From NINA Wiki
Jump to navigation Jump to search
MSNP Protocol
Version 8
Payload CommandsNames
Bitwise AND
ChallengesGetting Details
Setting DetailsMessages
Example Session
MessagesExample Session
Error ListCommandsRelying Party SuiteSpotlife
XMPPHTTP GatewayTabsActivities
Development ToolsMSNP Grid
PolygamyURLs used by MSN
Protocol Versions
Version 21
Version 18
Version 16
Version 15
Version 14
Version 13
Version 12
Version 11
Version 9
Version 8
Version 2
IntroductionP2PObject DescriptorDisplay PicturesFile Transfer
Microsoft Messenger for Mac

Service URLs (URL)

The URL command retrieves URLs relating to the various MSN services to be opened in an external or integrated browser. It takes one or two parameters. The following values have been observed for the first parameter:

  • INBOX - Hotmail inbox
  • FOLDERS - Believed to be the Hotmail's "MSN home" URL.
  • COMPOSE - Compose an email
  • CHGMOB - Mobile settings (pager etc.)
  • PROFILE - Edit your MSN member directory profile.
  • PERSON - Member services, password, secret question, account info
  • CHAT - Chat rooms

The official client also seems to send MOBILE, ADDRBOOK, ADVSEARCH andINTSEARCH, but these have never been observed.

INBOX, FOLDERS, and COMPOSE are ways of accessing Hotmail, and are explained in the notification server messages page. COMPOSE may be sent with a second parameter, the e-mail address of the person you're composing a message to.

The PROFILE, PERSON, and CHAT URLs require a second parameter - a hexadecimal number specifying your locale ID (e.g. "0x0409" For U.S. English).

The server will respond with another URL. It always has three parameters: the first two are URLs and the third is an ID number. These parameters are used to determine how to direct the web browser.

Below is an example of requesting the URL information for the Hotmail inbox:

>>> URL 15 INBOX\r\n
<<< URL 15 /cgi-bin/HoTMaiL 2\r\n

The URL command does not give you the URL to view profiles of people in the MSN Member List. To do this, direct the web browser to where ACCOUNTNAME is the account name of the principal whose profile you want to view.

Sending an e-mail invitation

You can send an e-mail to someone inviting them to use the MSN Messenger service. We've never had any reports of e-mails addresses being harvested by Microsoft through this service. There are two commands to do this: SDC and SND. You are recommended to use SDC - SND is a relic from earlier versions of the protocol.

With the SDC command

You can send an e-mail saying "<your-name> wants to talk to you!" to a specified e-mail address with the SDC command. It's a payload command with a TrID and eight parameters:

  • The first parameter is the the e-mail address you want to send a message to.
  • The second, third, fourth, fifth and sixth parameters are "0x0409 MSNMSGS WindowsMessenger X X"
  • The seventh parameter is the name in the subject line ("<name> wants to talk to you!") of the e-mail they receive.
  • The eighth parameter is the length of the payload to this command.

For example, if I wanted to contact someone with the address "", with the message "Hi Mike!", I might send the following:

>>> SDC 3 0x0409 MSMSGS WindowsMessenger X X Andrew%20Sayers 8\r\n
    Hi Mike! (no newline)

If the message was successfully sent, the server will return an SDC response with a TrID and a single parameter of "OK":

<<< SDC 21 OK\r\n

With the SND command

Alternatively, you can send an e-mail saying "<your-passport> wants to talk to you!" with the SND command. This command is less well tested than SDC. If you have done any research on the SND command, please let us know!

SND is a normal command with a TrID and 4 parameters:

  • The first parameter is the e-mail address you want to send the message to.
  • The second parameter is the locale ID of the language to send the message in.
  • The third and fourth parameters are "MSMSGS MSMSGS".

If the message was sent successfully, the server will reply with an SND with a single parameter of OK. Here is an example.

>>> SND 22 0x409 MSMSGS MSMSGS\r\n
<<< SND 22 OK\r\n

If sent this message, Alice would receive an e-mail saying " wants to talk to you!".

Sending Pages

You can page someone on their MSN Mobile device with the PAG command and receive incoming messages with the IPG command.

If someone on your forward list has an MSN Mobile device and have allowed you to send messages to them with it, their "MOB" will be set to "Y". The PAG command has a TrID and two parameters.

  • The first parameter is the passport of the principal you want to send the message to.
  • The second parameter is the length of the message body.

The payload can optionally begin with <PHONE pri="1">​<LOC>string</LOC>​<NUM>string</NUM>​</PHONE>, to specify a callback number. Next comes <TEXT xml:space="preserve" enc="utf-8">string</TEXT>, which contains the message to be sent. Strictly, enc="utf-8" is only necessary if the message includes non-ASCII characters, but it's safest to always include it.

If the command failed to send, the reply is an 800 error. If there is some other error (for example, you are not allowed to send PAGs, or your PAG is malformed), you get a 220 error. If the message was sent successfully, there is no reply.

A message sent with the PAG command must be no more than 113 characters long. It's an XML document, so is XML encoded.

Receiving Pages

Incoming pages can be received with the IPG command. The command has one parameter: the length of the payload. Here is an example:

<<< IPG 643\r\n
643 bytes in the message body

The payload is a notification document. The official client displays the text of the notification in a message box much like a standard chat window, and doesn't use either of the notification URLs.


Notices are used by services affiliated with MSN Messenger to tell you when something happens (like someone's birthday comes round). At present, only MSN Calendar and MSN Alerts are known to use notices. The command is NOT. Much like IPG, the only parameter is the length of the payload. Here is an example:

<<< NOT 589\r\n
589 bytes in the message body

The payload is a notification document. The official client displays the text of the notification in a pop-up window (called "toast") much like that used when someone logs in. Clicking on the message opens a browser to the action URL, clicking on "options" in the same window goes to the subscription URL.


When the NS finds a need to sign you out, you will recieve the OUT command from the server:

<o> Server closes connection

The first (and) single parameter is used to indentify the reason of the sign-out:

  • OTH: Another client has signed onto this address
  • SSD: Server shut down for maintainence - you should reconnect via the dispatch server

Disabling Instant Messaging

The client can ask the server to not forward any RNG and not to accept any XFR SB commands by using the IMS command. This command has so far been undocumented, and is only being used by MSN TV (in fact it has been discovered on accident by using a network analyser and a MSN TV set-top box).

> IMS (TrID) 0 OFF
> IMS (TrID) 0 ON

It is still unknown what the 0 in the servers reply means.