drop diameter capture · parse aaa + s6a + s9 messages · runs locally
flags authentication-information bursts · cancel-location · reset · result-code failures · peer realm mismatch
encrypted diameter payloads opaque — metadata only · heuristic screener · not definitive proof