there are two major revisions of the master protocol.
the first one works with the original quakespy with full integration and user logins and all sorts of annoying crud.
the second one has the master as only a keeper of server ip addresses.
you can't ask the master who's on a server - it doesn't know any more.
you must send a request to each server individually, the same as you would to find all servers on a lan (just unicast instead of broadcast)
the s2m server-shutdown message is open to exploitation and should be ignored by the master.
here's the list I know of (note that some of these are named by me, the frontend(quakespy) and the master(original) code are not public):
#define S2C_CHALLENGE 'c'
#define S2C_CONNECTION 'j'
#define A2A_PING 'k' // respond with an A2A_ACK
#define A2A_ACK 'l' // general acknowledgement without info
#define A2A_NACK 'm' // [+ comment] general failure
#define A2A_ECHO 'e' // for echoing
#define A2C_PRINT 'n' // print a message on client
#define S2M_HEARTBEAT 'a' // + serverinfo + userlist + fraglist
#define A2C_CLIENT_COMMAND 'B' // + command line
#define S2M_SHUTDOWN 'C'
#define C2M_MASTER_REQUEST 'c'
#define M2C_MASTER_REPLY 'd' // + \n + qw server port list
whether a client, frontend, server or master will respond to any of them is a different matter. :)