Server List Ping

Minecraft supports querying the MOTD, player count, max players and server version via the usual port. Unlike Query, the server list ping interface is always enabled.

Client -> Server

The client initiates a TCP connection to the minecraft server on the standard port. Instead of doing auth and logging in (as detailed in Protocol Encryption), it sends the two byte sequence FE 01. This is a 0xFE server list ping packet. If the second byte (the 0x01) is missing, the server waits about 1000ms then replies with the Server -> Client format used in 1.3 and earlier.

Server -> Client

The server responds with a 0xFF kick packet. The packet begins with a single byte identifier ff, then a two-byte big endian short giving the length of the proceeding string in characters. You can actually ignore the length because the server closes the connection after the response is sent.

After the first 3 bytes, the packet is a big-endian UCS-2 string. It begins with two characters: §1, followed by a null character. On the wire these look like 00 a7 00 31 00 00.

The remainder is null character (that is 00 00) delimited fields:

1. Protocol version (e.g. 47)
2. Minecraft server version (e.g. 1.4.2)
3. Message of the day (e.g. A Minecraft Server)
4. Current player count
5. Max players

The entire packet looks something like this:

                   <---> first character
   0000000: ff00 2300 a700 3100 0000 3400 3700 0000  ....§.1...4.7...
   0000010: 3100 2e00 3400 2e00 3200 0000 4100 2000  1...4...2...A. .
   0000020: 4d00 6900 6e00 6500 6300 7200 6100 6600  M.i.n.e.c.r.a.f.
   0000030: 7400 2000 5300 6500 7200 7600 6500 7200  t. .S.e.r.v.e.r.
   0000040: 0000 3000 0000 3200 30                   ..0...2.0

Example

A parsed transcript of a server list ping follows:

127.0.0.1:26603 connected, there is now 1 client connected
====PROTOCOL ANALYSIS====
127.0.0.1:26603 ==> Server - Packet of type 0xFE
====2 BYTES====
0xFE 0x01
====PAYLOAD====
#1 - Signed Byte: 1
127.0.0.1:26603 pinged
====PROTOCOL ANALYSIS====
Server ==> 127.0.0.1:26603 - Packet of type 0xFF
====59 BYTES====
0xFF 0x00 0x1C 0x00 0xA7 0x00 0x31 0x00
0x00 0x00 0x36 0x00 0x31 0x00 0x00 0x00
0x31 0x00 0x2E 0x00 0x35 0x00 0x2E 0x00
0x32 0x00 0x00 0x00 0x54 0x00 0x65 0x00
0x73 0x00 0x74 0x00 0x20 0x00 0x53 0x00
0x65 0x00 0x72 0x00 0x76 0x00 0x65 0x00
0x72 0x00 0x00 0x00 0x30 0x00 0x00 0x00
0x32 0x00 0x30
====PAYLOAD====
#1 - Unicode String (28 graphemes, 28 code points): "§1 61 1.5.2 Test Server 0 2
0"
127.0.0.1:26603 disconnected, there are now 0 clients connected

NOTE: §1 61 1.5.2 Test Server 0 20 is actually §1\061\01.5.2\0Test Server\00\020 where \0 is the null character (i.e. U+0000).

Server -> Client format used in 1.3 and earlier

The packet-structure is the same as above. Only the content of the big-endian UCS-2 string is different.

This one contains 3 fields delimited by §:

1. Message of the day (e.g. A Minecraft Server)
2. Current player count
3. Max players

The entire packet looks something like this:

                   <---> first character
   0000000: ff00 1700 4100 2000 4d00 6900 6e00 6500  ....A. .M.i.n.e.
   0000010: 6300 7200 6100 6600 7400 2000 5300 6500  c.r.a.f.t. .S.e.
   0000020: 7200 7600 6500 7200 a700 3000 a700 3100  r.v.e.r.§.0.§.1.
   0000030: 30                                       0

Sample code

• Python
• PHP
• Java