Master - 82.44.126.169 Master List talk filter tcp.flags.push == 1 && tcp.port == 29339 Master List Outbound talk filter tcp.flags.push == 1 && ip.dst == 82.44.126.169 && tcp.port == 29339 Master List Inbound talk filter tcp.flags.push == 1 && ip.src == 82.44.126.169 && tcp.port == 29339 Hosts talk filter tcp.flags.push == 1 && (tcp.len == 13 || tcp.len == 37) Hosts detail request filter tcp.flags.push == 1 && tcp.len == 13 && tcp.seq == 1 S2 = 0.5p7 unless otherwise denoted In order to get the master list, you need to create a conversation something similar to this:- Open connection to master (82.44.126.169:29339) Send MLRequestPacket Recv MLResponsePacket ... loop until you find an entry with an address of 0.0.0.0 & a port of 0 Close connection to master In order to get host details, you must create a conversation like this:- Open connection to host IP:PORT Send HDRequestPacketA Recv HDResponsePacketA Send HDRequestPacketB Recv HDResonsePacketB Close connection to host Master list Regular request packet (77 bytes) Offset Length Type Content -------------------------------------------------------------- 0 5 sz "LLFS".0x00 5 1 Byte Unknown (0x04) 6 1 Byte LLFS protocol ver? S1 = 0x1c (28), S2 = 0x1d (29) 7 1 Byte Packet type (Regular = 0x00, HostSpec = 0x01) 8 1 Byte Filter options; 0x02 + (PrivateOff = 4, PublicOff = 8, EmptyOff = 16, FullOff = 32) 9 1 Byte Type (Demo = 0x00, S2-1 = 0x01, S2 = 0x02) 10 1 Byte LFS version * 10 (Divide to get actual) 11 1 Char Host version (Major) 12 1 Byte Host version (Minor) 13 1 Byte Car-set1 Filter (On) 14 1 Byte Car-set2 Filter (On) 15 1 Byte Car-set3 Filter (on) 16 1 Byte Unknown /NULL 17 1 Byte Car-set1 Filter (off) 18 1 Byte Car-set2 Filter (off) 19 1 Byte Car-set3 Filter (off) 20 21 null Padding / Reserved 41 24 sz $name.0x00 65 1 Byte Unknown (S2 = 0x19, S2-1 = 0x09, Demo = 0x08) 66 1 Byte Unknown / NULL 67 6 Bytes Encoded / Hashed password, Null on demo 73 2 Bytes Unknown / NULL 75 2 Bytes Unknown (S2 = 0x2e 0x4e, S2-1 = 0x1e 0x27, Demo = 0x0e 0x00) -------------------------------------------------------------- Master list regular response packet (117 bytes) Offset Length Type Content -------------------------------------------------------------- 0 1 Byte Packet length - 1 1 2 Short Total hosts 3 2 Bytes Unknown 5 16 Bytes Flags 0x08 + (0x01 = Private) 21 64 Bytes IP Addreses 85 32 Shorts Ports -------------------------------------------------------------- Master list HostSpec request packet (77 bytes) Offset Length Type Content -------------------------------------------------------------- 0 5 sz "LLFS".0x00 5 1 Byte Unknown (0x04) 6 1 Byte LLFS protocol ver? S1 = 0x1c (28), S2 = 0x1d (29) 7 1 Byte Packet type (Regular = 0x00, HostSpec = 0x01) 8 1 Byte Unknown / NULL 9 32 Char Hostname 41 24 sz $name.0x00 65 1 Byte Unknown (S2 = 0x19, S2-1 = 0x09, Demo = 0x08) 66 1 Byte Unknown / NULL 67 6 Bytes Encoded / Hashed password, Null on demo 73 2 Bytes Unknown / NULL 75 2 Bytes Unknown (S2 = 0x2e 0x4e, S2-1 = 0x1e 0x27, Demo = 0x0e 0x00) -------------------------------------------------------------- Master list hostspec response packet (21 bytes) Offset Length Type Content -------------------------------------------------------------- 0 1 Byte Packet length - 1 1 1 Byte Unknown / Null 2 2 Bytes Port 4 4 Byte[] IP (4 bytes, NOT an int) 8 2 Bytes Unknown, possibly part of conn key 10 2 Bytes Unknown / blank 12 4 Bytes Unknown, possibly part of conn key 16 4 Bytes Unknown / blank -------------------------------------------------------------- 0000 00 11 2f a5 7c c7 00 12 17 48 3a 93 08 00 45 40 ../.|....H:...E@ 0010 00 3d 29 3e 40 00 77 06 47 bb 52 2c 7e a9 c0 a8 .=)>@.w.G.R,~... 0020 01 04 72 9b 08 51 ab 9c d5 f6 7a 6c b1 9d 50 18 ..r..Q....zl..P. 0030 43 1b 87 ee 00 00|14 08 00 68 f8 ca 7d 29 14 b9 C........h..}).. 0040 2e 00 00 ca 43 ba 18 00 00 00 00 ....C...... ^ Start of data Host detail request packet (13 bytes) Offset Length Type Content -------------------------------------------------------------- 0 1 Byte Packet length - 1 1 1 Byte Type (S2 = 0x02, S2-1 = 0x01, S2Demo = 0x00) 2 1 Byte LFS version *10 (divide to get actual ver) 3 1 Char Host Version (major) 4 1 Byte Host Version (minor) 5 1 Byte LLFS protocol ver? (0x1d) 6 1 Byte Request Seq (0x01 for A, Ox02 for B) 7 2 Bytes Unknown (S2 = 0x2e (46) 0x4e (78), S2-1 = 0x1e (30) 0x27 (39), Demo = 0x0e 0x00) See at end of LLFS. 9 4 Bytes Unknown / Null / Reserved -------------------------------------------------------------- Host detail response packet A (37 bytes) Offset Length Type Content -------------------------------------------------------------- 0 1 Byte Packet length - 1 1 1 Byte Player count 2 1 Byte Max players 3 1 Byte Rules (standard rule bitfield) 4 1 Byte Unknown / Reserved? 5 32 Char Host name -------------------------------------------------------------- Host detail response packet B (S2 13 bytes) Offset Length Type Content -------------------------------------------------------------- 0 1 Byte Packet length - 1 1 4 Char Track Code 5 1 Char Host Version (Major) 6 1 Byte Host Version (Minor) 7 2 Bytes Unknown / reserved 9 1 Byte S2Cars1(XFG = 01, XRG = 02, XRT = 04, RB4 = 08, FX0 = 16, LX4 = 32, LX6 = 64, MRT = 128) 10 1 Byte S2Cars2(UF1 = 01, RAC = 02, FZ5 = 04, FOX = 08, XFR = 16, UFR = 32, F08 = 64, FXR = 128) 11 1 Byte S2Cars3(XRR = 01, FZR = 02) 12 1 Byte Unknown / Reserved (more cars?) --------------------------------------------------------------