Xfire Network Protocol

Change History:

Rev	Date	Description
1	2007-08-16	Original revision by Iain McGinniss of OpenFire.
2	2008-06-15	Significant revision and lots of new information.

Document Overview

This document aims to provide a full specification for the Xfire instant messaging protocol, including packet structure and application program behavior. A lot of the information found in this document would not be available if it were not for the hard work of the XFireLib project team (http://xfirelib.sphene.net), who reverse engineered the protocol to write XFireLib. This document was written to formally document what they discovered, and to be provided as a basis for implementing Xfire communication libraries in alternative languages or on other platforms.

Note that this document may be incomplete. Not every aspect of the official Xfire client has been examined. Nor has every possible combination of scenarios. What follows should be adequate in most circumstances, but no guarnatees are made as to the correctness under all circumstances.

Section 2 describes the higher level protocol behaviors, while Section 3 describes the lower level packet interfaces.

Protocol Overview

High Level Description

The client logs in to the server by establishing a TCP link (SOCK_STREAM) to the Xfire central server (cs.xfire.com) on port 25999. After sending a short keying sequence to the server, the client and server exchange sequences of bytes that are arranged into short packets (see Section 3).

After authenticating as a specific user, communication occurs between the client and the server, and may occur between clients. The official Xfire client appears to support client-to-client (peer to peer) communication for IM conversations using UDP datagrams. The official Xfire client also uses HTTP requests to retrieve some information, such as user avatar images and update downloads.

Data Encoding

Xfire uses UTF-8 string encoding. Integer values are transmitted in Little Endian byte order (least significant byte first). Refer to Section 3 for more information.

Log In Sequence

After successfully opening a TCP connection to cs.xfire.com, the following sequence of packets is exchanged.

Seq. #	Source	Content	Comments
1	Client	String "UA01" (not a packet)	Keying sequence, in hex it is 0x55,0x41,0x30,0x31
2	Client	Client Version packet	Client version number
3	Server	Login Challenge packet	Server sends a value used to obscure the password (the "salt")
4	Client	Authentication Data packet	Client obscures the password using the "salt" and asks to be authenticated

After the above sequence of data exchanges, the Xfire server will respond with one of three known possible respones:

• New Client Version Available - The Xfire server indicates that the client's version is too old and gives information necessary to download the newest client version. The Xfire server will leave the connection open, but will stop responding to any new packets sent to it. The client should close the connection. See New Version Available packet.
• Authentication Failure - The supplied password was incorrect. The Xfire server will leave the connection open, but will stop responding to any new packets sent to it. The client should close the connection. See Login Failure packet.
• Authentication Success - The password was accepted. The Xfire server sends information that documents the current session and other information to be used by the client during the session. The log-in continuation sequence is shown below.

After authenticating successfully, the following sequence of packet exchanges occurs. Note that the order doesn't appear to be exact, and may change from version to version. For client implementation it is recommended to send the Client packets in the order they appear below.

Seq. #	Source	Content	Comments
5	Server	Authentication Success packet	Success indicator, and information to be used during the session. Response 1 to auth packet.
6	Server	Packet 400	Purpose is unknown.
7	Server	Packet 141	Purpose is unknown.
8	Client	Client Information packet	Identifies current skin, theme, and language
9	Server	Custom Friend Group Names	Lists all known custom friend groups.
10	Server	Custom Friend Group Members	Lists friends and their custom group memberships.
11	Server	Packet 148	Purpose is unknown - game information?
12	Server	Packet 155	Purpose is unknown
13	Server	Packet 157	Purpose is unknown
14	Server	Packet 177	Purpose is unknown
15	Server	Friend Group List Info	Gives specific information about friend group list.
16	Server	Friends List packet	Contains list of all friends
17	Server	Session ID Change packet	Contains list of all friends that are online and their session IDs
18	Server	Game status packet	List of friend game status (game IDs, IPs, and ports)
19	Server	In-Game Information packet	In-game information for given friends. These appear to be received even for people not on our friend list (maybe friend of friend?).
20	Server	Status Message Changed packet	Initial status message for one online friend's session; multiple messages of this type may be received
21	Client	Client Network Information packet	Client sends network information, including how peers may contact us

Idle Time

During network idle time, the client should periodically send Keep-alive packets. They let the server know the client is still around. It is unknown the minimum amount of time before a server terminates a connection. Sending keep-alive packets every minute seems to be reasonable.

Information View

The official Xfire client has an information view that contains additional information related to what the user is doing. Usually this relates to something selected in the main window (friends list, server list, downloads, etc.), but there are also generic views when nothing is selected or prior to log in.

The information view is an HTML view created from many templates included with the Xfire client. The template files use a special syntax to identify keys for information. The Xfire client replaces those keys with information either readily available, or soon retrieved. The client appears to make specific requests for information from the Xfire server or from one of the HTTP servers operated by Xfire.

