Intro to XMPP

An Introduction to the Extensible Messaging and Presence Protocol

Official XMPP Logo

Abstract

Thispaper provides an introduction to XMPP and the XML streams it uses. Transport layer concerns are briefly discussed herein, but these are not the focus. Common stanzas are discussed along with important concepts like presence and pubsub. Packet analysis using Wireshark was conducted. Four trace files were used in the analysis from two different sources, one of which involved the use of the Adium IM application. These analyses focus on how an XML stream is established, how messaging operates, how querying is performed, and a brief example of how the presence tag is used. XMPP is a protocol with comprehensive functionality for connecting two network entities in real time. The protocol’s features make it ideal for use in messaging applications.

An Introduction to the Extensible Messaging and Presence Protocol

The Extensible Messaging and Presence Protocol, formerly known as Jabber and hereafter referred to simply by the acronym XMPP, is an application level protocol used by instant messaging applications like WhatsApp. XMPP makes use of Extensible Markup Language (XML), establishing and maintaining an XML stream between two network entities.

Protocol Discussion

Though XMPP typically utilizes TCP, the protocol has also been adapted for use with UDP and HTML, the former for VoIP and video calls, the later for specialized use cases outside the scope of this paper (Beda, J., Saint-Andre, P., Ludwig, S., Hildebrand, J., & Eagan, S., 2020) (Peterson, I., Smith, D., Saint-Andre, P., Moffit, J., Stout, L., & Tilanus, 2021), XMPP clients typically operate at registered port 5222 which Wireshark is configured to recognize as XMPP/XML (Saint-Andre, 2015). Since this paper is introductory, the capture analysis in the Capture Results section below will only cover XMPP running on TCP on the standard port.

XMPP makes use of XML tags called stanzas with defined meanings. Three of the most common stanzas are iq or information query, message for messages sent between IM sotware users, and presence which along with other XML tags are used to store user information. The concept of presence is core to the protocol and is one of the things which distinguishes it and other IM protocols from common email protocols. Presence primarily operates to indicate whether a given user is online or not. This operates in conjunction with with publication and subscription concepts, together referred to as pubsub, to update user account information and inform those with that user in their roster, or contacts list.

Video Presentation

[embed]

Capture Methods

Four capture files were used in this analysis. One comes from a repository on systems engineer Peter Wu’s GitHub published in 2014. This capture simply shows how the XMPP initializes an encrypted XML STREAM. Three were downloaded from QA Cafe’s Cloudshark client. These captures were taken in 2017 while using the Adium IM for macOS. The following section will begin with a discussion of Peter Wu’s capture file. Then messaging functionality will be discussed with the Adium_send_message capture file, followed by a simple explanations of the Information Queries contained therein and an example of pubsub in action with Adium_set_nickname.pcapng The final capture discussed herein is Adium_add_contact.pcapng

Capture Results

Stream Initialization, Peter Wu’s File, xmpp-ssl.pcapng

The capture starts with the standard TCP three-way handshake between a client with IP address 192.168.97.167 and a server with IP address 208.68.163.218. The client operates from the user generated source port 46553, and the server operates from port 5222, indicating that XMPP/XML will be used. The handshake is immediately followed by a XMPP packet from the client to the server with a generic XML stream. Wireshark indicates which direction the XML data is being sent in the info section like so, with STREAM > jabber.org indicating the stream is heading to the server and the same message with an < indicating a server-to-client message. The server response is an XML stream with a number of features listed. One feature is a starttls tag marked required to inform the client that encryption is required. This is followed by a mechanisms tag which supports a single mechanism, DIGEST-MD5, indicating the higher-level hashing algorithm the stream will use from here forward. The client then sends its own starttls tag, the server responds with a proceed tag. The two hosts then go through the standard TLS handshake. The above process operates similarly to the TLS handshake itself, only at the application layer. Though not shown in the file, a packet with the containing the closing tag </stream> will end the stream.

