Quote from Euler:
Based on what you said, I'm now sniffing the packets between Sterling and its servers, and they do indeed seem to be unencrypted. As an aside, it's an interesting internal format they're using -- it looks sort of "FIX-like" (numberKey=value pairs); but, annoyingly, the key numbers are different from those of FIX.
Just found the notes I made some time ago, maybe they're interesting to you (although it isn't exactly hard to find this out yourself, lol, since Sterling didn't bother to encrypt) ->
[numberKey]=[value]
1=000238~ => packet length
2=0006~ => Packet identifier => 6 = order
3=XXXXX~ => account
4=XXXXX~ => Trader's last name
5=192.168.1.37~ => IP address
6=4450~ => Same for each session
7=15053873~ => Session ID, created by client and sent to server in 1st packet with numberkey 33
12=1~ => Seems to be always 1
27=3~ => 3 = buy, 4 = cancel (I think)
54=XXXXX~ => account
58=B~ => order side
60=100~ => order size
145=100~ => visible size
29=MSFT~ => symbol
179=T~ => Lacks for API orders
62=1.44~ => order price
64=5~ => maybe order type ?
I haven't investigated further, I don't intend to send orders to Sterling this way (e.g. create your own packet, send it to your socket and then let the platform send it over its own socket to the server). Reason is that if you do this directly, you'll skip all checks (e.g., the submit code that submitorder() returns is created by the platform, you're skipping all these checks, which is, obviously, very dangerous) and that I doubt that it's much faster (well, it most probably IS faster, but the lag is neglectible in comparison to the server order processing bottle neck). Besides, I'm 100% sure that both your firm and Sterling won't like you to skip all these checks, including BP checks

So I'd strongly advise anyone who's going to use sockets to only use it to 'read' info, not send, if you want to stay out of trouble
Anyway, hopefully Sterling will move to FIX one day (the above indeed very much is FIX-like and like mnx notes, they used to offer FIX), but I doubt they even bother and with all problems they're currently facing, I'm quite sure that API development is on the bottom of their 'to do list'
