diff --git a/doc/proto_00000402.txt b/doc/proto_00000402.txt
new file mode 100644
index 0000000..f1dbad9
--- /dev/null
+++ b/doc/proto_00000402.txt
@@ -0,0 +1,68 @@
+Detailed specification of protocol in version 00000403
+======================================================
+
+CMC = 2 byte Cache Miss Counter, increased every time it is used
+
+Version:
+Client sends:
+	First byte v or V
+	Rest encoded with base32:
+	4 bytes big endian protocol version
+	CMC
+Server replies:
+	4 chars:
+		VACK (version ok), followed by login challenge
+		VNAK (version differs), followed by server protocol version
+		VFUL (server has no free slots), followed by max users
+	4 byte value: means login challenge/server protocol version/max users
+	1 byte userid of the new user, or any byte if not VACK
+	
+Login:
+Client sends:
+	First byte l or L
+	Rest encoded with base32:
+	1 byte userid
+	16 bytes MD5 hash of: (first 32 bytes of password) xor (8 repetitions of login challenge)
+	CMC
+Server replies:
+	LNAK means not accepted
+	x.x.x.x-y.y.y.y-mtu means accepted (server ip, client ip, mtu)
+
+Case check:
+Client sends: 
+	First byte z or Z
+	Lots of data that should not be decoded
+Server replies:
+	The requested domain copied raw
+
+Switch codec:
+Client sends:
+	First byte s or S
+	One byte ASCII digit, meaning userid
+	One byte ASCII digit, with value 5 or 6, representing number of bits per byte in encoding
+Server sends:
+	Name of codec if accepted. After this all upstream data packets must be encoded with the new codec.
+	BADCODEC if not accepted. Client must then revert to Base32
+
+Data:
+Data header:
+	 321 0 
+	+---+-+
+	|UUU|L|
+	+---+-+
+
+UUU = Userid
+L = Last fragment in packet flag
+
+First 4 bits coded as hex in ASCII. 
+Followed by data encoded with the chosen codec.
+
+Ping:
+Command = 0x04, User = userid
+Client sends:
+	Only a CMC
+
+The server responses to Ping and Data packets is a DNS NULL type response:
+If server has nothing to send, data length is 0 bytes.
+If server has a packet to send, data length is set and the data is a full raw
+unencoded ip packet, prefixed with 32 bits tun data.