tech-invite   World Map     

IETF     RFCs     Groups     SIP     ABNFs    |    3GPP     Specs     Glossaries     Architecture     IMS     UICC    |    search

RFC 3588

 
 
 

Diameter Base Protocol

Part 2 of 5, p. 25 to 55
Prev RFC Part       Next RFC Part

 


prevText      Top      Up      ToC       Page 25 
2.8.  Role of Diameter Agents

   In addition to client and servers, the Diameter protocol introduces
   relay, proxy, redirect, and translation agents, each of which is
   defined in Section 1.3.  These Diameter agents are useful for several
   reasons:

   -  They can distribute administration of systems to a configurable
      grouping, including the maintenance of security associations.

   -  They can be used for concentration of requests from an number of
      co-located or distributed NAS equipment sets to a set of like user
      groups.

   -  They can do value-added processing to the requests or responses.

Top      Up      ToC       Page 26 
   -  They can be used for load balancing.

   -  A complex network will have multiple authentication sources, they
      can sort requests and forward towards the correct target.

   The Diameter protocol requires that agents maintain transaction
   state, which is used for failover purposes.  Transaction state
   implies that upon forwarding a request, its Hop-by-Hop identifier is
   saved; the field is replaced with a locally unique identifier, which
   is restored to its original value when the corresponding answer is
   received.  The request's state is released upon receipt of the
   answer.  A stateless agent is one that only maintains transaction
   state.

   The Proxy-Info AVP allows stateless agents to add local state to a
   Diameter request, with the guarantee that the same state will be
   present in the answer.  However, the protocol's failover procedures
   require that agents maintain a copy of pending requests.

   A stateful agent is one that maintains session state information; by
   keeping track of all authorized active sessions.  Each authorized
   session is bound to a particular service, and its state is considered
   active either until it is notified otherwise, or by expiration.  Each
   authorized session has an expiration, which is communicated by
   Diameter servers via the Session-Timeout AVP.

   Maintaining session state MAY be useful in certain applications, such
   as:

   -  Protocol translation (e.g., RADIUS <-> Diameter)

   -  Limiting resources authorized to a particular user

   -  Per user or transaction auditing

   A Diameter agent MAY act in a stateful manner for some requests and
   be stateless for others.  A Diameter implementation MAY act as one
   type of agent for some requests, and as another type of agent for
   others.

2.8.1.  Relay Agents

   Relay Agents are Diameter agents that accept requests and route
   messages to other Diameter nodes based on information found in the
   messages (e.g., Destination-Realm).  This routing decision is
   performed using a list of supported realms, and known peers.  This is
   known as the Realm Routing Table, as is defined further in Section
   2.7.

Top      Up      ToC       Page 27 
   Relays MAY be used to aggregate requests from multiple Network Access
   Servers (NASes) within a common geographical area (POP).  The use of
   Relays is advantageous since it eliminates the need for NASes to be
   configured with the necessary security information they would
   otherwise require to communicate with Diameter servers in other
   realms.  Likewise, this reduces the configuration load on Diameter
   servers that would otherwise be necessary when NASes are added,
   changed or deleted.

   Relays modify Diameter messages by inserting and removing routing
   information, but do not modify any other portion of a message.
   Relays SHOULD NOT maintain session state but MUST maintain
   transaction state.

    +------+    --------->     +------+     --------->    +------+
    |      |    1. Request     |      |     2. Request    |      |
    | NAS  |                   | DRL  |                   | HMS  |
    |      |    4. Answer      |      |     3. Answer     |      |
    +------+    <---------     +------+     <---------    +------+
   example.net                example.net                example.com

                  Figure 2: Relaying of Diameter messages

   The example provided in Figure 2 depicts a request issued from NAS,
   which is an access device, for the user bob@example.com.  Prior to
   issuing the request, NAS performs a Diameter route lookup, using
   "example.com" as the key, and determines that the message is to be
   relayed to DRL, which is a Diameter Relay.  DRL performs the same
   route lookup as NAS, and relays the message to HMS, which is
   example.com's Home Diameter Server.  HMS identifies that the request
   can be locally supported (via the realm), processes the
   authentication and/or authorization request, and replies with an
   answer, which is routed back to NAS using saved transaction state.

   Since Relays do not perform any application level processing, they
   provide relaying services for all Diameter applications, and
   therefore MUST advertise the Relay Application Identifier.

2.8.2.  Proxy Agents

   Similarly to relays, proxy agents route Diameter messages using the
   Diameter Routing Table.  However, they differ since they modify
   messages to implement policy enforcement.  This requires that proxies
   maintain the state of their downstream peers (e.g., access devices)
   to enforce resource usage, provide admission control, and
   provisioning.

Top      Up      ToC       Page 28 
   It is important to note that although proxies MAY provide a value-add
   function for NASes, they do not allow access devices to use end-to-
   end security, since modifying messages breaks authentication.

   Proxies MAY be used in call control centers or access ISPs that
   provide outsourced connections, they can monitor the number and types
   of ports in use, and make allocation and admission decisions
   according to their configuration.

   Proxies that wish to limit resources MUST maintain session state.
   All proxies MUST maintain transaction state.

   Since enforcing policies requires an understanding of the service
   being provided, Proxies MUST only advertise the Diameter applications
   they support.

2.8.3.  Redirect Agents

   Redirect agents are useful in scenarios where the Diameter routing
   configuration needs to be centralized.  An example is a redirect
   agent that provides services to all members of a consortium, but does
   not wish to be burdened with relaying all messages between realms.
   This scenario is advantageous since it does not require that the
   consortium provide routing updates to its members when changes are
   made to a member's infrastructure.

   Since redirect agents do not relay messages, and only return an
   answer with the information necessary for Diameter agents to
   communicate directly, they do not modify messages.  Since redirect
   agents do not receive answer messages, they cannot maintain session
   state.  Further, since redirect agents never relay requests, they are
   not required to maintain transaction state.

   The example provided in Figure 3 depicts a request issued from the
   access device, NAS, for the user bob@example.com.  The message is
   forwarded by the NAS to its relay, DRL, which does not have a routing
   entry in its Diameter Routing Table for example.com.  DRL has a
   default route configured to DRD, which is a redirect agent that
   returns a redirect notification to DRL, as well as HMS' contact
   information.  Upon receipt of the redirect notification, DRL
   establishes a transport connection with HMS, if one doesn't already
   exist, and forwards the request to it.

Top      Up      ToC       Page 29 
                               +------+
                               |      |
                               | DRD  |
                               |      |
                               +------+
                                ^    |
                    2. Request  |    | 3. Redirection
                                |    |    Notification
                                |    v
    +------+    --------->     +------+     --------->    +------+
    |      |    1. Request     |      |     4. Request    |      |
    | NAS  |                   | DRL  |                   | HMS  |
    |      |    6. Answer      |      |     5. Answer     |      |
    +------+    <---------     +------+     <---------    +------+
   example.net                example.net               example.com

                 Figure 3: Redirecting a Diameter Message

   Since redirect agents do not perform any application level
   processing, they provide relaying services for all Diameter
   applications, and therefore MUST advertise the Relay Application
   Identifier.