The extra information includes an avatar picture. The specific URL for a given user's avatar picture is likely indicated by the content of certain request packets, but as of this writing the decoding is unknown. The pictures are then retrieved via an HTTP request. Known locations are:

Instant Messages

Messages are sent either:

• Routed through the log-in connection (to cs.xfire.com:25999)
• Via UDP connections directly between clients

There appear to be provisions in the network protocol to support either. The Client Network Information packet describes the availability to the master server. The Xfire client appears to support UPnP to put holes into visible router firewalls for a given port. Other clients can use that port to communicate with you. Indicating a 1 for a "NAT error" appears to work correctly to indicate that client-to-client communication is not possible.

Instant messages are plain UTF-8 text strings. As of this writing, the Xfire client support for chat rooms is not understood. Instant messages are usually directed to specific Session IDs, which are assigned to specific clients. It is assumed that chat rooms recieve their own Session ID which causes messages to be routed to all connected clients.

Friends of Friends

The Friends of Friends (Playing) feature allows an Xfire user to see what their friends' friends are playing. It can be seen as a community-building exercise because it allows friends to find new friends that play the same games they like.

In some ways, Friends of Friends is handled backwards. The Xfire server first sends a Game Status packet to the client. The game status packet assigns game IDs, addresses, and ports to given session IDs. The client would have previously received a Session ID packet listing known friends and their session IDs. Presumably, any unassigned session IDs in the Game Status packet represent friends of friends. So, the client must send a Friend of Friend Info request packet to get the associated username and nickname information.

Note that such friends are listed in the official Xfire client as Friends of Friends Playing. Presumably this means that when a player goes offline, the client should no longer display them in the list. These are indicated by Game Status packets with game IDs set to 0.

Packet Structure

All data exchanged over the Xfire network protocol except the initial "UA01" synchronization key are combined into well-formed packets. The packets contain a 4-byte header followed by a set of "attributes", or key/value pairs. The attribute map contains typed information that is used to uniquely decode a given message.

The general packet structure is as follows:

• The packet length indicates the total number of bytes in the packet, including the length itself. Therefore, total useful packet size is 65534 bytes.
• The packet type ID is a unique number identifying the content of the packet as well as the key format of the included attribute map.
• The attribute map contains a set of key/value pairs. Most packets include multiple keys and associated values. The values are typed using a unique integer value, and can contain any of several known kinds of data.

As indicated before, all multi-byte values are stored in Little Endian format (least-significant byte first).

Attribute Maps

Attribute maps contain up to 255 key/value pairs. The keys are formatted either as short, variable-length strings or as single-byte integer values. The key "domain" appears to depend upon the specific packet type. Most older packets use string keys, while many newer packets (higher number IDs) appear to use integer keys. Whereas string-based keys are somewhat easier to interpret, integer keys are more opaque in all observed data. It is believed that there are equivalent string-based keys for many (if not all) integer-based keys. That relationship is not well understood to to absence of applicable observed network traffic.

An attribute map starts with a 1-byte count of the number of attributes (key/value pairs) in the map. It is then followed by alternating keys and values. The value format is indicated in the next section.

String-encoded keys appear as UTF-8 string data preceded by a 1-byte length field. Note that the string encoding is assumed to be UTF-8 given string attribute values use UTF-8 encoding; all observed keys may also be using ASCII encoding since they use no special characters. Because of the one-byte length field, a string-encoded attribute key may be at most 255 characters in length. No known keys have zero length. An example of a string-encoded key "userid" is:

Integer-encoded keys appear as single-byte values in the data stream. They are followed immediately by values. The current guesses at the content for observed integer key IDs are shown below.

The specific key domain for a packet is listed with each packet in Section 4.

Attribute Values

Attribute values are typed data streams. Each attribute value starts with a one-byte type ID field that uniquely indicates how to decode the remaining data for that attribute value. Known value types and their encoding is indicated below.

An example of a simple packet is the Client Version packet, which has a single attribute named "version". It looks like this (with each byte's value displayed in hexadecimal, or the character equivalent where appropriate) :

The total number of bytes in the packet is 18 (0x0012). The packet ID is 3 (0x0003), which makes this a Client Version packet. There is one attribute in the map. The attribute key is length 7 ("version"). The value type is 2 (integer), and the value is 85 (0x00000055).

Packet Descriptions

All known packets are listed below. Generally, packets sent from the client to the server use IDs between 0 and 127. Packets sent from the server to the client use IDs 128 and above.

Authentication Data Packet

This packet contains the client's username and a hashed password (the authentication data for the user). It is sent from the client to the server in response to a Login Challenge packet. The server will respond with one of three known packets:

• Login Success packet, upon successful authentication.
• Login Failure packet, if the username/password pair don't match.
• New Version Available packet, if the client's version is too old. After sending this packet, the server will no longer respond to any communication.

