SS7 & Diameter — Telecom Signaling Protocols Guide

In this tutorial, you'll learn about SS7 & Diameter. We cover key concepts, practical examples, and best practices.

SS7 (Signaling System No. 7) and Diameter are the signaling protocols that telecom networks use to authenticate subscribers, route calls, send SMS, manage mobility, and enforce policy — SS7 powers PSTN and 2G/3G networks, while Diameter evolved for 4G LTE and 5G core interfaces.

What You'll Learn

• SS7 protocol stack: MTP 1-3, SCCP, TCAP, ISUP, MAP
• SS7 point codes and global title routing
• Diameter base protocol: AVPs, sessions, applications
• 3GPP Diameter interfaces: S6a, S11, Gx, Rx, Sh

Why SS7 and Diameter Matter

Signaling protocols are the nervous system of telecom networks. Without SS7, calls cannot be routed between carriers. Without Diameter, 4G devices cannot attach to the network, and 5G policy control cannot function. Understanding these protocols is essential for network engineers, security researchers, and interoperability testers.

Durga Antivirus Pro applies Diameter-style attribute-value pair (AVP) encoding for its agent-to-server configuration messages, ensuring extensible and type-safe communication.

Learning Path

flowchart LR
  A[Telecom Fundamentals] --> B[SS7: Legacy Signaling
You are here]
  B --> C[SS7 MAP & ISUP]
  C --> D[Diameter: 4G/5G Signaling]
  D --> E[5G Service-Based Architecture]
  style B fill:#f90,color:#fff

SS7 Protocol Stack

flowchart TD
  subgraph SS7 Stack
    ISUP[ISUP - Call Control]
    TCAP[TCAP - Transaction Capabilities]
    MAP[MAP - Mobile Application Part]
    SCCP[SCCP - Signaling Connection Control]
    MTP3[MTP Level 3 - Network]
    MTP2[MTP Level 2 - Link]
    MTP1[MTP Level 1 - Physical]
  end
  ISUP --> MTP3
  TCAP --> SCCP
  MAP --> TCAP
  SCCP --> MTP3
  MTP3 --> MTP2
  MTP2 --> MTP1

SS7 Addressing: Point Codes

SS7 networks route messages using Point Codes — numeric addresses for each signaling point:

ITU-T Point Code: 2-045-3
  Zone: 2 (USA)
  Area: 045 (California)
  ID:   3 (specific switch)

ANSI Point Code: 3-112-7
  Network: 3
  Cluster: 112
  Member:  7

class SS7Message:
    def __init__(self, opc, dpc, service, payload):
        self.opc = opc
        self.dpc = dpc
        self.service = service
        self.payload = payload

    def route(self):
        print(f"[MTP3] Routing from {self.opc} to {self.dpc}")
        if self.service in ("ISUP",):
            print(f"[MTP3] Service: {self.service} -> MTP3 direct")
        elif self.service == "MAP":
            print(f"[SCCP] Global Title Translation: {self.payload['msisdn']}")
            print(f"[SCCP] Translated to DPC: {self.dpc}")
            print(f"[TCAP] Invoke MAP operation: {self.payload['operation']}")
        print(f"[MTP2] Transmit on signaling link 0x13")
        return "sent"

msg = SS7Message("3-112-7", "2-045-3", "MAP", {
    "msisdn": "+1-555-0142",
    "operation": "sendAuthenticationInfoV3"
})
msg.route()

Expected output:

[MTP3] Routing from 3-112-7 to 2-045-3
[SCCP] Global Title Translation: +1-555-0142
[SCCP] Translated to DPC: 2-045-3
[TCAP] Invoke MAP operation: sendAuthenticationInfoV3
[MTP2] Transmit on signaling link 0x13

Diameter Protocol

Diameter is the next-generation signaling protocol for 4G LTE and 5G, replacing SS7 MAP for core network interfaces:

flowchart LR
  subgraph Diameter Interfaces
    S6a[HSS <-> MME
S6a]
    S11[MME <-> SGW
S11]
    Gx[PCRF <-> PGW
Gx]
    Rx[PCRF <-> AF/IMS
Rx]
    Sh[HSS <-> AS/IMS
Sh]
    Sd[PCRF <-> TDF
Sd]
  end

Diameter Message Structure

Diameter uses AVPs (Attribute-Value Pairs) to encode information:

Diameter Message: Credit-Control-Request (CCR)
  Session-Id: "session-001@realm.net"
  Origin-Host: "ocs.realm.net"
  Origin-Realm: "realm.net"
  Destination-Realm: "realm.net"
  Auth-Application-Id: 4 (Diameter Credit Control)
  CC-Request-Type: UPDATE_REQUEST
  CC-Request-Number: 1
  Subscription-Id:
    Subscription-Id-Type: END_USER_IMSI
    Subscription-Id-Data: "310410123456789"
  Multiple-Services-Indicator: MULTIPLE_SERVICES_SUPPORTED
  Service-Information: [AVPs for voice/data usage]

class DiameterMessage:
    def __init__(self, command_code, application_id):
        self.version = 1
        self.command = command_code
        self.app_id = application_id
        self.avps = {}

    def add_avp(self, code, vendor, data):
        self.avps[code] = {"vendor": vendor, "data": data}

    def encode(self):
        print(f"DIAMETER: version={self.version}, cmd={self.command}")
        print(f"  app_id={self.app_id}, hop-by-hop=0xA3B2C1D0")
        for code, avp in self.avps.items():
            print(f"  AVP {code}: vendor={avp['vendor']} data={avp['data']}")
        size = 20 + sum(12 + len(str(a["data"])) for a in self.avps.values())
        return f"Encoded: {size} bytes"

ccr = DiameterMessage(272, 4)  # 272 = Credit-Control
ccr.add_avp(263, 0, "session-001@realm.net")     # Session-Id
ccr.add_avp(416, 10415, 1)   # CC-Request-Type (UPDATE)
ccr.add_avp(443, 0, "310410123456789")            # Subscription-Id
print(ccr.encode())

Expected output:

DIAMETER: version=1, cmd=272
  app_id=4, hop-by-hop=0xA3B2C1D0
  AVP 263: vendor=0 data=session-001@realm.net
  AVP 416: vendor=10415 data=1
  AVP 443: vendor=0 data=310410123456789
Encoded: 87 bytes

Key Diameter Applications

SS7 Security Inject

class SS7SecurityCheck:
    def __init__(self):
        self.blacklisted_operators = ["untrusted_operator"]
        self.max_queries_per_minute = 100

    def check_location_query(self, source_operator, target_imsi, query_count):
        print(f"[SS7-FW] Location query from {source_operator} for {target_imsi}")
        if source_operator in self.blacklisted_operators:
            print(f"[SS7-FW] BLOCKED: Operator in blacklist")
            return False
        if query_count > self.max_queries_per_minute:
            print(f"[SS7-FW] RATE LIMIT: {query_count} queries/min exceeded")
            return False
        print(f"[SS7-FW] ALLOWED: Sending MAP_ANY_TIME_INTERROGATION to HLR")
        return True

fw = SS7SecurityCheck()
fw.check_location_query("malicious_op", "310410123456789", 5)
fw.check_location_query("roaming_partner", "310410987654321", 150)

Expected output:

[SS7-FW] Location query from malicious_op for 310410123456789
[SS7-FW] BLOCKED: Operator in blacklist
[SS7-FW] Location query from roaming_partner for 310410987654321
[SS7-FW] RATE LIMIT: 150 queries/min exceeded

Common Errors

1. Confusing SS7 and Diameter Addressing

SS7 uses Point Codes (3-level hierarchy). Diameter uses Realm-Based Routing (FQDN and realms). They are fundamentally different addressing schemes.

2. Forgetting SS7 Has No Security

SS7 was designed for trusted carrier-only networks. No authentication exists for signaling requests. Any connected carrier can query any subscriber's data.

3. Misconfiguring Diameter Peer Tables

Diameter requires each node to have a peer table with Origin-Host, Origin-Realm, and IP address. Missing entries cause connection failures without clear error messages.

4. Ignoring Overload Control

SS7 has MTP3 congestion control. Diameter has no built-in overload mechanism — applications must implement their own using OC-OLI AVPs.

Practice Questions

1. What is the difference between MTP3 and SCCP? MTP3 routes on Point Codes only. SCCP adds Global Title Translation (GTT) for number-based routing, enabling TCAP/MAP database queries.

2. What is an AVP in Diameter? Attribute-Value Pair — the fundamental data unit in Diameter messages, with a code, vendor ID, and variable-length value.

3. What is the S6a interface used for? Between MME and HSS — subscriber authentication (EPS-AKA vectors), subscription data retrieval, location tracking.

Challenge: Design a signaling flow for a roaming LTE subscriber attaching to a visited network. Trace the SS7 MAP (for 2G/3G fallback) and Diameter S6a messages between VPLMN MME, HSS in HPLMN, and the subscriber's PGW session establishment.

FAQ

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro. Updated 2026-06-24.