2.8.4.  Translation Agents

   A translation agent is a device that provides translation between two
   protocols (e.g., RADIUS<->Diameter, TACACS+<->Diameter).  Translation
   agents are likely to be used as aggregation servers to communicate
   with a Diameter infrastructure, while allowing for the embedded
   systems to be migrated at a slower pace.

   Given that the Diameter protocol introduces the concept of long-lived
   authorized sessions, translation agents MUST be session stateful and
   MUST maintain transaction state.

   Translation of messages can only occur if the agent recognizes the
   application of a particular request, and therefore translation agents
   MUST only advertise their locally supported applications.

    +------+    --------->     +------+     --------->    +------+
    |      |  RADIUS Request   |      |  Diameter Request |      |
    | NAS  |                   | TLA  |                   | HMS  |
    |      |  RADIUS Answer    |      |  Diameter Answer  |      |
    +------+    <---------     +------+     <---------    +------+
   example.net                example.net               example.com

                Figure 4: Translation of RADIUS to Diameter

Top      Up      ToC       Page 30 
2.9.  End-to-End Security Framework

   End-to-end security services include confidentiality and message
   origin authentication.  These services are provided by supporting AVP
   integrity and confidentiality between two peers, communicating
   through agents.

   End-to-end security is provided via the End-to-End security
   extension, described in [AAACMS].  The circumstances requiring the
   use of end-to-end security are determined by policy on each of the
   peers. Security policies, which are not the subject of
   standardization, may be applied by next hop Diameter peer or by
   destination realm.  For example, where TLS or IPsec transmission-
   level security is sufficient, there may be no need for end-to-end
   security.

   End-to-end security policies include:

   -  Never use end-to-end security.

   -  Use end-to-end security on messages containing sensitive AVPs.
      Which AVPs are sensitive is determined by service provider policy.
      AVPs containing keys and passwords should be considered sensitive.
      Accounting AVPs may be considered sensitive.  Any AVP for which
      the P bit may be set or which may be encrypted may be considered
      sensitive.

   -  Always use end-to-end security.

   It is strongly RECOMMENDED that all Diameter implementations support
   end-to-end security.

2.10.  Diameter Path Authorization

   As noted in Section 2.2, Diameter requires transmission level
   security to be used on each connection (TLS or IPsec).  Therefore,
   each connection is authenticated, replay and integrity protected and
   confidential on a per-packet basis.

   In addition to authenticating each connection, each connection as
   well as the entire session MUST also be authorized.  Before
   initiating a connection, a Diameter Peer MUST check that its peers
   are authorized to act in their roles.  For example, a Diameter peer
   may be authentic, but that does not mean that it is authorized to act
   as a Diameter Server advertising a set of Diameter applications.

Top      Up      ToC       Page 31 
   Prior to bringing up a connection, authorization checks are performed
   at each connection along the path.  Diameter capabilities negotiation
   (CER/CEA) also MUST be carried out, in order to determine what
   Diameter applications are supported by each peer.  Diameter sessions
   MUST be routed only through authorized nodes that have advertised
   support for the Diameter application required by the session.

   As noted in Section 6.1.8, a relay or proxy agent MUST append a
   Route-Record AVP to all requests forwarded.  The AVP contains the
   identity of the peer the request was received from.

   The home Diameter server, prior to authorizing a session, MUST check
   the Route-Record AVPs to make sure that the route traversed by the
   request is acceptable.  For example, administrators within the home
   realm may not wish to honor requests that have been routed through an
   untrusted realm.  By authorizing a request, the home Diameter server
   is implicitly indicating its willingness to engage in the business
   transaction as specified by the contractual relationship between the
   server and the previous hop.  A DIAMETER_AUTHORIZATION_REJECTED error
   message (see Section 7.1.5) is sent if the route traversed by the
   request is unacceptable.

   A home realm may also wish to check that each accounting request
   message corresponds to a Diameter response authorizing the session.
   Accounting requests without corresponding authorization responses
   SHOULD be subjected to further scrutiny, as should accounting
   requests indicating a difference between the requested and provided
   service.

   Similarly, the local Diameter agent, on receiving a Diameter response
   authorizing a session, MUST check the Route-Record AVPs to make sure
   that the route traversed by the response is acceptable.  At each
   step, forwarding of an authorization response is considered evidence
   of a willingness to take on financial risk relative to the session.
   A local realm may wish to limit this exposure, for example, by
   establishing credit limits for intermediate realms and refusing to
   accept responses which would violate those limits.  By issuing an
   accounting request corresponding to the authorization response, the
   local realm implicitly indicates its agreement to provide the service
   indicated in the authorization response.  If the service cannot be
   provided by the local realm, then a DIAMETER_UNABLE_TO_COMPLY error
   message MUST be sent within the accounting request; a Diameter client
   receiving an authorization response for a service that it cannot
   perform MUST NOT substitute an alternate service, and then send
   accounting requests for the alternate service instead.

Top      Up      ToC       Page 32 
3.  Diameter Header

   A summary of the Diameter header format is shown below.  The fields
   are transmitted in network byte order.

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Version    |                 Message Length                |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   | command flags |                  Command-Code                 |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                         Application-ID                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                      Hop-by-Hop Identifier                    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                      End-to-End Identifier                    |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  AVPs ...
   +-+-+-+-+-+-+-+-+-+-+-+-+-

   Version
      This Version field MUST be set to 1 to indicate Diameter Version
      1.

   Message Length
      The Message Length field is three octets and indicates the length
      of the Diameter message including the header fields.

   Command Flags
      The Command Flags field is eight bits.  The following bits are
      assigned:

       0 1 2 3 4 5 6 7
      +-+-+-+-+-+-+-+-+
      |R P E T r r r r|
      +-+-+-+-+-+-+-+-+

      R(equest)   - If set, the message is a request.  If cleared, the
                    message is an answer.
      P(roxiable) - If set, the message MAY be proxied, relayed or
                    redirected.  If cleared, the message MUST be
                    locally processed.
      E(rror)     - If set, the message contains a protocol error,
                    and the message will not conform to the ABNF
                    described for this command.  Messages with the 'E'

Top      Up      ToC       Page 33 
                    bit set are commonly referred to as error
                    messages.  This bit MUST NOT be set in request
                    messages.  See Section 7.2.
      T(Potentially re-transmitted message)
                  - This flag is set after a link failover procedure,
                    to aid the removal of duplicate requests.  It is
                    set when resending requests not yet acknowledged,
                    as an indication of a possible duplicate due to a
                    link failure.  This bit MUST be cleared when
                    sending a request for the first time, otherwise
                    the sender MUST set this flag.  Diameter agents
                    only need to be concerned about the number of
                    requests they send based on a single received
                    request; retransmissions by other entities need
                    not be tracked.  Diameter agents that receive a
                    request with the T flag set, MUST keep the T flag
                    set in the forwarded request.  This flag MUST NOT
                    be set if an error answer message (e.g., a
                    protocol error) has been received for the earlier
                    message.  It can be set only in cases where no
                    answer has been received from the server for a
                    request and the request is sent again.  This flag
                    MUST NOT be set in answer messages.

      r(eserved)  - these flag bits are reserved for future use, and
                    MUST be set to zero, and ignored by the receiver.