Packet ID	1
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
name	String	The user name of the user that is attempting to log in.
password	String	The salted username and password of the user that is attempting to log in. The string is exactly 40 characters long and represents an SHA-1 hash computed per the following pseudocode: String a = username + password + "UltimateArena"; int128 a_hash = ComputeSHA1(a); String b = ToHexString(a_hash) + salt; int128 b_hash = ComputeSHA1(b); String result = ToHexString(b_hash); The 'salt' value is that provided in the Login Challenge packet. The ToHexString function must return lower case characters for the SHA1 hash to be computed correctly. The "+" operators indicate string concatenation. The SHA-1 hash is computed on the string data, encoded to UTF-8.
flags	Integer	The purpose of this integer value is unknown. In all observed data it has been 0.

Chat Message Packet

This message is sent by the client to the server, or directly to another user via UDP. The message can represent a number of things:

• An content message (e.g. "hi there")
• An indication of whether the user is typing or not
• A list of the client's details (IP address, open UDP port, etc)
• An acknowledgement of that a message from the peer was received

When chat messages are sent via the server, they will be received by the peer as a Server Routed Chat Message.

If communication is to be routed via the XFire server, client information messages should be sent regularly to prevent "high latency warnings" where the peer is a real XFire client. In OpenFire, these are sent with each real message, up to once every 5 seconds. It has not been determined what the threshold is for the XFire client to start reporting latency warnings.

The contents of the peermsg map vary depending on what this chat message represents. What is represented is indicated in the "msgtype" attribute in the map, a 32-bit integer value.

• msgtype = 0 - a content message:

  Attribute Name	Type	Details
  imindex	32-bit integer	The "index" of this message within the conversation log. Used as a hint of message order, incremented for each message sent.
  im	string	The actual message (e.g. "hello")

• msgtype = 1 - an acknowledgement message:

  Attribute Name	Type	Details
  imindex	32-bit integer	The "index" of the message we are acknowledging. Corresponds to the imindex in the message the peer sent.

• msgtype = 2 - a client information message:

  Attribute Name	Type	Details
  ip	IPv4 address (32-bit int)	The public IPv4 address of this user.
  port	32-bit int (legal range 0-65535)	The public UDP port of this user.
  localip	IPv4 address (32-bit int)	The LAN IPv4 address of this user.
  localport	32-bit int (legal range 0-65535)	The LAN UDP port of this user (not necessarily the same as the public port, depending on how the use of NAT or firewall)
  status	32-bit int	The purpose of this field has not been determined, in all analysed data to date it has been 0.
  salt	string	A salt string; it is not known what this is used for (it is always present but does not appear to be used when communicating via the server)

• msgtype = 3 - a typing notification:

  Attribute Name	Type	Details
  imindex	32-bit integer	The "index" of the message that will be sent if the user sends the pending content message.
  typing	32-bit integer	A boolean indicating whether the user is typing or not (1 is typing, 0 is not typing).

Client Version Packet

This contains a number identifying the Xfire client version. It should be the first packet sent from the client to the server immediately after the "UA01" synchronization key. The number appears to reflect the minor revision of the official Xfire client. So, for example, the official Xfire client version 1.85 sends number 85 in this packet. After successful authentication (see Authentication Data Packet), the Xfire server may respond with a Version Too Old packet if the number indicated in this packet is older than the current official Xfire client version.

Packet ID	3
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
version	Integer	The version number of the client.

Request Info for Friend of Friend

This packet is used to request information for Friends of Friends. The client uses the session IDs sent to it by the initial Game Status packet. That packet may contain session IDs for people that are not Friends. This packet is used to request information about them. The response is a Friend of Friend Info packet.

Packet ID	5
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
sid	UUID Array	Array of the session IDs for which the client is requesting information.

Add Friend Request Packet

This packet requests that a friend be added. The other user must accept the friendship request for the user to be added to your friends list. The request includes a personalized message. The server will respond with a confirmation, that may indicate an error occurred.

Packet ID	6
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
Attribute Name	Type	Details
name	String	The username of the user to invite.
msg	String	The personalized message to be displayed to the recipient.

Accept Add Friend Request

The client sends this packet in response to an Incoming Add Friend Request when the user wishes to accept the invitation. It simply contains the username of the requestor.

Packet ID	7
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
name	string	The username of the invitation to accept.

Decline Add Friend Request

The client sends this packet in response to an Incoming Add Friend Request when the user wishes to decline the invitation. It simply contains the username of the requestor.

Packet ID	8
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
name	string	The username of the invitation to decline.

Remove Friend Packet

This packet requests that a friendship be terminated. The other user recieves a Friend Removed packet.

Packet ID	9
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
userid	Integer	The user ID of the friend to remove.

Change Preferences Packet (?)

This appears to contain a change-to-preferences packet. Best guess is that the primary packet attribute (prefs) contains a map, the keys of that map represent specific preference settings.

Packet ID	10
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
prefs	Attribute Map (Integer Key)	Preference settings (see below).

The content of the prefs attribute map depends upon the specific settings being changed. It appears that the presence or absense assumes some default settings (best guess).

Look up User Packet

This is sent by a client to search for other users. It's part of the Add Friend dialog. The Xfire client puts up one text box that populates the "name" attribute of this packet. The server responds with a User Search Results packet.

