; SCTP heartbeats blocked.
• Roaming S6a fails at the border — the DEA's topology hiding or the IPX's mediation rewrote an AVP the HSS rejects; or the roaming agreement's realm isn't provisioned.
• LTE attach fails, HLR is legacy — the S6a↔MAP IWF isn't mapping the authentication-information / EPS subscription data correctly, or the HLR doesn't have EPS (APN/QoS) provisioning for the subscriber.
• Gx session established but no policy — PCRF has no rule for the subscriber category, or the PGW/SMF isn't sending the right CCR-I AVPs (Subscription-Id, IP-CAN-Type).

Related tools and reading¶

• On-site: Port Checker (3868).
• Related posts: SS7 vs SIGTRAN, Charging systems: online vs offline.