Master Server Query Protocol

This page documents the legacy Steam master server query protocol. The legacy master is still used by older games and mods, but all current games and mods query the master server through Steam directly.

Client to master server

Send the following UDP query to a master server to get a list of Source host servers.

Format

Type	Field	Value
Byte	Message Type	0x31 - the character "1"
Byte	Region Code	See below
String Zero	IP:Port	See below
String Zero	Filter	See below

Region codes

The region of the world that you wish to find servers in.

Byte	Description
0x00	US East coast
0x01	US West coast
0x02	South America
0x03	Europe
0x04	Asia
0x05	Australia
0x06	Middle East
0x07	Africa
0xFF	Rest of the world

IP:Port

The first IP:Port you should send is "0.0.0.0:0"

From then on, IP:Port becomes the last IP:Port received in the master servers reply. This allows steam to then grab another list of more servers.

Terminate this with 0x00

Note that whenever you open a new socket (and thus get a new random client port), the Master Server will always send you the first batch of IPs even if you pass a valid game server IP. Do not close your socket between packets.

Filter

Allows you to restrict the results to servers running a certain game, map, etc. Insert \ in between filter parameters

Filter code	What the filter returns
0x00 (NULL, empty string)	All servers
\nor\[x]	A special filter, specifies that servers matching any of the following [x] conditions should not be returned
\nand\[x]	A special filter, specifies that servers matching all of the following [x] conditions should not be returned
\dedicated\1	Servers running dedicated
\secure\1	Servers using anti-cheat technology (VAC, but potentially others as well)
\gamedir\[mod]	Servers running the specified modification (ex. cstrike)
\map\[map]	Servers running the specified map (ex. cs_italy)
\linux\1	Servers running on a Linux platform
\password\0	Servers that are not password protected
\empty\1	Servers that are not empty
\full\1	Servers that are not full
\proxy\1	Servers that are spectator proxies
\appid\[appid]	Servers that are running game [appid]
\napp\[appid]	Servers that are NOT running game [appid] (This was introduced to block Left 4 Dead games from the Steam Server Browser)
\noplayers\1	Servers that are empty
\white\1	Servers that are whitelisted
\gametype\[tag,...]	Servers with all of the given tag(s) in sv_tags
\gamedata\[tag,...]	Servers with all of the given tag(s) in their 'hidden' tags (L4D2)
\gamedataor\[tag,...]	Servers with any of the given tag(s) in their 'hidden' tags (L4D2)
\name_match\[hostname]	Servers with their hostname matching [hostname] (can use * as a wildcard)
\version_match\[version]	Servers running version [version] (can use * as a wildcard)
\collapse_addr_hash\1	Return only one server for each unique IP address matched
\gameaddr\[ip]	Return only servers on the specified IP address (port supported and optional)

Sample query

To get all servers everywhere:

0000   31 FF 30 2E 30 2E 30 2E    1.0.0.0.
0008   30 3A 30 00 00             0:0..

This is the default Steam Server Browser query to the Source Master Server. It uses the napp filter to filter out Left 4 Dead games (which are meant to be joined using the matchmaking feature).

31 ff 30 2e 30 2e 30 2e 30 3a 30 00 5c 6e 61 70  1.0.0.0.0:0.\nap
70 5c 35 30 30 00                                p\500.

Master servers

Current master servers are:

GoldSrc

Currently hl1master.steampowered.com [1] and MasterServer2.vdf contain the old outdated IPs for querying HL1 master servers (although heartbeat may work). The new IPs (for querying) as reported by an old HLDS version: "208.64.200.117", "208.64.200.118". The new HLDS version supposedly reports "none". [2]

 Note: The port numbers used by hl1master.steampowered.com can be anything between 27010 and 27013.

Source

hl2master.steampowered.com:27011 (numeric IP may change)

This domain name points to 3 A records (IPs), one of them using a different port (27015) according to the MasterServer2.vdf.

Rag Doll Kung Fu

See MasterServer2.vdf below.

Red Orchestra

Unknown - same as Source?

SiN 1 Multiplayer

69.28.151.162:27010 - still current?

If you can, get your application to check the file Steam\config\MasterServer2.vdf to get the latest list of master servers.

Reply format

The reply always starts with FF FF FF FF 66 0A.

The format is then a series of these server address blocks:

Type	Data
Byte	First octet of IP address
Byte	Second octet of IP address
Byte	Third octet of IP address
Byte	Fourth octet of IP address
Unsigned Short	Port number - usually 27015 (69 87) - this is network ordered, which is unlike every other Steam protocol.

Some of the servers may be unreachable, so query each server directly to find out. Note also that this list is not exhaustive, so if you're looking for a particular type of server make sure that you specify a filter with the query, rather than filtering client side.

End of IP address list

The full requested IP list may not fit in 1 x packet. Subsequent packets must be requested by using the last received IP address and Port as the 'seed' in the next request.

The end of the IP list is indicated by a received IP address of 0.0.0.0 Port:0.

Implementations

• Asynchronous Game Query Library A Java based Asynchronous Game Query Library powered by Netty
• Steam Condenser - a multi-language library for querying the Steam Community, Source and GoldSrc game servers as well as the Steam master servers. Currently it is implemented in Java, PHP and Ruby.
• Master Server Query Protocol/Parsing packet - an example code for parsing the packet (presumably Visual Basic).
• User:Pizzahut/msqp.php - a code example for querying a Half-Life master server using the PHP language.
• QueryMaster C# library
• vmsq Node.js implementation for querying master servers

Game server to master server

Join

Shortly after a game server has been initialized, it picks two master servers to "join." In order for clients to see a particular game server when they click on the "Internet" tab, the game server must be present in the Steam master servers' records.

