XTLS/Xray-core · error

syscall error: {err}

Error message

syscall error: {err}

What it means

Returned by getTransportTable when the Win32 GetExtendedTcpTable/GetExtendedUDPTable syscall invoked via syscall.Syscall6 fails with an error code other than 0 and ERROR_INSUFFICIENT_BUFFER. The numeric Windows error code is embedded in the message.

Source

Thrown at common/net/find_process_windows.go:216

		ip:       ip,
		ipSize:   ipSize,
		pid:      pid,
		tcpState: tcpState,
	}
}

func getTransportTable(fn uintptr, family int, class int) ([]byte, error) {
	for size, buf := uint32(8), make([]byte, 8); ; {
		ptr := unsafe.Pointer(&buf[0])
		err, _, _ := syscall.Syscall6(fn, 6, uintptr(ptr), uintptr(unsafe.Pointer(&size)), 0, uintptr(family), uintptr(class), 0)

		switch err {
		case 0:
			return buf, nil
		case uintptr(syscall.ERROR_INSUFFICIENT_BUFFER):
			buf = make([]byte, size)
		default:
			return nil, errors.New("syscall error: ", int(err))
		}
	}
}

func readNativeUint32(b []byte) uint32 {
	return *(*uint32)(unsafe.Pointer(&b[0]))
}

func getExecPathFromPID(pid uint32) (string, error) {
	// kernel process starts with a colon in order to distinguish with normal processes
	switch pid {
	case 0:
		// reserved pid for system idle process
		return ":System Idle Process", nil
	case 4:
		// reserved pid for windows kernel image
		return ":System", nil
	}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Decode the numeric code in the message against the Windows System Error Codes (e.g. 87 = ERROR_INVALID_PARAMETER) to identify the cause
2. Verify the network ('tcp'/'udp') and address family passed to the lookup are valid combinations
3. If memory-related, reduce concurrent process-lookup calls or snapshot less frequently

allowed := map[string]bool{"tcp": true, "udp": true}
if !allowed[network] { return errors.New("bad network for lookup") }

if err != nil {
    code := parseTrailingInt(err.Error()) // extract Windows error code
    log.Warn("transport table syscall failed: code=", code)
    return 0, err
}

When it happens

Trigger: The underlying Windows API returns e.g. ERROR_INVALID_PARAMETER (87) from a wrong family/class combination, or ERROR_NOT_ENOUGH_MEMORY if the realloc loop cannot satisfy the requested buffer size on a busy socket table.

Common situations: Passing an unexpected family/class argument (invalid network type or family), severe memory pressure, or Windows API behavior differences across versions. Rare in practice; the retry loop already handles the common insufficient-buffer case.

Related errors

• invalid IP address
• not found
• LoadLibrary iphlpapi.dll failed
• failed to determine if address is local: {err}
• LRU size is bigger than subnet size

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/2725973cb0aa87a0. Report an issue: GitHub.