Key	Type	Preference Default	Details
0x01	String	1	This enables/disables the Game Status "Show my friends" option.
0x02	String	1	This enables/disables the Game Status "Show my game server data" option.
0x03	String	1	This enables/disables the Game Status "Show on my profile and miniprofile" option.
0x06	String	0	This enables/disables the Chat tab's "Show time stamp in chat window" option.
0x08	String	1	This enables/disables the Game Status "Show friends of my friends" option.
0x09	String	1	This enables/disables the Game Status "Show my offline friends" option.
0x0A	String	1	This enables/disables the Game Status "Show nicknames when available" option.
0x0B	String	1	This enables/disables the Other Activity "Show my voice chat server to my friends" option.
0x0C	String	1	This enables/disables the Other Activity "Show people when I type to them" option.

Packet ID	12
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
name	String	The main search string. Matches against username, first name, last name, and/or email address.
fname	String	A search string which will match only on first names.
lname	String	A search string which will match only on last names.
email	String	A search string which will match only on email addresses.

Connection Keep-alive Packet

This packet must be sent periodically by the client to notify the server that it is still alive. The maximum period that a client can wait between messages is not known. Every 60 seconds appears to work properly.

Packet ID	13
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
value	Integer	Unknown. In all analyzed data it has had the value zero.
stats	Integer Array	Unknown. In all observed data this been an empty array.

Change Nickname Packet

The client sends this to the Xfire server to change their nickname.

Packet ID	14
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
nick	String	The new nickname.

Client Information Packet

The client sends this packet to the Xfire server as soon as it has successfully logged in (received a Login Success packet). It indicates the language in use by the client as well as the skin and associated theme.

Packet ID	16
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
lang	String	A language or locale string for the client's configuration. Not all exact values and their associated meanings are known, but "us" appears to mean United States English.
skin	String	The skin currently being used by the user's client. The default skin in new Xfire installations (as of this writing) was "Shadow".
theme	String	The currently selected theme (associated with the skin) in the user's client. The default theme in new Xfire installations (as of this writing) was "default".
partner	String	A string of unknown purpose. In all observed data, this has been an empty string.

Client Network Information Packet

The client sends this packet to indicate its view of the network configuration. It is sent shortly after a succeful log in (see Login Success packet).

Packet ID	17
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
conn	Integer	An integer of unknown purpose, possibly indicating the type of connection. In all observed data this has had the value 2.
nat	Integer	This appears to be a boolean value indicating whether the client is behind a NAT device.
sec	Integer	An integer of unknown purpose. In all analyzed data this has had the value 5.
clientip	Integer	This appears to be the client's local IP address in non-network byte order (that is, little endian. This is the direct IP address of the client's machine.
naterr	Integer	This appears to be a boolean value indicating whether NAT override errors were detected. The official Xfire client supports UPnP and thus can create openings in certain NAT devices to allow peer to peer communication.
upnpinfo	String	A string indicating the UPnP configuration string the client managed to successfully use. This may be an empty string.

Client Skin Packet (Deprecated)

This packet was once used to communicate client skin and theme information to the Xfire server. It appears to have been abandoned in favor of the Client Information packet.

Packet ID	18
Attribute Key Domain	String
Direction	Client to Server

Unknown Packet 24

This appears to be related to using a download channel. When climsg = 17700, it apears to be a request for update (new file?) information for a channel.

Packet ID	24
Attribute Key Domain	String
Direction	Client to Server

Attribute Map Contents:

Key	Type	Details
climsg	Integer	This appears to be a command, similar to chat message packets.
msg	Attribute Map (Integer Key)	This appears to have different content depending upon the climsg attribute value.

The content of the msg attribute depends upon the climsg attribute.

• When climsg = 0 - A request for channel update information?

  Create New Custom Friend Group Packet

  The client sends this to the Xfire server to request an ID for a new custom friend group. The server responds with a New Custom Friend Group ID packet.

  Key	Type	Details
  0x4f	Integer Array	Appears to be the channel number
  0x50	Integer Array	This appears to be the last known timestamp. Guess is the server uses this to determine the range of files updated in the channel when returning results via packet 450.

  Packet ID	26
  Attribute Key Domain	Integer
  Direction	Client to Server

  Attribute Map Contents:

  Key	Type	Details
  0x1A	String	The new custom friend group's name.

  Delete Custom Friend Group Packet

  The client sends this to the Xfire server to delete a custom friend group.

  Packet ID	27
  Attribute Key Domain	Integer
  Direction	Client to Server

  Attribute Map Contents:

  Key	Type	Details
  0x19	Integer	The custom friend group's ID to delete.

  Rename Custom Friend Group Packet

  The client sends this to the Xfire server to rename a custom friend group.

  Packet ID	28
  Attribute Key Domain	Integer
  Direction	Client to Server

  Attribute Map Contents:

  Key	Type	Details
  0x19	Integer	The custom friend group's ID.
  0x1A	String	The new name for the custom friend group

  Add Friend to Custom Friend Group Packet

  The client sends this to the Xfire server to add a friend to a custom friend group.

