LAN Protocol

Pia Overview > LAN Protocol

This page describes the protocol that's used to find nearby consoles in LAN mode. In this mode, UDP broadcast packets are used to discover other consoles. LAN mode is not the default mode for local multiplayer and not all games support it. It can usually be enabled by pressing L + R + Left Stick in one of the menus.

Every packet starts with a single byte that indicates its type.

Packet types

Value	Description
0	Browse request
1	Browse reply
3	Host request
4	Host message
5	Session request
6	Session message
7	Keep alive message

(0) Browse Request

Up to 5.44:

This packet is sent through UDP broadcast port 30000. It is sent in plain text, and is not encapsulated in a Pia packet.

6.16 - 6.30:

This packet is sent through port 35000 instead.

Up to 5.6:

Offset	Size	Description
0x0	1	Packet type (0)
0x1	4	Size of search criteria (0x23A)
0x5	0x23A	LanSessionSearchCriteria

5.7 - 5.44:

Offset	Size	Description
0x0	1	Packet type (0)
0x1	4	Size of search criteria (0x23A)
0x5	0x23A	LanSessionSearchCriteria
0x23F	0x12A	Crypto challenge

6.16 - 6.30:

Offset	Size	Description
0x0	1	Packet type (0)
0x1	4	Size of search network setting (0x16)
0x2		LanSearchNetworkSetting
	0x12A	Crypto challenge

LanSessionSearchCriteria

Up to 5.44:

Offset	Size	Description
0x0	4	Minimum number of participants (range)
0x4	4	Maximum number of participants (range)
0x8	1	Opened only
0x9	1	Vacant only
0xA	4	Result range offset
0xE	4	Result range size
0x12	4	Game mode
0x16	4	Session type
0x1A	0x50 * 6	Attribute lists
0x1FA	1 * 6	Number of attributes
0x200	4 * 6	Attribute range min
0x218	4 * 6	Attribute range max
0x230	1 * 6	Is attribute range used
0x236	4	Search flags

Search flags

These flags indicate which fields are compared against the active session to determine if there is a match.

Mask	Description
0x1	Minimum number of participants
0x2	Maximum number of participants
0x4	Opened only
0x8	Vacant only
0x10	Game mode
0x20	Session type
0x40	First attribute list
...	...
0x800	Last attribute list

Range

Offset	Size	Description
0x0	2	Maximum
0x2	2	Minimum

Attribute list

Each attribute list may contain up to 20 attributes. Every attribute is stored as a 4-byte integer.

LanSearchNetworkSetting

6.16 - 6.20:

Offset	Size	Description
0x0	8	Matchmake key
0x8	2	Maximum number of stations (upper bound)
0xA	2	Maximum number of stations (lower bound)
0xC	2	Search flags

6.23 - 6.30:

Offset	Size	Description
0x0	8	Matchmake key
0x8	2	Maximum number of stations (upper bound)
0xA	2	Maximum number of stations (lower bound)
0xC	2	Search flags
0xE	8	Title id

Search Flags

These flags indicate which fields are compared against the active session to determine if there is a match.

6.16 - 6.26:

Mask	Description
0x1	Matchmake key
0x2	Maximum number of stations
0x4	Opened only
0x8	Vacant only

6.29 - 6.30:

Mask	Description
0x1	Ignored
0x2	Matchmake key
0x4	Maximum number of stations
0x8	Opened only
0x10	Vacant only

(1) Browse reply

This packet is sent to the source of the browse request in plain text, and is not encapsulated in a Pia packet.

Up to 5.6:

Type	Description
Uint8	Packet type (1)
Uint32	Size of session info
LanSessionInfo	Session info

5.7 - 5.44:

Type	Description
Uint8	Packet type (1)
Uint32	Size of session info
LanSessionInfo	Session info
Bytes	Crypto challenge reply

6.29 - 6.30:

Type	Description
Uint8	Packet type (1)
Uint32	Size of network property
LanNetworkProperty	Network property
Bytes	Crypto challenge reply

LanSessionInfo

Up to 5.2:

Type	Description
Uint32	Game mode
Uint32	Session id
Uint32 (x6)	Attributes
Uint16	Current number of participants
Uint16	Minimum number of participants
Uint16	Maximum number of participants
Uint32	Session type
Bytes (0x180)	Application data
Uint32	Application data size
Bool	Is opened
StationLocation	Host address
LanStationInfo (x16)	Station info of every player in the room

5.3 - 5.6:

Type	Description
Uint32	Game mode
Uint32	Session id
Uint32 (x6)	Attributes
Uint16	Current number of participants
Uint16	Minimum number of participants
Uint16	Maximum number of participants
Uint8	System communication version
Uint8	Application communication version
Uint16	Session type
Bytes (0x180)	Application data
Uint32	Application data size
Bool	Is opened
StationLocation	Host address
LanStationInfo (x16)	Station info of every player in the room

5.7 - 5.9:

Type	Description
Uint32	Game mode
Uint32	Session id
Uint32 (x6)	Attributes
Uint16	Current number of participants
Uint16	Minimum number of participants
Uint16	Maximum number of participants
Uint8	System communication version
Uint8	Application communication version
Uint16	Session type
Bytes (0x180)	Application data
Uint32	Application data size
Bool	Is opened
StationLocation	Host address
LanStationInfo (x16)	Station info of every player in the room
Bytes (0x20)	Session key param

5.10 - 5.44:

Type	Description
Uint32	Game mode
Uint32	Session id
Uint32 (x6)	Attributes
Uint16	Current number of participants
Uint16	Minimum number of participants
Uint16	Maximum number of participants
Uint8	System communication version
Uint8	Application communication version
Uint16	Session type
Bytes (0x180)	Application data
Uint32	Application data size
Bool	Is opened
StationAddress	Host address
Uint64	Host constant id
Uint32	Host variable id
Uint32	Host service variable id
LanStationInfo (x16)	Station info of every player in the room
Bytes (0x20)	Session key param