The game server sends each master server "q" (71).

The master servers each respond by sending FF FF FF FF 73 0A followed by a (relatively) unique 4-byte "challenge" number. If you send the master servers an invalid challenge, you will get another challenge as a response.

Challenge response

After receiving the challenge packet, the game server then sends its challenge information in the following format:

Goldsource

 002a                                 30 0a 5c 70 72 6f            0.\pro
 0030   74 6f 63 6f 6c 5c 34 37 5c 63 68 61 6c 6c 65 6e  tocol\47\challen
 0040   67 65 5c 31 33 33 39 38 39 35 37 30 32 5c 70 6c  ge\1339895702\pl
 0050   61 79 65 72 73 5c 30 5c 6d 61 78 5c 32 5c 62 6f  ayers\0\max\2\bo
 0060   74 73 5c 30 5c 67 61 6d 65 64 69 72 5c 63 73 74  ts\0\gamedir\cst
 0070   72 69 6b 65 5c 6d 61 70 5c 64 65 5f 64 75 73 74  rike\map\de_dust
 0080   5c 74 79 70 65 5c 64 5c 70 61 73 73 77 6f 72 64  \type\d\password
 0090   5c 30 5c 6f 73 5c 6c 5c 73 65 63 75 72 65 5c 30  \0\os\l\secure\0
 00a0   5c 6c 61 6e 5c 30 5c 76 65 72 73 69 6f 6e 5c 31  \lan\0\version\1
 00b0   2e 31 2e 32 2e 35 2f 53 74 64 69 6f 5c 72 65 67  .1.2.5/Stdio\reg
 00c0   69 6f 6e 5c 32 35 35 5c 70 72 6f 64 75 63 74 5c  ion\255\product\
 00d0   63 73 74 72 69 6b 65 0a                          cstrike.

The challenge number is simply the challenge sent by the master server converted to an int.

Source

 002a                                 30 0a 5c 70 72 6f            0.\pro
 0030   74 6f 63 6f 6c 5c 37 5c 63 68 61 6c 6c 65 6e 67  tocol\7\challeng
 0040   65 5c 31 33 33 39 36 31 38 32 33 5c 70 6c 61 79  e\133961823\play
 0050   65 72 73 5c 30 5c 6d 61 78 5c 32 5c 62 6f 74 73  ers\0\max\2\bots
 0060   5c 30 5c 67 61 6d 65 64 69 72 5c 63 73 74 72 69  \0\gamedir\cstri
 0070   6b 65 5c 6d 61 70 5c 64 65 5f 64 75 73 74 5c 70  ke\map\de_dust\p
 0080   61 73 73 77 6f 72 64 5c 30 5c 6f 73 5c 6c 5c 6c  assword\0\os\l\l
 0090   61 6e 5c 30 5c 72 65 67 69 6f 6e 5c 32 35 35 5c  an\0\region\255\
 00a0   74 79 70 65 5c 64 5c 73 65 63 75 72 65 5c 30 5c  type\d\secure\0\
 00b0   76 65 72 73 69 6f 6e 5c 31 2e 30 2e 30 2e 32 38  version\1.0.0.28
 00c0   5c 70 72 6f 64 75 63 74 5c 63 73 74 72 69 6b 65  \product\cstrike
 00d0   0a                                               .

The challenge number is simply the challenge sent by the master server converted to an int.

Orangebox

0000   30 0a 5c 70 72 6f 74 6f 63 6f 6c 5c 37 5c 63 68  0.\protocol\7\ch
0010   61 6c 6c 65 6e 67 65 5c 31 39 35 39 36 38 37 33  allenge\19596873
0020   39 39 5c 70 6c 61 79 65 72 73 5c 31 5c 6d 61 78  99\players\1\max
0030   5c 34 5c 62 6f 74 73 5c 30 5c 67 61 6d 65 64 69  \4\bots\0\gamedi
0040   72 5c 74 66 5c 6d 61 70 5c 61 72 65 6e 61 5f 62  r\tf\map\arena_b
0050   61 64 6c 61 6e 64 73 5c 70 61 73 73 77 6f 72 64  adlands\password
0060   5c 30 5c 6f 73 5c 77 5c 6c 61 6e 5c 31 5c 72 65  \0\os\w\lan\1\re
0070   67 69 6f 6e 5c 2d 31 5c 67 61 6d 65 74 79 70 65  gion\-1\gametype
0080   5c 61 72 65 6e 61 5c 74 79 70 65 5c 6c 5c 73 65  \arena\type\l\se
0090   63 75 72 65 5c 30 5c 76 65 72 73 69 6f 6e 5c 31  cure\0\version\1
00a0   2e 30 2e 34 2e 33 5c 70 72 6f 64 75 63 74 5c 74  .0.4.3\product\t
00b0   66 0a                                            f.

The challenge number is simply the challenge sent by the master server converted to an int.

Differences

The field order is a bit different with Source than with Goldsource.

Goldsource	protocol	challenge	players	max	bots	gamedir	map	type	password	os	secure	lan	version	region	product
Source	protocol	challenge	players	max	bots	gamedir	map	password	os	lan	region	type	secure	version	product

Heartbeat

A "heartbeat" occurs every five minutes in order to let the master servers know that a game server is still "alive". The game server simply goes through the process of "joining" the master server list again.

Quit

Goldsource

The game server sends the master server 62 0A to signal that the game server has shut down.

Source

The game server sends the master server 62 0A 00 to signal that the game server has shut down.

See also

• Server Queries
• Source RCON Protocol