Another WAP Push over SMS encoding

This post was written by Jeroen on February 26, 2009
Posted Under: SMS
This entry is part 10 of 17 in the series Sending out an SMS

I still needed to show how you can send an Service Indication (SI) document like:

<?xml version="1.0"?>
   <indication href=""
     si-expires="2009-03-04T16:25:00Z">Check out Mobile Tidings!</indication>

This document, a Service Indication, tells the WAP client to store the following:

  • A link to
  • With text “Check out Mobile Tidings!
  • This typically shows up in a “WAP Push Inbox” or sometimes in the “SMS Inbox
  • The link will show when it was created
  • It should automatically be removed after the expiry time mentioned

Well here is the AT command to send this particular SI document:



As before, here is a byte-for-byte explanation:

Size Value Description Section
1 octet 0×00 No SMSC supplied SMS
1 octet 0×41 SUBMIT-PDU + UDH present  
1 octet 0×00 message reference  
1 octet 0x0B Length of destination address in digits  
1 octet 0×91 Destination is an international telephone number  
6 octets 0x5121551532F4 Destination is ‘+15125551234’  
1 octet 0×00 Protocol identifier  
1 octet 0×04 Date coding scheme. This value stands for ‘8 bit data’.  
1 octet 0x5E User Data Length. Size of payload is 94 octets.  
1 octets 0x0B User data header length is 11 octets. UDH
1 octet 0×05 IEI 0×05 contains source and destination port.  
1 octet 0×04 IEDL. Content is 4 octets.  
2 octets 0x0B84 Destination port is 2948. This is the port for connectionless WSP.  
2 octets 0xC002 Source port is 49154. Since we’re not expecting any replies, this can be any value.  
1 octet 0×00 IEI 0×00 contains concatenation information  
1 octet 0×03 EIDL. Content is 3 octets.  
1 octet 0xF0 Reference number  
1 octet 0×01 Total 1 parts  
1 octet 0×01 This is the 1st (and only) part  
1 octet 0x0B The WSP transaction ID WSP
1 octet 0×06 This is a push PDU  
1 octet 0×04 Headers consist of 4 octets  
1 octet 0×03 Content type consists of 3 octets  
1 octet 0xAE Content type 0x2E: This stands for application/vnd.wap.sic (a WBXML encoded SI document)  
1 octet 0×81 Parameter name: 0×01 means ‘Charset  
1 octet 0xEA Parameter value: 0x6A means ‘UTF-8  
1 octet 0×02 WBXML Version 1.2 WBXML
1 octet 0×05 Document type -//WAPFORUM//DTD SI 1.0//EN  
1 octet 0x6A Encoding UTF-8  
1 octet 0×00 String table length  
1 octet 0×45 <si> element with content  
1 octet 0xC6 <indication> element with attributes and content  
1 octet 0x0C token for attribute ‘href’ and its value starting with ’http://’  
1 octet 0×03 Inline string follows  
18 octets 0x6D6F62696C657
1 octet 0×00 end of inline string  
1 octet 0×04 token for attribute ‘created’  
1 octet 0xC3 opaque data follows  
1 octet 0×06 length of opaque data  
6 octets 0×200602261625 a GMT date-time value using hex nibbles:2006-02-26 16:25  
1 octet 0×10 token for attribute ‘si-expires’  
1 octet 0xC3 opaque data follows  
1 octet 0×06 length of opaque data  
6 octets 0×200603041625 a GMT date-time value using hex nibbles:2006-03-04 16:25  
1 octet 0×01 end of <indication> attributes  
1 octet 0×03 Inline string follows  
25 octets 0x436865636B20


“Check out Mobile Tidings!”  
1 octet 0×00 end of inline string  
1 octet 0×01 end of <indication> (</indication>)  
1 octet 0×01 end of <si> (</si>)  
Series NavigationEMS and WAP Push supportSMS based applications
Tags: , ,

Reader Comments

How can I insert a “signal-delete” instead
of “si-expires”.
Your answer will be appreciated.

Written By franco on June 4th, 2009 @ 9:32 am


- For “action=signal-none” insert 0×05
- For “action=signal-low” insert 0×06
- For “action=signal-medium” insert 0×07
- For “action=signal-high” insert 0×08
- For “action=delete” insert 0×09

Don’t forget to adjust the UDL.

Good luck,

Written By Jeroen on June 5th, 2009 @ 10:25 am

I sent a wap push using your code with success!.
(With hyperterminal)
My celular receives it fine (SonyEricsson w200).
If I send it again and the old sms (Wap Push) is still at the inbox of my phone, the hyperterminal reports “sent”, However my phone does not make any sound and does not receive anything new.
Now if I erase the wap push message from my phone and send it again with the hyperterminal then it is received as a normal sms (Wap push) message.
Is that normal (Or rather standard) for wap push messages or something is wrong with my phone?
I am confused about it!.
It seems as if the operator checks if an identical message already exists!

Written By Franco on June 6th, 2009 @ 8:07 pm

It seems like that the receiving phone has some form of duplicate detection. Duplicate detection could be based on the URL, have you tried changing the URL?

Written By Jeroen on June 6th, 2009 @ 8:26 pm

Hi Jeroen – best regards from Switzerland. Helpful pages indeed – I stumbled over them with a Google search.

Written By Marc on June 9th, 2009 @ 5:54 pm

Tried action-signal with success; however, for 05 and 09 it will not work, the sms reports as sent but it is never received. For 07 it is received by my phone as a normal wap-push sms and with 08 it is received and at the inbox the wap-push appears as the 07 one plus a sign (!) in color red appears next to it.
Which I think is nice but can not undertand why.
I think that the SMSC is not using the standards as it should or their platforms is not uptodate!.
Any thoughts on that?

Written By Franco on June 18th, 2009 @ 9:37 pm


How these actions are interpreted is purely a matter of implementation on the recipient phone. The SMSC never (in my experiences) touches the User Data part of messages.

The action=delete is intended to delete a previously sent WAP push. The matching of the delete is based on the “si-id” attribute. So if you first send a normal SI with “si-id=6789″, you cal later remove it by sending an SI with “action=delete” and the same “si-id” value.

I’ll update this post to include the encoding of the “si-id” when I have some time, but if you want to try it: the encoding for the “si-id” attribute and value (inside the “indication” element) is like this:
- 0×11 (which indicates “si-id” attribute)
- followed by 0×03 (inline string)
- followed by your id (any string, but something like “” is convention)
- followed by a 0×00 (terminating 0)

Written By Jeroen on June 19th, 2009 @ 7:35 am

Thanks again!.
Sent a wap push with ID= 7777, action=08 and was received OK. (1103373737370007)(sound and everything)
Sent same wap push ID= 7777, action=09 and my phone did not make any sound at all and after a few minutes, cheked the sms and it had been erased.
This is fantastic!!!

Written By Franco on July 2nd, 2009 @ 6:16 pm

For your 8-bit encoding of “”, is that using extended ASCII? UTF-8? The spec says “8-bit alphabet” but I can’t find it actually specify what 8-bit alphabet it is talking about!


Written By Sam C on July 7th, 2009 @ 12:07 am


The character set used in the WBXML encoding is defined in the WBXML header. In my example I used UTF-8: see the octet after the WBXML version and document type. UTF-8 is most commonly accepted, so it is the only one I ever use, but theoretically you can use other character sets. The character set field in the WBXML header is defined as a multi-byte integer representing the MIBEnum value as define by IANA, see

Good luck,

Written By Jeroen on July 7th, 2009 @ 8:15 am

Hi I think you have a typo for the content type:
1 octet 0xAE Content type 0×2E: This stands for application/vnd.wap.sic (a WBXML encoded SI document)

From what I can tell, the 0xAE should be 0x2E as per the comment.

Written By Sam C on July 7th, 2009 @ 4:05 pm

Hi Jeroen,

Thanks for that info. Just a note on that, appears to be a typo where you define the character set
1 octet 0xEA Parameter value: 0×6A means ‘UTF-8‘
I believe the 0xEA should be 0x6A as per the following comment.


Written By Sam C on July 7th, 2009 @ 4:11 pm


The first bit is set as part of the WSP header encoding. In the WSP encoding the first octet of a value has the following meaning:

  • 0-30: This octet is followed by the indicated number (0 –30) of data octets.
  • 31: This octet is followed by a uintvar, which indicates the number of data octets after it.
  • 32-127: The value is a text string, terminated by a null.
  • 128-255: It is an encoded 7-bit value; this header has no more data, the value is obtained by zero-ing the first bit.

The content-type is encoded as a 7-bit value (like an enum), as is the character-set.

Written By Jeroen on July 7th, 2009 @ 4:41 pm

Aha thanks for that Jeroen. So if I understand the spec correctly, by specifying the WSP first octet in the range 0-30, you imply octets for the data. And then the spec expects ( “Short-integer = OCTET” so the MSB is set.

The specs I find would be much accessible if they were illustrated with examples like what you are doing. Thanks!


Written By Sam C on July 7th, 2009 @ 9:58 pm

Sorry to be a pain Jeroen. Can you tell me where I can find the attribute token list and values for SI and SL?


Written By Sam C on July 8th, 2009 @ 12:06 am

Take a look at for all WAP specifications.The ones you’re looking for are wap-168-serviceload-20010731-a and wap-167-serviceind-20010731-a. You’ll also need wap-192-wbxml-20010725-a.


Written By Jeroen on July 8th, 2009 @ 8:33 am

Aha thankyou!

Written By Sam C on July 8th, 2009 @ 4:05 pm

Just a note about certain values.
Have played around with some of them and found out that one can change certain values without altering the final output; however, some of them simply can not be altered or the output is either not sent or destination is not reached.
Examples : case mentioned by SAM.

Written By Franco on July 8th, 2009 @ 5:52 pm


I’m investigating the OMA Email Notification (EMN), which has Content-Type = application/vnd.wap.emn+wbxml (0x030a).
This C-Type is 2 bytes long, while in your examples both SI and SL are 1 byte only.
So now my question is, when encoding the C-Type shall I use either the text plain format or the hex value or can use any of them?

Below WSP headers I’ve used:

1) application/vnd.wap.emn+wbxml
T-ID = 0×01
PDU Type = 0×06
Headers- Length = 0x 34
C-Type = 0x 61 70 70 6c 69 63 61 74 69 6f 6e 2f 76 6e 64 2e 77 61 70 2e 65 6d 6e 2b 77 62 78 6d 6c 00
X-WAP-App-ID = 0x af 89
Content-Length = 0x 8d a0
— payload —

2) 0x030A
T-ID = 0×01
PDU Type = 0×06
Headers- Length = 0x 08
C-Type = 0x 03 02 03 0a
X-WAP-App-ID = 0x af 89
Content-Length = 0x 8d a0
— payload —

I’ve tried both but Wireshark looks recognizing the text format only (1), so my doubt:
is (2) actually correct?


Written By Massi on July 9th, 2009 @ 2:17 pm


When encoding the content-type it is always best to use the encoding. The client will be programmed for size and efficiency which make the encodings preferred (which is why they were invented in the first place).

The second attempt seems right:

- Content-type is encoded as Value-length + Media-type

- Media-type is encoded as a Well-known-media

- Well-known-media is encoded as an Integer

- Integer is encoded as a Long-integer

- Long-integer is encoded as Length + Value

Just curious: Since Wireshark captures only IP traffic, are you trying to send this as an UDP packet?
Are you sure the recipient:

- Supports the EMN?

- Listens on the right IP address?

Very curious about your setup….

Good luck,

Written By Jeroen on July 9th, 2009 @ 3:27 pm

Hello Jeroen

many thanks for your prompt feedback.
Yes, I send Push over UDP/IP and phones I have indeed support such bearer, I’m trying to understand if they support EMN as well.

From OMA web site (

0×00 to 0xFF - Well-Known values, named in the WSP specification.
0×0100 to 0xFFFF - Registered values, listed below. Must be IANA-registered before assigned a number.

Sounds like my 0x030a is indeed registered but not a “well-known-value”.
What’s your opinion?

From my experience for instance I’ve seen MMS notification coming with application/vnd.wap.mms-message instead of 0x3E (actually defined in 1.4 of encoding version).

Back to my EMN experiments, it might be a problem of Wireshark, but I still don’t feel comfortable with “well-know” definition in WSP :(
Hope you can help

Written By Massi on July 10th, 2009 @ 4:39 am


You have the correct code value for the Content-Type. I am convinced that if your device has implemented the feature, it will recognize the code. The idea of well-known (in the WSP spec) is ‘standard, but not part of WSP itself’. At the time of of the WSP spec (2001?) MMS was known, but EMN was not, that’s all. Every code added afterward was in the 0×0100 – 0xFFFF rage simply because they didn’t want to change the mature WSP spec anymore.

If the code would be in the rage 0×10000 to 0xFFFFFF, I’d be worried. Those are proprietary or experimental.


Written By Jeroen on July 10th, 2009 @ 7:36 am

As you know, when you send this wap push message, you are essentially sending a sms message.
When message is received by recepient, it is handled as any sms messages.
I was planning to include an activation of the either voice mail alert or e-mail alert or fax alert with the wap push sms.
I understand based on one of the answers to one of my posts at “Setting Voicemail Waiting Indication via SMS”
that it is possible and it should be part of the UDH, after SMS and before WSP.
Could you give us some idea as to where and how it should be included in this wap push message?

Written By Franco on August 7th, 2009 @ 5:18 pm

In reference to this ->

- For “action=signal-none” insert 0×05
- For “action=signal-low” insert 0×06
- For “action=signal-medium” insert 0×07
- For “action=signal-high” insert 0×08
- For “action=delete” insert 0×09

Don’t forget to adjust the UDL.

Good luck,

Have worked with all of them OK; except 0×05
the sms is effectively sent but phone apparently receives it and discards it; So it is like a ping
to check if phone is working or available.
Is this thought of mine right?

Written By Franco on August 9th, 2009 @ 4:45 pm

There is another element that can be inserted under <si>, the <info> element.

Here is the description from the SI spec:

“The info element provides a means to specify additional information not provided by the attributes of the indication element. The element contains one or more item elements that specify the additional information. Each item element contains a class attribute describing what information the content of the item element contains. How a client uses this information is not specified within this specification and is thus implementation dependent. A client MAY discard the info element.”

A WAP Push SI message with signal-none is intended to pass the info element without notifying the user. After the info element has been processed, the client can discard the WAP Push message. I don’t know if or how it is used by anybody.

Written By Jeroen on August 10th, 2009 @ 9:38 am

Thanx for this great article. I successfully sent SI wap push messages to number of different phone models.

But I am wondering whether, can we send multiple URLs in a WAP push message?

Written By TharOF on January 19th, 2010 @ 8:50 pm

No, the WAP push specs for both SL and SI only let you send one URL per message.

Glad the article is helpful. Post a link to my blog if you can.


Written By Jeroen on January 20th, 2010 @ 11:21 pm

Great article and site. I have a question regarding sending WAP push messages with long message text. Is it possible and how should I split the message, like normal SMS or..?
We are sending messages/multipart messages, WAP push to SMSC over SMPP…
Tnx for any info.. :)

Written By Domagoj on June 2nd, 2010 @ 2:37 am

Can we send this wap push over USSD since USSD also follows SMPP protocol ?

Written By nsv on June 24th, 2012 @ 9:40 am

I would like to send all my contacts number from my phone using the wap push. can it be possible and how can I do it.
Can it be possible from any phone.
Many Thanks

Written By Willy on July 15th, 2013 @ 2:44 am

Add a Comment

required, use real name
required, will not be published
optional, your blog address