   Command-Code
      The Command-Code field is three octets, and is used in order to
      communicate the command associated with the message.  The 24-bit
      address space is managed by IANA (see Section 11.2.1).

      Command-Code values 16,777,214 and 16,777,215 (hexadecimal values
      FFFFFE -FFFFFF) are reserved for experimental use (See Section
      11.3).

   Application-ID
      Application-ID is four octets and is used to identify to which
      application the message is applicable for.  The application can be
      an authentication application, an accounting application or a
      vendor specific application.  See Section 11.3 for the possible
      values that the application-id may use.

      The application-id in the header MUST be the same as what is
      contained in any relevant AVPs contained in the message.

Top      Up      ToC       Page 34 
   Hop-by-Hop Identifier
      The Hop-by-Hop Identifier is an unsigned 32-bit integer field (in
      network byte order) and aids in matching requests and replies.
      The sender MUST ensure that the Hop-by-Hop identifier in a request
      is unique on a given connection at any given time, and MAY attempt
      to ensure that the number is unique across reboots.  The sender of
      an Answer message MUST ensure that the Hop-by-Hop Identifier field
      contains the same value that was found in the corresponding
      request.  The Hop-by-Hop identifier is normally a monotonically
      increasing number, whose start value was randomly generated.  An
      answer message that is received with an unknown Hop-by-Hop
      Identifier MUST be discarded.

   End-to-End Identifier
      The End-to-End Identifier is an unsigned 32-bit integer field (in
      network byte order) and is used to detect duplicate messages.
      Upon reboot implementations MAY set the high order 12 bits to
      contain the low order 12 bits of current time, and the low order
      20 bits to a random value.  Senders of request messages MUST
      insert a unique identifier on each message.  The identifier MUST
      remain locally unique for a period of at least 4 minutes, even
      across reboots.  The originator of an Answer message MUST ensure
      that the End-to-End Identifier field contains the same value that
      was found in the corresponding request.  The End-to-End Identifier
      MUST NOT be modified by Diameter agents of any kind.  The
      combination of the Origin-Host (see Section 6.3) and this field is
      used to detect duplicates.  Duplicate requests SHOULD cause the
      same answer to be transmitted (modulo the hop-by-hop Identifier
      field and any routing AVPs that may be present), and MUST NOT
      affect any state that was set when the original request was
      processed.  Duplicate answer messages that are to be locally
      consumed (see Section 6.2) SHOULD be silently discarded.

   AVPs
      AVPs are a method of encapsulating information relevant to the
      Diameter message.  See Section 4 for more information on AVPs.

Top      Up      ToC       Page 35 
3.1.  Command Codes

   Each command Request/Answer pair is assigned a command code, and the
   sub-type (i.e., request or answer) is identified via the 'R' bit in
   the Command Flags field of the Diameter header.

   Every Diameter message MUST contain a command code in its header's
   Command-Code field, which is used to determine the action that is to
   be taken for a particular message.  The following Command Codes are
   defined in the Diameter base protocol:

   Command-Name             Abbrev.    Code       Reference
   --------------------------------------------------------
   Abort-Session-Request     ASR       274           8.5.1
   Abort-Session-Answer      ASA       274           8.5.2
   Accounting-Request        ACR       271           9.7.1
   Accounting-Answer         ACA       271           9.7.2
   Capabilities-Exchange-    CER       257           5.3.1
      Request
   Capabilities-Exchange-    CEA       257           5.3.2
      Answer
   Device-Watchdog-Request   DWR       280           5.5.1
   Device-Watchdog-Answer    DWA       280           5.5.2
   Disconnect-Peer-Request   DPR       282           5.4.1
   Disconnect-Peer-Answer    DPA       282           5.4.2
   Re-Auth-Request           RAR       258           8.3.1
   Re-Auth-Answer            RAA       258           8.3.2
   Session-Termination-      STR       275           8.4.1
      Request
   Session-Termination-      STA       275           8.4.2
      Answer

Top      Up      ToC       Page 36 
3.2.  Command Code ABNF specification

   Every Command Code defined MUST include a corresponding ABNF
   specification, which is used to define the AVPs that MUST or MAY be
   present.  The following format is used in the definition:

   command-def      = command-name "::=" diameter-message

   command-name     = diameter-name

   diameter-name    = ALPHA *(ALPHA / DIGIT / "-")

   diameter-message = header  [ *fixed] [ *required] [ *optional]
                      [ *fixed]

   header           = "<" Diameter-Header:" command-id
                      [r-bit] [p-bit] [e-bit] [application-id]">"

   application-id   = 1*DIGIT

   command-id       = 1*DIGIT
                      ; The Command Code assigned to the command

   r-bit            = ", REQ"
                      ; If present, the 'R' bit in the Command
                      ; Flags is set, indicating that the message
                      ; is a request, as opposed to an answer.

   p-bit            = ", PXY"
                      ; If present, the 'P' bit in the Command
                      ; Flags is set, indicating that the message
                      ; is proxiable.

   e-bit            = ", ERR"
                      ; If present, the 'E' bit in the Command
                      ; Flags is set, indicating that the answer
                      ; message contains a Result-Code AVP in
                      ; the "protocol error" class.

   fixed            = [qual] "<" avp-spec ">"
                      ; Defines the fixed position of an AVP

   required         = [qual] "{" avp-spec "}"
                      ; The AVP MUST be present and can appear
                      ; anywhere in the message.

Top      Up      ToC       Page 37 
   optional         = [qual] "[" avp-name "]"
                      ; The avp-name in the 'optional' rule cannot
                      ; evaluate to any AVP Name which is included
                      ; in a fixed or required rule.  The AVP can
                      ; appear anywhere in the message.

   qual             = [min] "*" [max]
                      ; See ABNF conventions, RFC 2234 Section 6.6.
                      ; The absence of any qualifiers depends on whether
                      ; it precedes a fixed, required, or optional
                      ; rule.  If a fixed or required rule has no
                      ; qualifier, then exactly one such AVP MUST
                      ; be present.  If an optional rule has no
                      ; qualifier, then 0 or 1 such AVP may be
                      ; present.
                      ;
                      ; NOTE:  "[" and "]" have a different meaning
                      ; than in ABNF (see the optional rule, above).
                      ; These braces cannot be used to express
                      ; optional fixed rules (such as an optional
                      ; ICV at the end).  To do this, the convention
                      ; is '0*1fixed'.

   min              = 1*DIGIT
                      ; The minimum number of times the element may
                      ; be present.  The default value is zero.

   max              = 1*DIGIT
                      ; The maximum number of times the element may
                      ; be present.  The default value is infinity.  A
                      ; value of zero implies the AVP MUST NOT be
                      ; present.

   avp-spec         = diameter-name
                      ; The avp-spec has to be an AVP Name, defined
                      ; in the base or extended Diameter
                      ; specifications.

   avp-name         = avp-spec / "AVP"
                      ; The string "AVP" stands for *any* arbitrary
                      ; AVP Name, which does not conflict with the
                      ; required or fixed position AVPs defined in
                      ; the command code definition.

