My WarCraft III: TFT client sent this while loging on.

[pre]0030                    ff 44 32 00 02 01 00 00 00 05      ..D2.......
0040  4c 52 55 00 00 00 00 00 50 41 4d 00 00 00 00 00  LRU.....PAM.....
0050  45 50 59 54 00 00 00 00 43 53 45 44 00 00 00 00  EPYT....CSED....
0060  52 44 41 4c 00 00 00 00                          RDAL....[/pre]

Subcommand 0x02 isn't documented, so I figured I'd post this. I find this kind of weird because all the characters of every other DWORD are alpha numerical (except the first byte of the first DWORD), and the other DWORDs are all zero. Might be worth noting that the last DWORD, when turned around, spells LADR, which could be pronounced LADDER (probably not though =p). Of course, thats asuming these are DWORDs at all.

[code]BYTE  02
DWORD 01 00 00 00
DWORD 05 4C 52 55
DWORD 00 00 00 00
DWORD 50 41 4D 00
DWORD 00 00 00 00
DWORD 45 50 59 54
DWORD 00 00 00 00
DWORD 43 53 45 44
DWORD 52 44 41 4C
DWORD 00 00 00 00[/code]

This message is used to request a list of maps to use, along with the URLs for user profiles and ladder lookups.  It's simply:

(BYTE) Request type (2)
(DWORD) Cookie (Static incremental variable)
(BYTE) Types of data requested (5)
(DWORD[]) Lookup data

Lookup data usually consists of the following types: '\0URL' (List of urls for ladder/profiles), '\0MAP' (list of maps), 'TYPE' (game types available, iirc), 'DESC' (description of the maps), 'LADR' (list of ladder maps).  The second dword for each lookup data item is usually always seen to be 0.

Ah, that was fast.

How does the server respond? With S>C 0x44 SID_WARCRAFTGENERAL SC 0x02?