  Packet ID	29
  Attribute Key Domain	Integer
  Direction	Client to Server

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer	The friend's user ID to add to the custom group.
  0x19	Integer	The custom friend group ID to which to add the friend.

  Remove Friend from Custom Friend Group Packet

  The client sends this to the Xfire server to remove a friend from a custom friend group.

  Packet ID	30
  Attribute Key Domain	Integer
  Direction	Client to Server

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer	The friend's user ID to remove from the custom group.
  0x19	Integer	The custom friend group ID from which to remove the friend.

  Status Text Change Packet

  This packet changes the client status text message.

  Packet ID	32
  Attribute Key Domain	Integer
  Direction	Client to Server

  Attribute Map Contents:

  Key	Type	Details
  0x2e	String	The new status text string.

  Change Friend Group List

  This packet appears to reflect a change to the friend group list. It appears to be analagous to Packet 163.

  Packet ID	36
  Attribute Key Domain	Integer
  Direction	Client to Server

  Attribute Map Contents:

  Key	Type	Details
  0x19	Integer Array	Group ID. Looks like group IDs zero (0), one (1), and two (2) may be the default groups for Online Friends, Friends of Friends Playing, and Offline Friends. Otherwise it appears to contain a custom group ID. Value 2 appears to reflect the Offline Friends group.
  0x34	Integer Array	Possibly a group type. A value of zero (0) was observed to be associated with a custom group, while the value two (2) was associated with what are assumed to be standard groups.
  0x12	Integer Array	Unknown. In all observed data the entries of this array were zeros.

  Info View Request ?

  This packet appears to be a request for information for the Info View display. The server appears to respond with packets 172, 174, 182, and 176.

  Packet ID	37
  Attribute Key Domain	Integer
  Direction	Client to Server

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer	This appears to be a user ID.

  Login Challenge Packet

  This packet is sent from the server to the client once the server receives a Client Version packet. It contains a "salt" value that is required to compute the hashed password. The client must respond with an Authentication Data packet.

  Packet ID	128
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  salt	String	The salt string (apparently representing a hexadecimal number) used to log in.

  Login Failure Packet

  SECTION NEEDS UPDATES

  This message is sent in response to a login request message if the user's password was incorrect.

  Packet ID	129
  Attribute Key Domain	string
  Direction	Server to Client

  Attribute Name	Type	Details
  reason	Integer	A code perhaps used to indicate the reason for the failed login. In all analysed data this has had the value "0".

  Login Success Packet

  This packet is one possible response to an Authentication Data packet. It is only sent if the version number from a Client Version packet is new enough and the hashed username/password combination is correct. It indicates a successful log-in. After sending this packet, the Xfire server responds with a variety of packets that configure the client to communicate with contacts on the network.

  Packet ID	130
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  userid	Integer	The user's unique identifier on the network.
  sid	UUID	The unique session identifier for this connection. It is distinct from all other connections, active or past.
  nick	String	The user's nick name. This is displayed in the Xfire GUI if set.
  status	Integer	An integer of unknown purpose. It has taken on several different values but the exact meaning of those numbers is indeterminant.
  dlset	String	A string of unknown purpose. In all observed data this has been an empty string.
  p2pset	String	A string of unknown purpose. In all observed data this has been an empty string.
  clntset	string	A string of unknown purpose. In all observed data this has been an empty string.
  minrect	Integer	An integer of unknown purpose. In all observed data this has been the value 1 (0x1).
  maxrect	Integer	An integer of unknown purpose. In all observed data this has been the value 900 (0x384).
  ctry	Integer	An integer of unknown purpose. In all observed data this has been the value 840 (0x348). One guess is this is a unique country code for the geographic location of the client.
  n1	Integer	This appears to be an IP address in non-network order (that is, little endian). MS- In all observed data this has had the value 0xcedc2893, or 206.220.40.147, which resolves to nat1.xfire.com. IM- In all observed data this has had the value 204.71.190.131, which resolves to nat1.sv.xfire.com.
  n2	Integer	This appears to be an IP address in non-network order (that is, little endian). MS- In all observed data this has had the value 0xcedc2894, or 206.220.40.148, which resolves to nat2.xfire.com. IM- In all observed data this has had the value 204.71.190.132, which resolves to nat2.sv.xfire.com.
  n3	Integer	This appears to be an IP address in non-network order (that is, little endian). MS- In all observed data this has had the value 0xcedc2895, or 206.220.40.149, which resolves to nat3.xfire.com. IM- In all observed data this has had the value 204.71.190.133, which resolves to nat3.sv.xfire.com.
  pip	Integer	This appears to be the indicated public IP address of the client in non-network order (that is, little endian). This is the IP address of the client as viewed by the Xfire server. This may be different from the client's local IP address if the client is behind a NAT.