Top      Up      ToC       Page 38 
   The following is a definition of a fictitious command code:

   Example-Request ::= < "Diameter-Header: 9999999, REQ, PXY >
                       { User-Name }
                     * { Origin-Host }
                     * [ AVP

3.3.  Diameter Command Naming Conventions

   Diameter command names typically includes one or more English words
   followed by the verb Request or Answer.  Each English word is
   delimited by a hyphen.  A three-letter acronym for both the request
   and answer is also normally provided.

   An example is a message set used to terminate a session.  The command
   name is Session-Terminate-Request and Session-Terminate-Answer, while
   the acronyms are STR and STA, respectively.

   Both the request and the answer for a given command share the same
   command code.  The request is identified by the R(equest) bit in the
   Diameter header set to one (1), to ask that a particular action be
   performed, such as authorizing a user or terminating a session.  Once
   the receiver has completed the request it issues the corresponding
   answer, which includes a result code that communicates one of the
   following:

   -  The request was successful

   -  The request failed

   -  An additional request must be sent to provide information the peer
      requires prior to returning a successful or failed answer.

   -  The receiver could not process the request, but provides
      information about a Diameter peer that is able to satisfy the
      request, known as redirect.

   Additional information, encoded within AVPs, MAY also be included in
   answer  messages.

4.  Diameter AVPs

   Diameter AVPs carry specific authentication, accounting,
   authorization, routing and security information as well as
   configuration details for the request and reply.

   Some AVPs MAY be listed more than once.  The effect of such an AVP is
   specific, and is specified in each case by the AVP description.

Top      Up      ToC       Page 39 
   Each AVP of type OctetString MUST be padded to align on a 32-bit
   boundary, while other AVP types align naturally.  A number of zero-
   valued bytes are added to the end of the AVP Data field till a word
   boundary is reached.  The length of the padding is not reflected in
   the AVP Length field.

4.1.  AVP Header

   The fields in the AVP header MUST be sent in network byte order.  The
   format of the header is:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                           AVP Code                            |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |V M P r r r r r|                  AVP Length                   |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                        Vendor-ID (opt)                        |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |    Data ...
   +-+-+-+-+-+-+-+-+

   AVP Code
      The AVP Code, combined with the Vendor-Id field, identifies the
      attribute uniquely.  AVP numbers 1 through 255 are reserved for
      backward compatibility with RADIUS, without setting the Vendor-Id
      field.  AVP numbers 256 and above are used for Diameter, which are
      allocated by IANA (see Section 11.1).

   AVP Flags
      The AVP Flags field informs the receiver how each attribute must
      be handled.  The 'r' (reserved) bits are unused and SHOULD be set
      to 0.  Note that subsequent Diameter applications MAY define
      additional bits within the AVP Header, and an unrecognized bit
      SHOULD be considered an error.  The 'P' bit indicates the need for
      encryption for end-to-end security.

      The 'M' Bit, known as the Mandatory bit, indicates whether support
      of the AVP is required.  If an AVP with the 'M' bit set is
      received by a Diameter client, server, proxy, or translation agent
      and either the AVP or its value is unrecognized, the message MUST
      be rejected.  Diameter Relay and redirect agents MUST NOT reject
      messages with unrecognized AVPs.

Top      Up      ToC       Page 40 
      The 'M' bit MUST be set according to the rules defined for the AVP
      containing it.  In order to preserve interoperability, a Diameter
      implementation MUST be able to exclude from a Diameter message any
      Mandatory AVP which is neither defined in the base Diameter
      protocol nor in any of the Diameter Application specifications
      governing the message in which it appears.  It MAY do this in one
      of the following ways:

      1) If a message is rejected because it contains a Mandatory AVP
         which is neither defined in the base Diameter standard nor in
         any of the Diameter Application specifications governing the
         message in which it appears, the implementation may resend the
         message without the AVP, possibly inserting additional standard
         AVPs instead.

      2) A configuration option may be provided on a system wide, per
         peer, or per realm basis that would allow/prevent particular
         Mandatory AVPs to be sent.  Thus an administrator could change
         the configuration to avoid interoperability problems.

      Diameter implementations are required to support all Mandatory
      AVPs which are allowed by the message's formal syntax and defined
      either in the base Diameter standard or in one of the Diameter
      Application specifications governing the message.

      AVPs with the 'M' bit cleared are informational only and a
      receiver that receives a message with such an AVP that is not
      supported, or whose value is not supported, MAY simply ignore the
      AVP.

      The 'V' bit, known as the Vendor-Specific bit, indicates whether
      the optional Vendor-ID field is present in the AVP header.  When
      set the AVP Code belongs to the specific vendor code address
      space.

      Unless otherwise noted, AVPs will have the following default AVP
      Flags field settings:

         The 'M' bit MUST be set.  The 'V' bit MUST NOT be set.

   AVP Length
      The AVP Length field is three octets, and indicates the number of
      octets in this AVP including the AVP Code, AVP Length, AVP Flags,
      Vendor-ID field (if present) and the AVP data.  If a message is
      received with an invalid attribute length, the message SHOULD be
      rejected.

Top      Up      ToC       Page 41 
4.1.1.  Optional Header Elements

   The AVP Header contains one optional field.  This field is only
   present if the respective bit-flag is enabled.

   Vendor-ID
      The Vendor-ID field is present if the 'V' bit is set in the AVP
      Flags field.  The optional four-octet Vendor-ID field contains the
      IANA assigned "SMI Network Management Private Enterprise Codes"
      [ASSIGNNO] value, encoded in network byte order.  Any vendor
      wishing to implement a vendor-specific Diameter AVP MUST use their
      own Vendor-ID along with their privately managed AVP address
      space, guaranteeing that they will not collide with any other
      vendor's vendor-specific AVP(s), nor with future IETF
      applications.

      A vendor ID value of zero (0) corresponds to the IETF adopted AVP
      values, as managed by the IANA.  Since the absence of the vendor
      ID field implies that the AVP in question is not vendor specific,
      implementations MUST NOT use the zero (0) vendor ID.

4.2.  Basic AVP Data Formats

   The Data field is zero or more octets and contains information
   specific to the Attribute.  The format and length of the Data field
   is determined by the AVP Code and AVP Length fields.  The format of
   the Data field MUST be one of the following base data types or a data
   type derived from the base data types.  In the event that a new Basic
   AVP Data Format is needed, a new version of this RFC must be created.

   OctetString
      The data contains arbitrary data of variable length.  Unless
      otherwise noted, the AVP Length field MUST be set to at least 8
      (12 if the 'V' bit is enabled).  AVP Values of this type that are
      not a multiple of four-octets in length is followed by the
      necessary padding so that the next AVP (if any) will start on a
      32-bit boundary.

