WAP Push SMS encoding

This post was written by Jeroen on February 21, 2009
Posted Under: SMS
This entry is part 8 of 17 in the series Sending out an SMS

As I started to explain in the last post, a WAP push consists of an XML document sent to the device over SMS. This is true but somewhat simplified.
The truth is that we send:

  • an WBXML encoded XML
  • over WSP (Wireless Session Protocol)
  • over WDP (Wireless Datagram Protocol)
  • over SMS

This is called an unconfirmed push.

It is also possible to send a confirmed push. In a confirmed push, the recipient confirms the receipt of the push message. If the recipient fails to confirm the sender is supposed to retry sending it. This is necessary mainly when WDP is over a less reliable protocol than SMS (like UDP for instance). For unconfirmed push we have to add another layer:

  • an WBXML encoded XML
  • over WSP (Wireless Session Protocol)
  • over WTP (Wireless Transaction Protocol)
  • over WDP (Wireless Datagram Protocol)
  • over SMS

Since we’re focusing on SMS in this series and SMS messages are a very reliable, I’ll ignore the confirmed push in this article.


The WAP protocol (versions 1.3 and before) relied heavily on compressing data (such as WML and XML documents) to reduce the bandwidth used by WAP. WAP started to become deployed around 1998, at which time a Mb of bandwidth was still expensive. Today many operators offer all-you-can-eat data plans, network speeds are much higher and network latency is much lower. So since WAP protocol version 2.0, WAP is much more like HTTP and doesn’t rely on the encodings as much.

In a WBXML encoding, predefined element names, attributes and even attribute values will be substituted by tokens. A token typically consists of 1 octet. The encoding also allows for efficient encoding of strings that occurs more than once.

In the WBXML encoding of an XML document is a document type specific encoding. The WBXML encoding for a document type is defined by

  • Which elements translate to hat tokens
  • Which attributes translate to what tokens
  • Which attribute values translate to what tokens


The Wireless Session Protocol is the WAP (1.3 and before) version of HTTP. WSP is a request/response protocol optimized for carrying HTTP requests and responses. As with WBXML the main feature of WSP is the compression of HTTP request/responses and HTTP headers. This is relevant to us since what we’re going to send in the WAP push message includes the HTTP Content-Type and Content-Size headers. Additionally we can send some WAP specific headers, of which I’ll show one. Basic structure for WSP encoded content is:

  • Encoded headers Length
  • Encoded headers
  • Body Length
  • Body

The length fields are integers encoded in 1 or more octets.


The Wireless Datagram Protocol is the lowest layer of the WAP (1.3 and before) stack. It defines how packets are to be sent over a specific bearer. In any IP based network (GPRS, 3G, etc) WDP corresponds to UDP. We’re interested only in how to send packets over SMS, so we need to understand how to make a WDP packet out of an SMS.

There are 2 IEI used to make a WDP packet out of an SMS:

  • Source and destination ports. This is IEI 0×05. When multiple applications on the device interested in WDP packets, they use the destination port to figure out if a particular packet is for them.
  • The concatenation information. This IEI 0×00. This is exactly as described in the ‘Concatenating SMS messages’ article.

Having said all this let’s just dive in and look at the first example:

Service Load

Here we send an SMS message that corresponds to the Service Load document of the previous article:


Here is a byte-for-byte explanation:

Size Value Description Section
1 octet 0×00 No SMSC supplied SMS
1 octet 0×41 SUBMIT-PDU + UDH present
1 octet 0×00 message reference
1 octet 0x0B Length of destination address in digits
1 octet 0×91 Destination is an international telephone number
6 octets 0x5121551532F4 Destination is ‘+15125551234’
1 octet 0×00 Protocol identifier
1 octet 0×04 Date coding scheme. This value stands for ‘8 bit data’.
1 octet 0x2E User Data Length. Size of payload is 46 octets.
1 octets 0x0B User data header length is 11 octets. UDH
1 octet 0×05 IEI 0×05 contains source and destination port.
1 octet 0×04 IEDL. Content is 4 octets.
2 octets 0x0B84 Destination port is 2948.
2 octets 0xC002 Source port is 49154.
1 octet 0×00 IEI 0×00 contains concatenation information
1 octet 0×03 EIDL. Content is 3 octets.
1 octet 0xF0 Reference number
1 octet 0×01 Total 1 parts
1 octet 0×01 This is the 1st (and only) part
1 octet 0x0A The WSP transaction ID WSP
1 octet 0×06 This is a push PDU
1 octet 0×04 Headers consist of 4 octets
1 octet 0×03 Content type consists of 3 octets
1 octet 0xB0 Content type 0×30: This stands for  application/vnd.wap.slc (a WBXML encoded SL document)
1 octet 0×81 Parameter name: 0×01 means ‘Charset
1 octet 0xEA Parameter value: 0x6A means ‘UTF-8
1 octet 0×02 WBXML Version 1.2 WBXML
1 octet 0×06 Document type
1 octet 0x6A Encoding UTF-8
1 octet 0×00 String table length
1 octet 0×85 <sl> element, with attributes
1 octet 0×09 token for ‘href=http://’
1 octet 0×03 Inline string follows
18 octets 0x6D6F62696C657
1 octet 0×00 end of inline string
1 octet 0×01 end of <sl> attributes

In the next post I’ll analyze the Service Indication variant.