  Friend List Packet

  SECTION NEEDS UPDATES

  This message provides the list of friends for the current user after a successful login, with some essential details for future operations dealing with these friends.

  Packet ID	131
  Attribute Key Domain	string
  Direction	Server to Client

  Attribute Name	Type	Details
  userid	Integer list	A list containing the unique ID of each friend.
  friends	String list	A list containing the usernames of each friend.
  nick	String list	A list containing the "nick name" of each friend, i.e. the name that will be displayed instead of the username if set. If no nick name has been set, this will be an empty string.

  Session ID List Packet

  SECTION NEEDS UPDATES

  This message provides a list of session IDs for friends who are currently online, or for friends who have just come online mid-way through a session. This message type is also used to indicate when friends have gone offline.

  Packet ID	132
  Attribute Key Domain	string
  Direction	Server to Client

  Attribute Name	Type	Details
  userid	Integer list	A list containing the unique ID of each who has come online or gone offline.
  sid	Session ID list	A list containing the session IDs for each user. If the session ID is 0, this indicates that the friend has gone offline. Otherwise, it is a real session ID and indicates the user is online.

  Server Routed Chat Message Packet

  SECTION NEEDS UPDATES

  This message type is identical to a normal chat message, but is sent down to the client via the TCP link to the server. This allows clients to communicate where they cannot open a public UDP port and directly communicate with peers.

  Packet ID	133
  Attribute Key Domain	string
  Direction	Server to client

  See the description of the normal chat message for a full description of the contents of the message.

  New Version Available Packet

  SECTION NEEDS UPDATES

  This message is sent by the server to the client if it reports a version number which is lower than the currently released XFire client. It contains the details to download newer client versions. The message is composed of a number of string lists, where values at matching indices in these lists collectively represent a new version.

  Packet ID	134
  Attribute Key Domain	string
  Direction	Server to Client

  Attribute Name	Type	Details
  version	Integer list	The list of new version numbers available.
  file	string list	The links to the new XFire client versions. An example of a URL sent is "http://seed2.da.xfire.com/79.exe". All files observed to date have been .exe update installers which must be run within the XFire installation path.
  command	Integer list	An integer list of unknown purpose. In all data observed so far, the integers have had the value "1".
  fileid	Integer list	An integer list of unknown purpose. In all data observed so far, the integers have had the value "0".
  flags	Integer	A 32-bit integer of unknown purpose. In all data observed so far this has had the value 0.

  Game Status Change Packet

  This packet notifies of a change in the associated user's gaming status. The users are identified by their session IDs. The game IDs are the numbers used in the xfire_games.ini file of the official Xfire client. They are not listed in this document. Note that the session IDs listed in this packet may be associated with a friend of a friend, and not a friend. Refer to Friends of Friends.

  Packet ID	135
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  sid	UUID Array	The session IDs of the user who's game status is changing.
  gameid	Integer Array	The game ID for what the user is now playing. Is 0 when the user leaves a game. Note that the value here appears to have extra data. The least significant 16 bits represent the normal TCP port. It is not yet clear what the most significant 16 bits represent.
  gip	Integer Array	The IP address of the server the person is playing in, if any; 0 otherwise.
  gport	Integer Array	The port on the game server to use for querying, if available; 0 otherwise.

  Friends of Friends Info

  This packet is sent in response to a Friend of Friend information request. It contains the username, nickname, and how we know this person (the friend ID of the mutual friend).

  Packet ID	136
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  fnsid	UUID Array	The session ID of the Friend of Friend.
  userid	Integer Array	The user ID of the Friend of Friend.
  name	String Array	The user name of the Friend of Friend.
  nick	String Array	The nick name of the Friend of Friend.
  friends	Array of Array of Integer	Each top-level array contains an array of Integers (so, it's kind of a 2D array). Those integers represent the user IDs of the mutual friends. The Xfire client displays these in a tooltip when hovering over the user name in the list.

  Outgoing Add-Friend Request Confirmation Packet

  This packet is sent to confirm that the friend addition will be conveyed to the other user. It is sent in response to an Add Friend Request packet. This does not indicate whether the other user accepted or declined the request.

  Packet ID	137
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  Attribute Name	Type	Details
  name	String	The username of the user to invite.
  result	Integer	The result. 0 = success (the message will be conveyed). Anything else = fail?

  Incoming Add Friend Request Packet

  This packet is sent to the client when another user wants to be your friend (via an Add Friend Request packet. It includes the personalized message from the other user. The client must respond with either an Accept or Decline packet.

  Packet ID	138
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  name	String Array	The user names of the users that are inviting you.
  nick	String Array	The nick names of the users that are inviting you.
  msg	String Array	The personalized messages from the users that are inviting you.

  Friend Removed Packet

  This packet is to notify that a friend has removed you from their friend list (via a Remove Friend packet).

  Packet ID	139
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  userid	Integer	The user ID of the friend that removed you.

