How the pieces fit together
The client speaks FLAP over TCP. Sign-on, the welcome screen and the tunnel all ride on the same connection, distinguished by two-letter tokens.
The tunnel uses four of them: two carry configuration - address, DNS servers, routes, MTU - and two carry the IP packets themselves, in pieces of at most 1015 bytes. An empty data token every second or so is the acknowledgement that keeps the link alive.
Passport 1.4 and Directory Access, both over HTTPS - the client checks the certificate and will not talk without one.
Sign-in posts to clientpost.srf and gets back a ticket inside the response,
plus the address to jump to afterwards. Before that, the client asks the Nexus
for client.xml to learn where everything lives, and caches the answer in the
registry. Afterwards it asks for permissions and the member list, and only
then considers the account activated.
The exact shapes of those answers are not documented anywhere; they were read
out of msnsign.dll. What the binaries say has them.
Not an offering by Microsoft or AOL. MSN, MSN Explorer and AOL are trademarks of their respective owners.