UT3 query protocol

From UnrealAdminWiki

Basics

The query port (on the server) seems to be a random port number by default, contrary to the UT2003/4 situation where it was one port above the gameport. The protocol uses UDP to send datagrams.

The UT3 query protocol is quite different from the UT2003/2004 query protocols.

This is the basic schema:

1. Client sends request to Server
2. Server replies with a unique number
3. Client sends new request to Server, including said number
4. Server replies with query information

These are the specifications of the packets:

Packet 1: Initial request

FE FD 09 XX XX XX XX

The first 2 bytes (FE FD) are the game identifier. In this case, they represent the UT3 Demo.

Byte 3 (09) indicate that the client wishes to receive the challenge string.

Bytes 4 to 7 (XX XX XX XX) are a sequence number, incrementing 'occasionally'.

Packet 2: First response

09 XX XX XX XX YY YY YY YY YY YY YY YY YY YY YY YY

The first byte (09) indicates this is a reply to the initial request.

Bytes 2 to 6 (XX XX XX XX) are the sequence number that was in the initial request.

Bytes 7 to 18 (YY YY YY YY YY YY YY YY YY YY YY YY) is an ASCII represented number. This number can start with a - sign (2D), and is padded with 00's at the end.

Packet 3: Second request

FE FD 00 WW WW WW WW ZZ ZZ ZZ ZZ FF FF FF 01

The first two bytes (FE FD) again indicate the game type (UT3 Demo).

Byte 3 (00) indicates that this is a request for server information.

Bytes 4 to 7 (WW WW WW WW) is a new sequence number, similar to the original sequence number but different. The exact formula to calculate this new sequence number is still unknown.

Bytes 8 to 11 (ZZ ZZ ZZ ZZ) is the hexadecimal representation of the number received from Packet 2. If that number was negative, it needs to be subtracted from 4294967296 before it is transcoded into the hexadecimal value.

Bytes 12 to 15 are always (FF FF FF 01).

Packet 4: Server information response

00 WW WW WW WW *DATA*

Byte 1 (00) indicates that this is a reply for a server information request.

Bytes 2 to 5 (WW WW WW WW) are the new sequence number, sent in Packet 3.

What follows is server information such as:

• Server name
• Server owner name
• Number of players
• Maximum number of players
• Number of public connections (?)
• Number of private connections (?)
• Number of open public connections (?)
• Number of open private connections (?)
• Mapname
• Gametype
• Stats enabled/disabled
• Dedicated or not