  User Preferences Packet

  This packet appears to contain settings specific to the user that is logged in. It is sent from the server to the client shortly after successful log-in. Refer to the Change Preferences packet for a list of definitions for the 0x4c attribute map.

  Packet ID	141
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x4c	Attribute Map (Integer Keys)	Various. See here for definitions

  User Search Results Packet

  This is the server's response to a user search. It contains the details for Xfire users that matched the search criteria.

  Packet ID	143
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  name	String Array	User names of matching users.
  fname	String Array	First names of matching users.
  lname	String Array	Last names of matching users.

  Server Keep-alive Response

  This packet is the server's response to the Keep-alive packet.

  Packet ID	144
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  value	Integer	Unknown. In observed data it has had the value zero.

  Disconnect Notice Packet

  This packet appears to be sent to notify the client that the session will be terminated. For example, if you log in from another location the first session will receive this notice and will no longer respond to packets.

  Packet ID	145
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  reason	Integer	Reason code for the disconnect. A value of 1 indicates the user is now logged in elsewhere.
  minrect	Integer	Unknown. In observed data it has had the value zero.
  maxrect	Integer	Unknown. In observed data it has had the value zero.

  Voice Chat Info

  This packet appears to uniquely identify the voice chat information in use. It identifies whether the specific session is using TeamSpeak or Ventrilo, and the host and port for the connection. Those are the only two known applications on the xfire_games.ini file that are not games, and their information is indicated here instead of via a Game Status Change packet.

  Packet ID	147
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  sid	UUID Array	Session ID of the friend.
  vid	Integer Array	Game ID of the application in use (32 for TeamSpeak and 33 for Ventrilo).
  vip	Integer Array	IP address of the server to which the friend is connected.
  vport	Integer Array	Port on the server to which the friend is connected.

  Custom Friend Group Names

  This packet identifies the custom friend groups and the display names of those groups.

  Packet ID	151
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x19	Integer Array	Contains a list of friend group identifiers (integers).
  0x1a	String Array	The name of the friend group.

  Custom Friend Group Members

  This packet identifies the members of custom friend groups. Note that a given user ID may be a member of more than one group (or no groups).

  Packet ID	152
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer Array	Friend user ID.
  0x19	Integer Array	Custom friend group ID.

  New Custom Friend Group Name

  This packet returns the identifier of the new friend group. This is sent in response to the Create Custom Friend Group packet.

  Packet ID	151
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x19	Integer	The identifier of the new group.
  0x1a	String	The name of the friend group.

  Friend Status Text Packet

  SECTION NEEDS UPDATES

  Nickname Changed

  This packet is sent to the client when a nickname changes. This may also be sent to the client when the user's own nickname is changed from their web profile page on www.xfire.com.

  Packet ID	161
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer	User ID
  0x0d	String	The new nickname.

  Friend Group List Info Packet

  This packet's purpose is not entirely clear. It contains a list of friend groups (but not all friend groups). It includes the standard groups (IDs 0, 1, and 2), which don't appear in any of the other group management packets. It lists some of the custom groups identified by the Custom Friend Group Name packet, but not all of them. In one case, where the group had no current members, it was displayed in the official Xfire client's list at the end but was not included in this packet. It is not known why that group was not included in this packet, so this packet must likely contain flags or settings for specific friend groups.

  Packet ID	163
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x19	Integer Array	Group ID. Standard group IDs are as follows: 0 = Online Friends (guess) 1 = Friends of Friends Playing 2 = Offline Friends Otherwise it contains a custom group ID per the Custom Friend Group Name packet.
  0x34	Integer Array	Possibly a group type. A value of zero (0) was observed to be associated with a custom group, while the value two (2) was associated with what are assumed to be standard groups.
  0x12	Integer Array	Unknown. In all observed data the entries of this array were zeros.

  Unknown Packet 172

  This packet is of unknown purpose. It appears to be a response to Unknown Packet 37 which contains a user ID. This is likely information for the Info View display. It may relate to either game info or clan info.

  Packet ID	172
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer	This appears to be a user ID.
  0x5c	Integer Array	Unknown. In one instance this appeared to contain IDs of some sort, but the numbers were too high for user IDs. In all other observed data this has been an empty array (zero entries).
  0x21	Integer Array	Unkonwn. Best guess is it's a game ID. In all other observed data this has been an empty array (zero entries) so it's hard to be certain.
  0x22	Integer Array	Unknown. Best guess is it's an IP address. In all other observed data this has been an empty array (zero entries).
  0x23	Integer Array	Unknown. Could be port numbers, but it's hard to be sure. It had several different values. In all other observed data this has been an empty array (zero entries).
  0x54	String Array	Unknown. These are comment strings of some sort. They could be the custom status messages for users related to the person whose ID appears above in item 0x01. In all other observed data this has been an empty array (zero entries).
  0x50	Integer Array	Unknown. Could be IP addresses of some sort. In all other observed data this has been an empty array (zero entries).
  0x5e	String Array	Unknown. In some observed data it contained a UUID string enclosed in curly braces: "{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}". The purpose of the UUID strings is unknown. In all other observed data this has been an empty array (zero entries).

