Game Packets
Certain frames contain game packets, which are recorded server game packets. While stored as byte arrays within these frames, the data is actually encoded in a bitstream format.
Frames contain multiple packets, concatenated together. Within a packet is a single protobuf message, encoded as bytes, we'll discuss this below.
Layout
Packets have three fields:
| Field | Type | Description |
|---|---|---|
packet_id | u_bit_var | the packet type |
packet_size | varint | the length of data in the packet (in bytes) |
packet_data | bytes | the actual packet data |
Note:
While packet_data is a set of bytes, it may not be byte-aligned, which can occur overhead.
Packet IDs
Packet Data consists of protobuf messages with each packet_id corresponding to a given type.
Packet IDs come from multiple protobuf enums. At this time we can guess the following types are packet IDs:
SVC_MessagesNET_MessagesECstrike15UserMessagesEBaseGameEventsEBaseUserMessagesECsgoGameEvents
It may be the case that some of these overlap, while we cannot confirm this fact, we have had success parsing in that order.
Packet Payloads
Each packet IDs matches to its given protobuf message.
Here are some notable ones:
| Packet Id | Payload Type | Description |
|---|---|---|
svc_ServerInfo | CSVCMsg_ServerInfo | Server Info (including build version, map name, class field size) |
svc_ClassInfo | CSVCMsg_ClassInfo | Mappings of class ids to their names/serializers |
svc_PacketEntities | CSVCMsg_PacketEntities | A list of entity updates |
svc_FlattenedSerializer | CSVCMsg_FlattenedSerializer | Serializer specifications |
We wouldn't be able to list all the messages here, I would recommend exploring the protobuf files.
Most enum variants match to a respective message, but some have mismatched names.