Implementation Notes

Implementing a new server

To implement this protocol from scratch:

1. Wire framing: 4-byte big-endian length prefix + 2-byte big-endian header + body.
2. Type codec: Use the type table in §1. All integers are signed big-endian.
3. Policy check: On first connection byte, if 0x3C (<), send Flash policy XML + close.
4. No auth check: Messages 4000, 3110, 773, 2419 must be handled without authentication. Mark all others as requiring an authenticated session.
5. Login flow: On 2419 (Authenticate), validate SSO token, then send the full post-login burst (§3–§4).
6. Room entry: On 2312 (RequestRoomLoad), stage the room for entry. Only complete entry and send heightmap/users/items when 3898 (RequestHeightmap) arrives.
7. Keepalive: Send 3928 (Ping) after login. Client responds with 2596 (Pong). No other keepalive exchange is required.
8. Broadcast vs unicast: Room events (movement, chat, items) must be broadcast to all users in the room. Login events are unicast to the connecting client only.

Security notes

• RC4 is optional and disabled by default. Do not rely on it for security.
• SSO tickets are single-use tokens validated against the database. Expire them after first use to prevent replay attacks.
• Rate limiting: Arcturus applies per-message rate limits (getRateLimit() in MessageHandler). Chat events default to 750ms min interval. Navigator search 500ms.
• Max frame size: 417 792 bytes. Reject frames exceeding →this.
• Flood mute: Server tracks chat rate per user. Sends S→C 566 FloodCounter when limit exceeded.