  Unknown Packet 173

  This packet is of unknown purpose. It contains a user ID.

  Packet ID	173
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer	This appears to be a user ID.

  Unknown Packet 174

  This packet is of unknown purpose. It appears to be a second response to Unknown Packet 37 which contains a user ID. This is likely additional information for the Info View display.

  Packet ID	174
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer	This appears to be a user ID.
  0x34	Integer	Unknown. In observed data is has had the values 1 and 3. In one case where a user was playing Counter-Strike: Source, it contained a 2 and the info view showed a unique view (themed for CS:S).
  0x1f	Integer	Best guess this has a value that indicates which avatar icon to display. For example, the value 553 means the avatar icon resides at URL http://media.xfire.com/xfire/xf/images/avatars/gallery/default/553.gif. A value of 0 indicates the default Xfire icon, URL http://media.xfire.com/xfire/xf/images/avatars/gallery/default/xfire.gif. It is not known how to distinguish custom icon URLs from the built-in ones. For the aforementioned CS:S player, this had the value 9479 which did not resolve to a specific GIF file. A file at URL http://media.xfire.com/client/templates/infoview/css/infoview_cs_source_rv_logo.gif was loaded instead.

  User Clan Affiliation

  This packet appears to be a fourth response to packet 37. It appears to contain a list of clans this person is a member of.

  Packet ID	176
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer	This appears to be a user ID.
  0x6c	Integer Array	Unknown, probably a clan ID.
  0x72	String Array	It appears to be a clan name (same purpose as a friend's username)
  0x81	String Array	It appears to be a clan display name (same purpose as a friend's nickname)
  0x6d	String Array	It appears to be the user's name within the clan.

  Unknown Packet 182

  This packet is of unknown purpose. It appears to be a third response to Unknown Packet 37 which contains a user ID. This is likely additional information for the Info View display. Contents are unknown.

  Packet ID	182
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x01	Integer	This appears to be a user ID.
  0x93	Integer Array	Unknown.
  0x94	String Array	Unknown.
  0x55	Integer Array	Unknown.
  0x95	Integer Array	Unknown.
  0x96	Integer Array	Unknown.
  0x97	Integer Array	Unknown.
  0x98	Integer Array	Unknown.
  0x21	Integer Array	Unknown.
  0x50	Integer Array	Unknown.
  0x54	Integer Array	Unknown.

  DID Packet

  SECTION NEEDS UPDATES

  Unknown Packet 401

  This packet appears to contain more information about a specific DID. It appears to include information on where to go get this DID. I'm wondering if a DID is one part (chunk?) of an entire file. It appears to be a response to a packet 23.

  Packet ID	401
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  did	DID	The DID.
  ip	Integer	IPv4 address, not sure of what (the remove computer to get it from?)
  port	Integer	Presumably the port on the remote computer.
  localip	Integer	IPv4 address, not sure of what
  localport	Integer	Presumably the port associated with the localip
  status	Integer	Unknown
  origin	Integer	Unknown
  salt	String	A salt string, not sure what it is used for

  Unknown Packet 402

  This packet appears to contain a set of DIDs for a download file ID. Still not 100% sure what the DIDs are used for (I still think they are "Download IDs").

  Packet ID	402
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  fileid	Integer	The file ID.
  withheld	Integer	Unknown
  did	DID Array	Unknkown

  Unknown Packet 404

  This packet appears to contain more information about a file ID, including it's filename and the number of chunks required to download the file.

  Packet ID	404
  Attribute Key Domain	String
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  fileid	Integer	The file ID.
  size	Integer	Unknown
  chunkcnt	Integer	Presumably the number of chunks to download to create a full file.
  chunksize	Integer	Presumably the maximum size (in bytes) of each chunk.
  filename	String	The name of the file after downloading and assembling.

  Channel Information (?)

  This packet appears to contain information about a download channel's available updates. It appears to be sent in response to packet 24.

  Packet ID	450
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x4f	Integer	The channel number.
  0x50	Integer	Timestamp
  0x21	Integer	Unknown
  0x02	String	Appears to be the channel's name (e.g. channel 1000's name is "Xfire Updates").
  0x51	Integer Array	Available file IDs. These numbers appear in the associated channel .ini file, and as individual downloads metadata .ini files.
  0x52	Integer Array	This appears to be a timestamp representing either the AddTime or ModifyTime for the file ID.
  0x53	Integer Array	This appears to be a timestamp representing either the AddTime or ModifyTime for the file ID.

  File ID Information (?)

  This packet appears to contain a download file ID's "meta checksum". The attribute 0x56 appears in the fileids.ini section for the associated file ID as the MetaChecksum.

  Packet ID	452
  Attribute Key Domain	Integer
  Direction	Server to Client

  Attribute Map Contents:

  Key	Type	Details
  0x51	Integer	The file ID.
  0x56	String	Checksum string, 42 characters in length. It is unknown how to compute this checksum.