XTLS/Xray-core · warning

not found

Error message

not found

What it means

Returned by the Windows process searcher after it walked the full MIB TCP/UDP owner table without finding a row whose local address matches the queried IP and port. It means no live socket in that transport table corresponds to the (ip, port) pair at the moment of the snapshot.

Source

Thrown at common/net/find_process_windows.go:168

		//     little endian: [ MSB LSB  0   0  ]   interpret as native uint32 is ((LSB<<8)|MSB)
		//       big  endian: [  0   0  MSB LSB ]   interpret as native uint32 is ((MSB<<8)|LSB)
		// so we need an syscall.Ntohs on the lower 16 bits after read the port as native uint32
		srcPort := syscall.Ntohs(uint16(readNativeUint32(row[s.port : s.port+4])))
		if srcPort != port {
			continue
		}

		srcIP, _ := netip.AddrFromSlice(row[s.ip : s.ip+s.ipSize])
		srcIP = srcIP.Unmap()
		// windows binds an unbound udp socket to 0.0.0.0/[::] while first sendto
		if ip != srcIP && (!srcIP.IsUnspecified() || s.tcpState != -1) {
			continue
		}

		pid := readNativeUint32(row[s.pid : s.pid+4])
		return pid, nil
	}
	return 0, errors.New("not found")
}

func newSearcher(network Network, family AddressFamily) *searcher {
	var itemSize, port, ip, ipSize, pid int
	tcpState := -1
	switch network {
	case Network_TCP:
		if family == AddressFamilyIPv4 {
			// struct MIB_TCPROW_OWNER_PID
			itemSize, port, ip, ipSize, pid, tcpState = 24, 8, 4, 4, 20, 0
		}
		if family == AddressFamilyIPv6 {
			// struct MIB_TCP6ROW_OWNER_PID
			itemSize, port, ip, ipSize, pid, tcpState = 56, 20, 0, 16, 52, 48
		}
	case Network_UDP:
		if family == AddressFamilyIPv4 {
			// struct MIB_UDPROW_OWNER_PID

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Treat 'not found' as an expected, non-fatal result: log at debug level and skip process attribution
2. Retry the lookup once after a short delay if the connection was just created
3. Verify the network family (AF_INET vs AF_INET6) matches the IP you query

Example fix

// before
pid, err := findProcess(network, ip, port)
if err != nil { return err }

// after
pid, err := findProcess(network, ip, port)
if err != nil {
    if strings.Contains(err.Error(), "not found") {
        pid = 0 // unknown process, continue
    } else {
        return err
    }
}

pid, err := findPid(network, ip, port)
if err != nil {
    pid = 0 // process unknown; not an error condition
    log.Debug("process not found for ", ip, ":", port)
}

When it happens

Trigger: Calling process lookup for a connection that already closed (TIME_WAIT/closed rows with tcpState filtering), a UDP socket whose row is bound to 0.0.0.0 but the code requires a specific IP (or vice versa via the tcpState != -1 condition), or an IPv4/IPv6 family mismatch between the query and the table.

Common situations: Race between connection teardown and lookup (very common with short-lived UDP/TCP), sockets bound to wildcard addresses, or querying an IPv4 address while only the IPv6 table was fetched.

Related errors

• invalid IP address
• syscall error: {err}
• process not found for connection from ::: to :
• could not get process path for PID :
• connection for :: not found in

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/8639727ae4b799a3. Report an issue: GitHub.