   Integer32
      32 bit signed value, in network byte order.  The AVP Length field
      MUST be set to 12 (16 if the 'V' bit is enabled).

   Integer64
      64 bit signed value, in network byte order.  The AVP Length field
      MUST be set to 16 (20 if the 'V' bit is enabled).

Top      Up      ToC       Page 42 
   Unsigned32
      32 bit unsigned value, in network byte order.  The AVP Length
      field MUST be set to 12 (16 if the 'V' bit is enabled).

   Unsigned64
      64 bit unsigned value, in network byte order.  The AVP Length
      field MUST be set to 16 (20 if the 'V' bit is enabled).

   Float32
      This represents floating point values of single precision as
      described by [FLOATPOINT].  The 32-bit value is transmitted in
      network byte order.  The AVP Length field MUST be set to 12 (16 if
      the 'V' bit is enabled).

   Float64
      This represents floating point values of double precision as
      described by [FLOATPOINT].  The 64-bit value is transmitted in
      network byte order.  The AVP Length field MUST be set to 16 (20 if
      the 'V' bit is enabled).

   Grouped
      The Data field is specified as a sequence of AVPs.  Each of these
      AVPs follows - in the order in which they are specified -
      including their headers and padding.  The AVP Length field is set
      to 8 (12 if the 'V' bit is enabled) plus the total length of all
      included AVPs, including their headers and padding.  Thus the AVP
      length field of an AVP of type Grouped is always a multiple of 4.

4.3.  Derived AVP Data Formats

   In addition to using the Basic AVP Data Formats, applications may
   define data formats derived from the Basic AVP Data Formats.  An
   application that defines new AVP Derived Data Formats MUST include
   them in a section entitled "AVP Derived Data Formats", using the same
   format as the definitions below.  Each new definition must be either
   defined or listed with a reference to the RFC that defines the
   format.

   The below AVP Derived Data Formats are commonly used by applications.

   Address
      The Address format is derived from the OctetString AVP Base
      Format.  It is a discriminated union, representing, for example a
      32-bit (IPv4) [IPV4] or 128-bit (IPv6) [IPV6] address, most
      significant octet first.  The first two octets of the Address

Top      Up      ToC       Page 43 
      AVP represents the AddressType, which contains an Address Family
      defined in [IANAADFAM].  The AddressType is used to discriminate
      the content and format of the remaining octets.

   Time
      The Time format is derived from the OctetString AVP Base Format.
      The string MUST contain four octets, in the same format as the
      first four bytes are in the NTP timestamp format.  The NTP
      Timestamp format is defined in chapter 3 of [SNTP].

      This represents the number of seconds since 0h on 1 January 1900
      with respect to the Coordinated Universal Time (UTC).

      On 6h 28m 16s UTC, 7 February 2036 the time value will overflow.
      SNTP [SNTP] describes a procedure to extend the time to 2104.
      This procedure MUST be supported by all DIAMETER nodes.

   UTF8String
      The UTF8String format is derived from the OctetString AVP Base
      Format.  This is a human readable string represented using the
      ISO/IEC IS 10646-1 character set, encoded as an OctetString using
      the UTF-8 [UFT8] transformation format described in RFC 2279.

      Since additional code points are added by amendments to the 10646
      standard from time to time, implementations MUST be prepared to
      encounter any code point from 0x00000001 to 0x7fffffff.  Byte
      sequences that do not correspond to the valid encoding of a code
      point into UTF-8 charset or are outside this range are prohibited.

      The use of control codes SHOULD be avoided.  When it is necessary
      to represent a new line, the control code sequence CR LF SHOULD be
      used.

      The use of leading or trailing white space SHOULD be avoided.

      For code points not directly supported by user interface hardware
      or software, an alternative means of entry and display, such as
      hexadecimal, MAY be provided.

      For information encoded in 7-bit US-ASCII, the UTF-8 charset is
      identical to the US-ASCII charset.

      UTF-8 may require multiple bytes to represent a single character /
      code point; thus the length of an UTF8String in octets may be
      different from the number of characters encoded.

      Note that the AVP Length field of an UTF8String is measured in
      octets, not characters.

Top      Up      ToC       Page 44 
   DiameterIdentity
      The DiameterIdentity format is derived from the OctetString AVP
      Base Format.

         DiameterIdentity  = FQDN

      DiameterIdentity value is used to uniquely identify a Diameter
      node for purposes of duplicate connection and routing loop
      detection.

      The contents of the string MUST be the FQDN of the Diameter node.
      If multiple Diameter nodes run on the same host, each Diameter
      node MUST be assigned a unique DiameterIdentity.  If a Diameter
      node can be identified by several FQDNs, a single FQDN should be
      picked at startup, and used as the only DiameterIdentity for that
      node, whatever the connection it is sent on.

   DiameterURI

      The DiameterURI MUST follow the Uniform Resource Identifiers (URI)
      syntax [URI] rules specified below:

      "aaa://" FQDN [ port ] [ transport ] [ protocol ]

                      ; No transport security

      "aaas://" FQDN [ port ] [ transport ] [ protocol ]

                      ; Transport security used

      FQDN               = Fully Qualified Host Name

      port               = ":" 1*DIGIT

                      ; One of the ports used to listen for
                      ; incoming connections.
                      ; If absent,
                      ; the default Diameter port (3868) is
                      ; assumed.

      transport          = ";transport=" transport-protocol

                      ; One of the transports used to listen
                      ; for incoming connections.  If absent,
                      ; the default SCTP [SCTP] protocol is
                      ; assumed.  UDP MUST NOT be used when
                      ; the aaa-protocol field is set to
                      ; diameter.

Top      Up      ToC       Page 45 
      transport-protocol = ( "tcp" / "sctp" / "udp" )

      protocol           = ";protocol=" aaa-protocol

                      ; If absent, the default AAA protocol
                      ; is diameter.

      aaa-protocol       = ( "diameter" / "radius" / "tacacs+" )

      The following are examples of valid Diameter host identities:

      aaa://host.example.com;transport=tcp
      aaa://host.example.com:6666;transport=tcp
      aaa://host.example.com;protocol=diameter
      aaa://host.example.com:6666;protocol=diameter
      aaa://host.example.com:6666;transport=tcp;protocol=diameter
      aaa://host.example.com:1813;transport=udp;protocol=radius

   Enumerated
      Enumerated is derived from the Integer32 AVP Base Format.  The
      definition contains a list of valid values and their
      interpretation and is described in the Diameter application
      introducing the AVP.

   IPFilterRule
      The IPFilterRule format is derived from the OctetString AVP Base
      Format.  It uses the ASCII charset.  Packets may be filtered based
      on the following information that is associated with it:

         Direction                          (in or out)
         Source and destination IP address  (possibly masked)
         Protocol
         Source and destination port        (lists or ranges)
         TCP flags
         IP fragment flag
         IP options
         ICMP types

      Rules for the appropriate direction are evaluated in order, with
      the first matched rule terminating the evaluation.  Each packet is
      evaluated once.  If no rule matches, the packet is dropped if the
      last rule evaluated was a permit, and passed if the last rule was
      a deny.

