Coding Range

Decoded: Steam In-Home Streaming Discovery Protocol

January 14th, 2014

In-Home Streaming is coming soon to Steam. It lets you use input and output on one computer, and let another computer actually handle the rendering, calculations, networking etc. It’s like Remote Desktop but for games.

Some of IHS (In-Home Streaming) has already made it’s way into the Steam Client, as uncovered by the good folks over at SteamDB.

IHS seems to be composed of three layers worth of networking protocol, each of which instructs the client on how to connect to the next one.

  • Autodiscovery: to detect other Steam instances.
  • Steam Control1: to view installed games, launch games, and start streaming, Steam has a protocol for partial remote client control.
  • Streaming: to transmit controller input and recieve render output.

When the user opens the IHS Settings page, the Steam client sends a broadcast over the network, inviting any other Steam installations to announce their presence. When they do, Steam displays them in the settings menu and either lets the user connect2, or notifies the user that another account is logged on to the remote machine.

The protocol will be considerably easier to understand if you have an understanding of Protocol Buffers and have a read-through of the protocol buffers definitions file.

Protocol Basics

All communication is done over IPv4 and UDP on port 27036. The first 8 bytes of each UDP packet is 0xFFFFFFFFA05F4C21 (little-endian).

The next 4 bytes are the little-endian length of the header, followed by the header.

The next 4 bytes (after the header) are the little-endian length of the body, followed by the body.


The header is a CMsgRemoteClientBroadcastHeader protobuf (Protocol Buffer) message. This contains:

  • a Client ID, which is a 64-bit unsigned integer that is randomly generated by each client.
  • a message type, which is an enum that specifies what the message body is.


There are three types of body messages as follows.


The discovery message is a CMsgRemoteClientBroadcastDiscovery protobuf. This contains:

  • a sequence number, which appears to be incremented each time the user visits the IHS Settings page.

The message type for this message is k_ERemoteClientBroadcastMsgDiscovery.

Discovery messages are sent as a broadcast, i.e. they are sent to IPv4 address


The status message is sent in response to a discovery message. This contains:

  • the TCP port to connect to for the Control protocol (see above)
  • what services, if any, are enabled. The only existing service currently is Remote Control (k_ERemoteClientServiceRemoteControl).
  • the host name of the machine
  • the minimum compatible version, assumedly of Steam Control protocol
  • the version, assumedly of the Steam Control protocol
  • which Steam users are logged in, I assume. Interestingly this is an array which would allow multiple Steam users to be logged in at once. I’m not sure if this is the full Steam ID or only the Steam Account ID.

The message type for this message is k_ERemoteClientBroadcastMsgStatus.


I’m not sure what causes the Offline message to be sent. This message also has no defined body, it only has an ERemoteClientBroadcastMsg value.

  1. For remote-controlling Steam, as opposed to remote-controlling games. Presumably this is used alongside the separate HTTP remote control protocol

  2. I assume, I haven’t actually been able to get that far. No matter what I try Steam says I have a different account logged in.