diameter

Overview ¶

Package diameter decodes Diameter packets per RFC 6733 (the current Diameter Base Protocol — supersedes RFC 3588). Diameter is the 3GPP AAA protocol that succeeded RADIUS (RFC 2865, already covered by `radius_packet_decode`); it carries authentication / authorization / accounting / charging signalling across every modern cellular network on the S6a (HSS↔MME), S13 (HSS↔EIR), Gx (PCEF↔PCRF), Gy (Charging), Rx (P-CSCF↔PCRF), Cx/Dx (IMS), Sh (AS↔HSS), and S6t / T6a (IoT M2M) interfaces. Diameter typically rides on SCTP (covered by `sctp_packet_decode`) on UDP/TCP/3868.

Wrap-vs-native judgement

Native. RFC 6733 is fully public; Diameter has a tight
20-byte header followed by a uniform AVP (Attribute-
Value Pair) array. AVPs are TLVs with a 4-byte AVP Code,
1-byte AVP Flags (V/M/P), 3-byte AVP Length, optional
4-byte Vendor-ID, value, and 4-byte trailing padding.
No crypto at the parse layer.

What this package covers

• **20-byte header** (RFC 6733 §3):

• byte 0: Version (must be 1).

• bytes 1-3: **Message Length** (24-bit BE; includes header).

• byte 4: **Command Flags** decoded into 4 named bits: R (Request — 1 = request, 0 = answer), P (Proxiable), E (Error — set in error answers), T (Potentially re-transmitted).

• bytes 5-7: **Command Code** (24-bit BE) with **~20-entry name table** covering base (CER/CEA 257 / DWR/DWA 280 / DPR/DPA 282 / Re-Auth 258 / Accounting 271 / Abort-Session 274 / Session- Termination 275 / Credit-Control 272) + 3GPP S6a (Update-Location 316 / Authentication-Information 318 / Cancel-Location 317 / Insert-Subscriber-Data 319 / Delete-Subscriber-Data 320 / Purge-UE 321 / Reset 322 / Notify 323).

• bytes 8-11: **Application ID** (uint32 BE) with **~15-entry name table**: 0 Diameter Base, 1 NASREQ, 2 Mobile-IPv4, 3 Accounting, 4 Credit- Control, 16777216 3GPP Cx/Dx, 16777217 3GPP Sh, 16777236 3GPP Rx, 16777238 3GPP Gx, 16777251 3GPP S6a/S6d, 16777272 3GPP S13, 16777316 3GPP T6a, 16777310 3GPP S6t, and the 0xFFFFFFFF Diameter Relay app.

• bytes 12-15: Hop-by-Hop Identifier (uint32 BE).

• bytes 16-19: End-to-End Identifier (uint32 BE).

• **AVP walker** — repeated 8-byte minimum header (AVP Code uint32 BE + 1-byte AVP Flags + 3-byte AVP Length including header) + optional 4-byte Vendor-ID (when V flag set) + value + 4-byte padding. **AVP Flags decoded into 3 named bits**: V (Vendor-Specific — the 4-byte Vendor-ID follows), M (Mandatory — must be understood), P (Protected — encrypt with end-to-end security).

• **~35-entry AVP Code name table** covering RFC 6733 base AVPs: User-Name (1) / Class (25) / Session-Timeout (27) / Acct-Session-Id (44) / Event-Timestamp (55) / Acct-Multi-Session-Id (50) / Host-IP-Address (257) / Auth-Application-Id (258) / Acct-Application-Id (259) / Vendor-Specific-Application-Id (260) / Redirect- Host-Usage (261) / Redirect-Max-Cache-Time (262) / Session-Id (263) / Origin-Host (264) / Supported- Vendor-Id (265) / Vendor-Id (266) / Firmware-Revision (267) / Result-Code (268) / Product-Name (269) / Session-Binding (270) / Session-Server-Failover (271) / Multi-Round-Time-Out (272) / Disconnect-Cause (273) / Auth-Request-Type (274) / Auth-Grace-Period (276) / Auth-Session-State (277) / Origin-State-Id (278) / Failed-AVP (279) / Proxy-Host (280) / Error-Message (281) / Route-Record (282) / Destination-Realm (283) / Proxy-Info (284) / Re-Auth-Request-Type (285) / Authorization-Lifetime (291) / Redirect-Host (292) / Destination-Host (293) / Error-Reporting-Host (294) / Termination-Cause (295) / Origin-Realm (296) / Experimental-Result (297) / Experimental-Result-Code (298) / Inband-Security-Id (299).

• **Type-aware AVP value decoding** — based on the AVP Code, surface the value as the appropriate Diameter base type:

• **UTF8String** — Session-Id / Origin-Host / Origin- Realm / Destination-Host / Destination-Realm / Error-Message / Product-Name / Route-Record / Proxy-Host / Redirect-Host / User-Name / Acct-Multi- Session-Id (all surfaced as decoded UTF-8).

• **Unsigned32** — Result-Code / Origin-State-Id / Auth-Application-Id / Acct-Application-Id / Vendor- Id / Firmware-Revision / Session-Timeout / Auth- Session-State / Authorization-Lifetime + 20 more (all surfaced as decoded uint32).

• **Address** — Host-IP-Address (RFC 6733 §4.3.1 Address type: 2-byte Address Family + 4 or 16 byte IPv4/v6 address).

• **Result-Code class** — when the AVP Code is 268 (Result-Code) the decoded uint32 is also classified as Informational (1xxx) / Success (2xxx — including the canonical 2001 DIAMETER_SUCCESS) / Protocol Error (3xxx) / Transient Failure (4xxx) / Permanent Failure (5xxx).

• **Padding** — every AVP is padded to a 4-byte boundary so the walker advances by `length + ((4 - length % 4) % 4)`. Mis-aligned AVPs (declared length not a multiple of 1 byte, padding running off the end of the message) are flagged via the Notes field.

What this package does NOT cover (deliberately out of scope)

• SCTP / TCP / TLS framing — feed Diameter bytes after the transport header strip. Diameter conventionally rides on SCTP destination port 3868 (use the existing `sctp_packet_decode` to unwrap the SCTP envelope first; the resulting DATA chunk's user data is the Diameter payload).

• Grouped AVP recursion — Grouped-type AVPs (Vendor- Specific-Application-Id, Proxy-Info, Failed-AVP, Experimental-Result) have their bodies surfaced as hex; a future iteration would recursively walk the inner AVPs.

• Diameter Routing Agent / Relay forwarding logic — higher-level analysis (Route-Record, Destination-Realm are surfaced; routing decisions are not).

• End-to-end security (E flag + Protected AVP encryption) — flagged in the Flags decode; payload remains opaque hex.