LanStationInfo

Offset	Size	Description
0x0	1	Role (1=host, 2=player)
0x1	1	Username encoding type (1=utf8, 2=utf16)
0x2	40	Username
0x2A	8	Station id

LanNetworkProperty

6.29 - 6.30:

Offset	Size	Description
0x0	8	Network id
0x8	0x200	Property data and padding
0x208	4	Property data size
0x20C	8	Matchmake key
0x214	2	Current number of stations
0x216	2	Maximum number of stations
0x218	1	Is opened
0x219	1	Has player number limit
0x21A	1	Current number of players
0x21B	0x12	Host address (StationAddress)

Property Data

If the application data consumes less than 0x184 bytes, this is reflected in the property data size field in the LanNetworkProperty structure.

Offset	Size	Description
0x0	0x7C	System property data
0x7C	Up to 0x184	Application data

System Property Data

Offset	Size	Description
0x0	2	System property data size (0x7C)
0x2	1	System communication version
0x3	2	Application communication version
0x5	16	User password
0x15	1	Has player number limit
0x16	1	Current number of players
0x17	4	Host player name size
0x1B	1	Host player name encoding (1=utf8, 2=utf16)
0x1C	64	Host player name and padding
0x5C	32	Session key param

System Communication Version

Version	Pia Version
0	5.3
2	5.6
3	5.7
4	5.8
5	5.9
6	5.10
7	5.11 - 5.18
8	5.19 - 5.44
10	6.16 - 6.30

(3) Host Request

This packet is sent through UDP broadcast ports 49152 - 49155 and is encapsulated in a Pia message. The message payload contains the following data and is encrypted with the session key:

Up to 5.44:

Offset	Size	Description
0x0	1	Message type (3)
0x1	11	Padding (always 0)
0xC	4	Session id

(4) Host Message

This message is encapsulated in a Pia message and is encrypted with the session key.

Up to 5.9:

Offset	Size	Description
0x0	1	Message type (4)
0x1	11	Padding (always 0)
0xC	4	Session id
0x10		StationConnectionInfo for host

5.10 - 5.44:

Offset	Size	Description
0x0	1	Message type (4)
0x1	11	Padding (always 0)
0xC	4	Session id
0x10		StationLocation for host

(5) Session Request

This packet is sent through UDP broadcast ports 49152 - 49155 and is encapsulated in a Pia message. The message payload contains the following data and is encrypted with the session key:

Up to 5.44:

Offset	Size	Description
0x0	1	Message type (5)
0x1	11	Padding (always 0)
0xC	4	Session id

(6) Session Message

This message is encapsulated in a Pia message and is encrypted with the session key. The goal of this message is to transmit a LanSessionInfo structure. Depending on the size of the LanSessionInfo, this message may be split into multiple fragments. Each fragment contains up to 800 bytes of data.

Whenever the session is updated, a session message is sent through UDP broadcast port 49152 - 49155. A session message is also sent to a specific station when the station requests an update with a session request.

Up to 5.44:

Offset	Size	Description
0x0	1	Message type (6)
0x1	11	Padding (always 0)
0xC	4	This is a random value that must be the same in all fragments that belong to the same session message. This is used to distinguish different session replies.
0x10	2	Session message id. This is an incrementing number that should be the same in all fragments that belong to the same session message.
0x12	1	Fragment index
0x13	1	Number of fragments
0x14	4	Fragment size
0x18		Fragment data

(7) Keep Alive Message

This packet is sent through UDP broadcast port 49152 and is encapsulated in a Pia message. This message is sent once every two seconds, even if the console is not participating in a session. If the console is participating in a session, the message payload is encrypted with the session key. Otherwise, the payload is not encrypted. The message payload contains the following data:

Up to 5.44:

Offset	Size	Description
0x0	1	Message type (7)
0x1	11	Padding (always 0)

Crypto Challenge

In Pia version 5.7 and later, the browse request contains a cryptographic challenge that must be correctly answered in the browse reply. Both the challenge and the response have the following format:

Offset	Size	Description
0x0	1	Version
0x1	1	Crypto enabled (0 or 1)
0x2	8	Incrementing counter used for nonce
0xA	16	Challenge key (random bytes)
0x1A	16	Authentication tag for AES-GCM
0x2A	256 or 16	Challenge or response, encrypted with AES-GCM

The content of the challenge/response when crypto is enabled is described below. If crypto is disabled the authentication tag and challenge/response data are filled with random bytes.

The nonce for the AES-GCM algorithm is generated as follows:

Offset	Size	Description
0x0	4	Broadcast address (local_address | ~subnet_mask)
0x4	8	Nonce counter

Version

The crypto challenge is the same in all versions.

Version	Pia version
1	5.7 - 5.10
2	5.11 - 5.44
3	6.16 - 6.30

Challenge

The challenge consists of 256 random bytes. The key for encrypting the challenge is generated by AES-encrypting the challenge key with a game-specific key.

Response

The response contains the first 16 bytes of the HMAC-SHA256 of the decrypted challenge with a game-specific key. The key for encrypting the response is the first 16 bytes of the HMAC-SHA256 of the session key param with the game-specific key:

Session Key Param

The session key param are used to derive the challenge response key.

Offset	Size	Description
0x0	16	Challenge key in browse response
0x10	16	Challenge key received in browse request

When the host receives a valid browse request for the first time, it saves the session key param in the LanSessionInfo or LanNetworkProperty structure. This is used to derive the session key.