Messaging, Addium_send_message.pcapng

The capture is composed primarily of XMPP/XML Message packets. The info section in Wireshark follows the same convention as in the above capture, but with MESSAGE in the place of STREAM, indicating the direction of the message. In this file, the user appears to be sending a message to a chatbot which simply echoes back whatever the user says. The user composes and sends a message which reads “hey” and receives an identical response back. Message packets can contain the following information: from, id, to, type, CHATSTATE, and body. The first three fields are self-explanatory. The from attribute will only appear in messages the user has received from another user or network entity. The capture file only includes messages of type chat. The two CHATSTATE values shown in the file are active and composing. The former when paired with an XML body tag indicates that a message has been sent. If the stream is unencrypted as in this file, the body and therefore the message content can be viewed in Wireshark. Filtering for xmpp.message.body in Wireshark can be convenient if the analyst wishes to simply see those messages with text content. The CHATSTATE composing is what allows WhatsApp and other IM application users to see if someone is currently typing in a message to send them.

Information Queries and pubsub, Addium_set_nickname.pcapng

This capture shows a user changing the profile’s display name shown to his contacts. The user had not previously set a nickname to change this display name from the default. All XMPP/XML packets in this capture are information queries with pubsub tags. Each publish tag here only contains a publish tag with no subscribe tags. The former are used to change user profile information; the later are used when a user adds another to his contacts. Each iq in the file has an unique id and type. The iq get, error, set, and result. The first iq attempts to retrieve the user’s nickname, which does not exist, so an iq of type error is returned in the next packet. The next XMPP/XML packet sets the display name to tom-nickname via its publish tag. A publish tag can contain one or more item. This packet only contains a single item, nick with its value set to tom-nickname. The final XMPP/XML packet is an iq of type result. Since the iq was not of type error, the nickname appears to have been set successfully.

Presence and Subscription, Addium_add_contact.pcapng

As the name suggests, this capture file involves adding a contact in Adium. Without giving an exhaustive relation of each packet, the client set its roster and adds the server to the roster with information queries. In addition to this, however, the client sends a packet with a presence tag to the server with the to attribute set to another entity’s id. After a series of information queries, the server responds with another presence packet of type subscribed. This indicates that the user will now receive additional presence packets indicating whether the entity to which it just subscribed is online. One such packet is contained near the end of the packet.

Conclusion

XMPP is a protocol with comprehensive functionality for connecting two network entities in real time. The protocol operates securely with standard encryption methods utilized by other protocols. The protocol comes with the prepackaged functionality, shown in the analysis above, for sending text messages between users. The protocol’s use of the concepts of presence and pubsub make applications which use XMPP good tools for consumers to connect with and share information about one another’s availability and contact details. XMPP’s extensibility give the protocol’s maintainers the means to improve on the protocol and network analysts an avenue for further exploration beyond what has been discussed above. All of these features make XMPP a viable choice for IM applications.

References

Beda, J., Saint-Andre, P., Ludwig, S., Hildebrand, J., & Eagan, S. (2020, December 10). Jingle Raw UDP Transport Method. XMPP. https://xmpp.org/extensions/xep-0177.html

Peterson, I., Smith, D., Saint-Andre, P., Moffit, J., Stout, L., & Tilanus, W. (2021, May 22). Bidirectional-streams over synchronous HTTP (BOSH). XMPP. https://xmpp.org/extensions/xep-0124.html

Saint-Andre, P. (2015, October 14). RFC 6120: Extensible messaging and presence protocol (XMPP): Core. IETF Datatracker. https://datatracker.ieo.org/doc/rfc6120/

Wu, P. (2014). xmpp-ssl.pcapng. Wireshark Notes. computer soUware. Retrieved 2025, from https://github.com/Lekensteyn/wireshark-notes/blob/master/tls/xmpp-ssl.pcapng

XMPP packet captures. QA Cafe Support. (2017, August 10). https://support.qacafe.com/cloudshark/documentation/xmpp-captures/