Series NavigationWAP Push over SMSEMS and WAP Push support
Tags: , ,

Reader Comments

This has worked perfect with my modem Siemens TC65,
SonyEricsson w200 and two different operators in
Managua, Nicaragua.

Written By franco on May 27th, 2009 @ 8:20 pm

Investigating about (Service Load), it seems as if one can automatically activate the browser and proceed with the download of a Wap-Push message.
I know that there is a security issue on this!.
I also found out that there is an action thing that one can use:
action (execute-low|execute-high|cache)
Could you help on this please!.

Written By Franco on July 4th, 2009 @ 8:26 pm

Which is the default value for Service Load; in terms of action?

Written By Franco on July 8th, 2009 @ 5:55 pm

I am sorry.
Just found out that the default value is execute-low or
05 and tried execute-high 06. right after 0×85 with… and adjusted my UDL by one and my cmgs value went up by one too.
Received a wap push: when you open it, you go directly to the wap page. The difference between 06 and 05 is a matter of steps to visit the site.

Written By Franco on July 8th, 2009 @ 6:30 pm

Hi Jeroen,

Is it possible for you to write an MMS example?


Written By Sam on July 20th, 2009 @ 11:53 pm


The MMS MM1 notification is done via a special WAP Push over SMS. I haven’t written about this because of the following… MMS delivery includes 3 steps:
- The server sends a new message (MM1) notification (which usually originates from the MMSC)
- The client fetches the content of the message via GET
- The client acknowledges the successful retrieval to the MMSC
The last step is a direct interaction with an MMSC (the MMS URL that is configured on your phone). Of course you could just ignore this, but maybe the MMSC uses the acknowledgment for billing….

I’ll probably write more about this later in the series.


Written By Jeroen on July 21st, 2009 @ 9:17 am

Hi Jeroen,

Thanks – I’ve just started going through the OMA-TS-MMS-ENC-V1_3-20080128-C.pdf again and now that I understand PDUs better it makes a lot more sense. Will try to form the M-Send.req etc and see if I can get something basic going. That WAP-PUSH code you have provided is a great stepping stone to understanding how the system comes together.


Written By Sam on July 21st, 2009 @ 5:48 pm

Been there, done that….

Good luck!

Written By Jeroen on July 21st, 2009 @ 6:18 pm

I do the following ->
1.- Have a wap site.
2.- Send a wap push either SL or SI
with a link to a xhtml page.
3.- when user receives message and via get
goes the the xhtml page which believe it or not
I use bgsound src to a 6.5KB midi file about the famous 20th century fox film theme and somehow, the midi
is effectively played(streamed) at my SonyEriccsson w200.
4.- The page shows a link to either an image(jpg), an audio file(.amr) or a video file (.3gp). When user clicks on it downloads the file and file is eventually saved successfully.
(I even send a voice mail notification with link to an audio file(.amr) and it simply works.)

My question is:
Is this wap push, is this MMS or is this better than MMS.

By the same token I do this with e-mail using e-mail notification and sendind a link to an e-mail wap site for user to retreive his or her mail.

Your thoughts are
strongly appreciated.

Written By Franco on July 23rd, 2009 @ 9:41 am


What you have is an application of WAP push. MMS is based on (but not restricted to) SMIL documents. SMIL let’s you combine your image, video and audio into one multi-media session. At some point I’ll write more about MMS.

As far as which is better… Your solution:
- Better reach (through email you can reach more devices and even PCs, not all devices support WAP push or MMS).
- Easier to build
- Cheaper (in general SMS costs are less than MMS costs and email is free)
- No mobile operator intervention

- Supports only MMS capable devices
- Mobile operator controlled (unless you’re not interested in MMS messages from your friends, you’d have to use the MMSC of your operator)
- More expensive
- Harder to build (MMS messages are Mime multi-part messages that are encoded similar to WSP and WBXML)
- The user experience is probably somewhat better with MMS, after all MMS was designed just for mobile phones
- MMS messages arrive in your inbox (if configured to do so) and can be viewed offline

You decide,

Written By Jeroen on July 23rd, 2009 @ 11:13 am

I can not stop saying,
Thanks again.

Written By Franco on July 23rd, 2009 @ 5:00 pm

Is it possible to send two different href://..
using same wap push message?
If the answer is ‘yes’ then how would one go about to be able to do it!!!.

Written By Franco on August 1st, 2009 @ 11:01 am


No, WAP Push lets you send only one link. You can send more links in a single message as bookmarks, but that is probably not what you want.


Written By Jeroen on August 3rd, 2009 @ 10:21 am

Hello! How to wap push an URL pointing to a filename? In my nokia 5310 when i wap push just the site, it works, but when the URL points to a filename, it doesn’t…am i doing something wrong?

Thanks a lot!


Written By Nuno on December 4th, 2009 @ 8:53 pm

I wish to send wap push over smpp (using python http://code.google.com/p/smpplib/). I am not sure, if I need to build the message myself i.e. BRXML. Otherwise, in general, do we have to build our own BRXML no matter what generic SMPP library we use? Please suggest something.

Written By Surya on February 16th, 2011 @ 6:41 pm

Whether 8 bit conversion method used for converting “mobiletidings.com/” to

Written By Karthick on February 24th, 2014 @ 5:28 am

Add a Comment

required, use real name
required, will not be published
optional, your blog address

Previous Post: