Read IAC commands

Every Telnet command begins with IAC, byte 255. A simple command uses two bytes: IAC followed by its command code.

For example, IAC IP means Interrupt Process. IAC AYT means Are You There. IAC EC means Erase Character. These map to things a person at a terminal wants: stop the running program, check whether the far end is alive, undo the last typed character.

255 244  -> IAC IP   (Interrupt Process)
255 245  -> IAC AO   (Abort Output)
255 246  -> IAC AYT  (Are You There)
255 247  -> IAC EC   (Erase Character)
255 248  -> IAC EL   (Erase Line)

Why send IAC EC instead of a plain backspace character? Because these are protocol-level representations, so each server decides how they affect its local process. One system erases characters with backspace, another with delete. The NVT command is neutral, and each end translates it into whatever its local system means by “erase one character”.

IAC AYT is worth trying by hand. Many Telnet clients let you send it from command mode:

telnet> send ayt

A responding server prints something visible, historically a message like [Yes], to prove the connection is alive. It is a tiny liveness check built into the protocol.

The command codes 251 through 254 are WILL, WONT, DO, and DONT. Those are three bytes rather than two, because they carry an option code. They get the next lesson to themselves.

Parse the stream, not the packets

Do not search each TCP packet independently for these pairs. A packet may end after IAC while the command byte arrives in the next packet. From TCP’s point of view that is completely legal: it promised you a byte stream, not tidy packages.

Parse the continuous stream. A correct reader consumes bytes in order, and when it sees 255 it waits for the next byte before deciding anything, even if that byte has not arrived yet.

The failure mode of getting this wrong is nasty: a parser that misses a split IAC treats the command byte as data. Byte 244 is not printable ASCII, so garbage lands in the session, and the intended interrupt never happens. Everything looks fine until packet boundaries fall in the wrong place.