Top      Up      ToC       Page 46 
      IPFilterRule filters MUST follow the format:

         action dir proto from src to dst [options]

         action       permit - Allow packets that match the rule.
                      deny   - Drop packets that match the rule.

         dir          "in" is from the terminal, "out" is to the
                      terminal.

         proto        An IP protocol specified by number.  The "ip"
                      keyword means any protocol will match.

         src and dst  <address/mask> [ports]

                      The <address/mask> may be specified as:
                      ipno       An IPv4 or IPv6 number in dotted-
                                 quad or canonical IPv6 form.  Only
                                 this exact IP number will match the
                                 rule.
                      ipno/bits  An IP number as above with a mask
                                 width of the form 1.2.3.4/24.  In
                                 this case, all IP numbers from
                                 1.2.3.0 to 1.2.3.255 will match.
                                 The bit width MUST be valid for the
                                 IP version and the IP number MUST
                                 NOT have bits set beyond the mask.
                                 For a match to occur, the same IP
                                 version must be present in the
                                 packet that was used in describing
                                 the IP address.  To test for a
                                 particular IP version, the bits part
                                 can be set to zero.  The keyword
                                 "any" is 0.0.0.0/0 or the IPv6
                                 equivalent.  The keyword "assigned"
                                 is the address or set of addresses
                                 assigned to the terminal.  For IPv4,
                                 a typical first rule is often "deny
                                 in ip! assigned"

                      The sense of the match can be inverted by
                      preceding an address with the not modifier (!),
                      causing all other addresses to be matched
                      instead.  This does not affect the selection of
                      port numbers.

Top      Up      ToC       Page 47 
                      With the TCP, UDP and SCTP protocols, optional
                      ports may be specified as:

                         {port/port-port}[,ports[,...]]

                      The '-' notation specifies a range of ports
                      (including boundaries).

                      Fragmented packets that have a non-zero offset
                      (i.e., not the first fragment) will never match
                      a rule that has one or more port
                      specifications.  See the frag option for
                      details on matching fragmented packets.

         options:
            frag    Match if the packet is a fragment and this is not
                    the first fragment of the datagram.  frag may not
                    be used in conjunction with either tcpflags or
                    TCP/UDP port specifications.

            ipoptions spec
                    Match if the IP header contains the comma
                    separated list of options specified in spec.  The
                    supported IP options are:

                    ssrr (strict source route), lsrr (loose source
                    route), rr (record packet route) and ts
                    (timestamp).  The absence of a particular option
                    may be denoted with a '!'.

            tcpoptions spec
                    Match if the TCP header contains the comma
                    separated list of options specified in spec.  The
                    supported TCP options are:

                    mss (maximum segment size), window (tcp window
                    advertisement), sack (selective ack), ts (rfc1323
                    timestamp) and cc (rfc1644 t/tcp connection
                    count).  The absence of a particular option may
                    be denoted with a '!'.

            established
                    TCP packets only.  Match packets that have the RST
                    or ACK bits set.

            setup   TCP packets only.  Match packets that have the SYN
                    bit set but no ACK bit.

Top      Up      ToC       Page 48 
            tcpflags spec
                    TCP packets only.  Match if the TCP header
                    contains the comma separated list of flags
                    specified in spec.  The supported TCP flags are:

                    fin, syn, rst, psh, ack and urg.  The absence of a
                    particular flag may be denoted with a '!'.  A rule
                    that contains a tcpflags specification can never
                    match a fragmented packet that has a non-zero
                    offset.  See the frag option for details on
                    matching fragmented packets.

            icmptypes types
                    ICMP packets only.  Match if the ICMP type is in
                    the list types.  The list may be specified as any
                    combination of ranges or individual types
                    separated by commas.  Both the numeric values and
                    the symbolic values listed below can be used.  The
                    supported ICMP types are:

                    echo reply (0), destination unreachable (3),
                    source quench (4), redirect (5), echo request
                    (8), router advertisement (9), router
                    solicitation (10), time-to-live exceeded (11), IP
                    header bad (12), timestamp request (13),
                    timestamp reply (14), information request (15),
                    information reply (16), address mask request (17)
                    and address mask reply (18).

   There is one kind of packet that the access device MUST always
   discard, that is an IP fragment with a fragment offset of one. This
   is a valid packet, but it only has one use, to try to circumvent
   firewalls.

      An access device that is unable to interpret or apply a deny rule
      MUST terminate the session.  An access device that is unable to
      interpret or apply a permit rule MAY apply a more restrictive
      rule.  An access device MAY apply deny rules of its own before the
      supplied rules, for example to protect the access device owner's
      infrastructure.

   The rule syntax is a modified subset of ipfw(8) from FreeBSD, and the
   ipfw.c code may provide a useful base for implementations.

Top      Up      ToC       Page 49 
   QoSFilterRule
      The QosFilterRule format is derived from the OctetString AVP Base
      Format.  It uses the ASCII charset.  Packets may be marked or
      metered based on the following information that is associated with
      it:

         Direction                          (in or out)
         Source and destination IP address  (possibly masked)
         Protocol
         Source and destination port        (lists or ranges)
         DSCP values                        (no mask or range)

      Rules for the appropriate direction are evaluated in order, with
      the first matched rule terminating the evaluation.  Each packet is
      evaluated once.  If no rule matches, the packet is treated as best
      effort.  An access device that is unable to interpret or apply a
      QoS rule SHOULD NOT terminate the session.

   QoSFilterRule filters MUST follow the format:

   action dir proto from src to dst [options]

                tag    - Mark packet with a specific DSCP
                         [DIFFSERV].  The DSCP option MUST be
                         included.
                meter  - Meter traffic.  The metering options
                         MUST be included.

   dir          The format is as described under IPFilterRule.

                proto        The format is as described under
                IPFilterRule.

                src and dst  The format is as described under
                IPFilterRule.

4.4.  Grouped AVP Values

   The Diameter protocol allows AVP values of type 'Grouped.'  This
   implies that the Data field is actually a sequence of AVPs.  It is
   possible to include an AVP with a Grouped type within a Grouped type,
   that is, to nest them.  AVPs within an AVP of type Grouped have the
   same padding requirements as non-Grouped AVPs, as defined in Section
   4.

Top      Up      ToC       Page 50 
   The AVP Code numbering space of all AVPs included in a Grouped AVP is
   the same as for non-grouped AVPs.  Further, if any of the AVPs
   encapsulated within a Grouped AVP has the 'M' (mandatory) bit set,
   the Grouped AVP itself MUST also include the 'M' bit set.

   Every Grouped AVP defined MUST include a corresponding grammar, using
   ABNF [ABNF] (with modifications), as defined below.

      grouped-avp-def  = name "::=" avp

      name-fmt         = ALPHA *(ALPHA / DIGIT / "-")

      name             = name-fmt
                         ; The name has to be the name of an AVP,
                         ; defined in the base or extended Diameter
                         ; specifications.

      avp              = header  [ *fixed] [ *required] [ *optional]
                         [ *fixed]

      header           = "<" "AVP-Header:" avpcode [vendor] ">"

      avpcode          = 1*DIGIT
                         ; The AVP Code assigned to the Grouped AVP

      vendor           = 1*DIGIT
                         ; The Vendor-ID assigned to the Grouped AVP.
                         ; If absent, the default value of zero is
                         ; used.

4.4.1.  Example AVP with a Grouped Data type

   The Example-AVP (AVP Code 999999) is of type Grouped and is used to
   clarify how Grouped AVP values work.  The Grouped Data field has the
   following ABNF grammar:

      Example-AVP  ::= < AVP Header: 999999 >
                       { Origin-Host }
                     1*{ Session-Id }
                      *[ AVP ]

   An Example-AVP with Grouped Data follows.

   The Origin-Host AVP is required (Section 6.3).  In this case:

      Origin-Host = "example.com".

Top      Up      ToC       Page 51 
   One or more Session-Ids must follow.  Here there are two:

      Session-Id =
        "grump.example.com:33041;23432;893;0AF3B81"

      Session-Id =
        "grump.example.com:33054;23561;2358;0AF3B82"

   optional AVPs included are

      Recovery-Policy = <binary>
         2163bc1d0ad82371f6bc09484133c3f09ad74a0dd5346d54195a7cf0b35
         2cabc881839a4fdcfbc1769e2677a4c1fb499284c5f70b48f58503a45c5
         c2d6943f82d5930f2b7c1da640f476f0e9c9572a50db8ea6e51e1c2c7bd
         f8bb43dc995144b8dbe297ac739493946803e1cee3e15d9b765008a1b2a
         cf4ac777c80041d72c01e691cf751dbf86e85f509f3988e5875dc905119
         26841f00f0e29a6d1ddc1a842289d440268681e052b30fb638045f7779c
         1d873c784f054f688f5001559ecff64865ef975f3e60d2fd7966b8c7f92

      Futuristic-Acct-Record = <binary>
         fe19da5802acd98b07a5b86cb4d5d03f0314ab9ef1ad0b67111ff3b90a0
         57fe29620bf3585fd2dd9fcc38ce62f6cc208c6163c008f4258d1bc88b8
         17694a74ccad3ec69269461b14b2e7a4c111fb239e33714da207983f58c
         41d018d56fe938f3cbf089aac12a912a2f0d1923a9390e5f789cb2e5067
         d3427475e49968f841

   The data for the optional AVPs is represented in hex since the format
   of these AVPs is neither known at the time of definition of the
   Example-AVP group, nor (likely) at the time when the example instance
   of this AVP is interpreted - except by Diameter implementations which
   support the same set of AVPs.  The encoding example illustrates how
   padding is used and how length fields are calculated.  Also note that
   AVPs may be present in the Grouped AVP value which the receiver
   cannot interpret (here, the Recover-Policy and Futuristic-Acct-Record
   AVPs).

Top      Up      ToC       Page 52 
   This AVP would be encoded as follows:

           0       1       2       3       4       5       6       7
       +-------+-------+-------+-------+-------+-------+-------+-------+
     0 |     Example AVP Header (AVP Code = 999999), Length = 468      |
       +-------+-------+-------+-------+-------+-------+-------+-------+
     8 |     Origin-Host AVP Header (AVP Code = 264), Length = 19      |
       +-------+-------+-------+-------+-------+-------+-------+-------+
    16 |  'e'  |  'x'  |  'a'  |  'm'  |  'p'  |  'l'  |  'e'  |  '.'  |
       +-------+-------+-------+-------+-------+-------+-------+-------+
    24 |  'c'  |  'o'  |  'm'  |Padding|     Session-Id AVP Header     |
       +-------+-------+-------+-------+-------+-------+-------+-------+
    32 | (AVP Code = 263), Length = 50 |  'g'  |  'r'  |  'u'  |  'm'  |
       +-------+-------+-------+-------+-------+-------+-------+-------+
                                     . . .
       +-------+-------+-------+-------+-------+-------+-------+-------+
    64 |  'A'  |  'F'  |  '3'  |  'B'  |  '8'  |  '1'  |Padding|Padding|
       +-------+-------+-------+-------+-------+-------+-------+-------+
    72 |     Session-Id AVP Header (AVP Code = 263), Length = 51       |
       +-------+-------+-------+-------+-------+-------+-------+-------+
    80 |  'g'  |  'r'  |  'u'  |  'm'  |  'p'  |  '.'  |  'e'  |  'x'  |
       +-------+-------+-------+-------+-------+-------+-------+-------+
                                     . . .
       +-------+-------+-------+-------+-------+-------+-------+-------+
   104 |  '0'  |  'A'  |  'F'  |  '3'  |  'B'  |  '8'  |  '2'  |Padding|
       +-------+-------+-------+-------+-------+-------+-------+-------+
   112 |   Recovery-Policy Header (AVP Code = 8341), Length = 223      |
       +-------+-------+-------+-------+-------+-------+-------+-------+
   120 |  0x21 | 0x63  | 0xbc  | 0x1d  | 0x0a  | 0xd8  | 0x23  | 0x71  |
       +-------+-------+-------+-------+-------+-------+-------+-------+
                                     . . .
       +-------+-------+-------+-------+-------+-------+-------+-------+
   320 |  0x2f | 0xd7  | 0x96  | 0x6b  | 0x8c  | 0x7f  | 0x92  |Padding|
       +-------+-------+-------+-------+-------+-------+-------+-------+
   328 | Futuristic-Acct-Record Header (AVP Code = 15930), Length = 137|
       +-------+-------+-------+-------+-------+-------+-------+-------+
   336 |  0xfe | 0x19  | 0xda  | 0x58  | 0x02  | 0xac  | 0xd9  | 0x8b  |
       +-------+-------+-------+-------+-------+-------+-------+-------+
                                     . . .
       +-------+-------+-------+-------+-------+-------+-------+-------+
   464 |  0x41 |Padding|Padding|Padding|
       +-------+-------+-------+-------+

Top      Up      ToC       Page 53 
4.5.  Diameter Base Protocol AVPs

   The following table describes the Diameter AVPs defined in the base
   protocol, their AVP Code values, types, possible flag values and
   whether the AVP MAY be encrypted.  For the originator of a Diameter
   message, "Encr" (Encryption) means that if a message containing that
   AVP is to be sent via a  Diameter agent (proxy, redirect or relay)
   then the message MUST NOT be sent unless there is end-to-end security
   between the originator and the recipient and integrity /
   confidentiality protection is offered for this AVP OR the originator
   has locally trusted configuration that indicates that end-to-end
   security is not needed.  Similarly, for the originator of a Diameter
   message, a "P" in the "MAY" column means that if a message containing
   that AVP is to be sent via a  Diameter agent (proxy, redirect or
   relay) then the message MUST NOT be sent unless there is end-to-end
   security between the originator and the recipient or the originator
   has locally trusted configuration that indicates that end-to-end
   security is not needed.

   Due to space constraints, the short form DiamIdent is used to
   represent DiameterIdentity.

Top      Up      ToC       Page 54 
                                            +---------------------+
                                            |    AVP Flag rules   |
                                            |----+-----+----+-----|----+
                   AVP  Section             |    |     |SHLD| MUST|    |
   Attribute Name  Code Defined  Data Type  |MUST| MAY | NOT|  NOT|Encr|
   -----------------------------------------|----+-----+----+-----|----|
   Acct-             85  9.8.2   Unsigned32 | M  |  P  |    |  V  | Y  |
     Interim-Interval                       |    |     |    |     |    |
   Accounting-      483  9.8.7   Enumerated | M  |  P  |    |  V  | Y  |
     Realtime-Required                      |    |     |    |     |    |
   Acct-            50   9.8.5   UTF8String | M  |  P  |    |  V  | Y  |
     Multi-Session-Id                       |    |     |    |     |    |
   Accounting-      485  9.8.3   Unsigned32 | M  |  P  |    |  V  | Y  |
     Record-Number                          |    |     |    |     |    |
   Accounting-      480  9.8.1   Enumerated | M  |  P  |    |  V  | Y  |
     Record-Type                            |    |     |    |     |    |
   Accounting-       44  9.8.4   OctetString| M  |  P  |    |  V  | Y  |
    Session-Id                              |    |     |    |     |    |
   Accounting-      287  9.8.6   Unsigned64 | M  |  P  |    |  V  | Y  |
     Sub-Session-Id                         |    |     |    |     |    |
   Acct-            259  6.9     Unsigned32 | M  |  P  |    |  V  | N  |
     Application-Id                         |    |     |    |     |    |
   Auth-            258  6.8     Unsigned32 | M  |  P  |    |  V  | N  |
     Application-Id                         |    |     |    |     |    |
   Auth-Request-    274  8.7     Enumerated | M  |  P  |    |  V  | N  |
      Type                                  |    |     |    |     |    |
   Authorization-   291  8.9     Unsigned32 | M  |  P  |    |  V  | N  |
     Lifetime                               |    |     |    |     |    |
   Auth-Grace-      276  8.10    Unsigned32 | M  |  P  |    |  V  | N  |
     Period                                 |    |     |    |     |    |
   Auth-Session-    277  8.11    Enumerated | M  |  P  |    |  V  | N  |
     State                                  |    |     |    |     |    |
   Re-Auth-Request- 285  8.12    Enumerated | M  |  P  |    |  V  | N  |
     Type                                   |    |     |    |     |    |
   Class             25  8.20    OctetString| M  |  P  |    |  V  | Y  |
   Destination-Host 293  6.5     DiamIdent  | M  |  P  |    |  V  | N  |
   Destination-     283  6.6     DiamIdent  | M  |  P  |    |  V  | N  |
     Realm                                  |    |     |    |     |    |
   Disconnect-Cause 273  5.4.3   Enumerated | M  |  P  |    |  V  | N  |
   E2E-Sequence AVP 300  6.15    Grouped    | M  |  P  |    |  V  | Y  |
   Error-Message    281  7.3     UTF8String |    |  P  |    | V,M | N  |
   Error-Reporting- 294  7.4     DiamIdent  |    |  P  |    | V,M | N  |
     Host                                   |    |     |    |     |    |
   Event-Timestamp   55  8.21    Time       | M  |  P  |    |  V  | N  |
   Experimental-    297  7.6     Grouped    | M  |  P  |    |  V  | N  |
      Result                                |    |     |    |     |    |
   -----------------------------------------|----+-----+----+-----|----|

Top      Up      ToC       Page 55 
                                            +---------------------+
                                            |    AVP Flag rules   |
                                            |----+-----+----+-----|----+
                   AVP  Section             |    |     |SHLD| MUST|MAY |
   Attribute Name  Code Defined  Data Type  |MUST| MAY | NOT|  NOT|Encr|
   -----------------------------------------|----+-----+----+-----|----|
   Experimental-    298  7.7     Unsigned32 | M  |  P  |    |  V  | N  |
      Result-Code                           |    |     |    |     |    |
   Failed-AVP       279  7.5     Grouped    | M  |  P  |    |  V  | N  |
   Firmware-        267  5.3.4   Unsigned32 |    |     |    |P,V,M| N  |
     Revision                               |    |     |    |     |    |
   Host-IP-Address  257  5.3.5   Address    | M  |  P  |    |  V  | N  |
   Inband-Security                          | M  |  P  |    |  V  | N  |
      -Id           299  6.10    Unsigned32 |    |     |    |     |    |
   Multi-Round-     272  8.19    Unsigned32 | M  |  P  |    |  V  | Y  |
     Time-Out                               |    |     |    |     |    |
   Origin-Host      264  6.3     DiamIdent  | M  |  P  |    |  V  | N  |
   Origin-Realm     296  6.4     DiamIdent  | M  |  P  |    |  V  | N  |
   Origin-State-Id  278  8.16    Unsigned32 | M  |  P  |    |  V  | N  |
   Product-Name     269  5.3.7   UTF8String |    |     |    |P,V,M| N  |
   Proxy-Host       280  6.7.3   DiamIdent  | M  |     |    | P,V | N  |
   Proxy-Info       284  6.7.2   Grouped    | M  |     |    | P,V | N  |
   Proxy-State       33  6.7.4   OctetString| M  |     |    | P,V | N  |
   Redirect-Host    292  6.12    DiamURI    | M  |  P  |    |  V  | N  |
   Redirect-Host-   261  6.13    Enumerated | M  |  P  |    |  V  | N  |
      Usage                                 |    |     |    |     |    |
   Redirect-Max-    262  6.14    Unsigned32 | M  |  P  |    |  V  | N  |
      Cache-Time                            |    |     |    |     |    |
   Result-Code      268  7.1     Unsigned32 | M  |  P  |    |  V  | N  |
   Route-Record     282  6.7.1   DiamIdent  | M  |     |    | P,V | N  |
   Session-Id       263  8.8     UTF8String | M  |  P  |    |  V  | Y  |
   Session-Timeout   27  8.13    Unsigned32 | M  |  P  |    |  V  | N  |
   Session-Binding  270  8.17    Unsigned32 | M  |  P  |    |  V  | Y  |
   Session-Server-  271  8.18    Enumerated | M  |  P  |    |  V  | Y  |
     Failover                               |    |     |    |     |    |
   Supported-       265  5.3.6   Unsigned32 | M  |  P  |    |  V  | N  |
     Vendor-Id                              |    |     |    |     |    |
   Termination-     295  8.15    Enumerated | M  |  P  |    |  V  | N  |
      Cause                                 |    |     |    |     |    |
   User-Name          1  8.14    UTF8String | M  |  P  |    |  V  | Y  |
   Vendor-Id        266  5.3.3   Unsigned32 | M  |  P  |    |  V  | N  |
   Vendor-Specific- 260  6.11    Grouped    | M  |  P  |    |  V  | N  |
      Application-Id                        |    |     |    |     |    |
   -----------------------------------------|----+-----+----+-----|----|


Next RFC Part