alibaba/canal · error · CanalClientException

unexpected packet type when ack is expected

Error message

unexpected packet type when ack is expected

What it means

Thrown after the client sends a CLIENTAUTHENTICATION packet: the server reply is parsed as an Ack packet but its type is not PacketType.ACK, meaning the auth response is malformed or the server sent an unexpected message.

Source

Thrown at admin/admin-web/src/main/java/com/alibaba/otter/canal/admin/connector/SimpleAdminConnector.java:102

                // encode passwd
                newPasswd = SecurityUtil.byte2HexStr(SecurityUtil.scramble411(passwd.getBytes(), seed.toByteArray()));
            }

            ClientAuth ca = ClientAuth.newBuilder()
                .setUsername(user != null ? user : "")
                .setPassword(ByteString.copyFromUtf8(newPasswd != null ? newPasswd : ""))
                .setNetReadTimeout(idleTimeout)
                .setNetWriteTimeout(idleTimeout)
                .build();
            writeWithHeader(Packet.newBuilder()
                .setType(PacketType.CLIENTAUTHENTICATION)
                .setBody(ca.toByteString())
                .build()
                .toByteArray());
            //
            Packet ack = Packet.parseFrom(readNextPacket());
            if (ack.getType() != PacketType.ACK) {
                throw new CanalClientException("unexpected packet type when ack is expected");
            }

            Ack ackBody = Ack.parseFrom(ack.getBody());
            if (ackBody.getCode() > 0) {
                throw new ServiceException("something goes wrong when doing authentication: " + ackBody.getMessage());
            }

            connected = true;
        } catch (IOException | NoSuchAlgorithmException e) {
            throw new ServiceException(e);
        }
    }

    @Override
    public void disconnect() throws ServiceException {
        if (!connected) {
            return;
        }

View on GitHub (pinned to 87be50e876)

Solutions

1. Confirm credentials (user/passwd) match the server config.
2. Ensure admin and server versions match (protocol expects ACK after CLIENTAUTHENTICATION).
3. Inspect server-side logs for the auth attempt to see what packet type it actually returned.
4. Verify network integrity (no truncating proxy) between admin web and server.

try {
    connector.connect(); // triggers CLIENTAUTHENTICATION + ACK read
} catch (CanalClientException e) {
    if (e.getMessage().contains("unexpected packet type when ack")) {
        // inspect server logs; reconnect; align versions
    }
    throw e;
}

When it happens

Trigger: After writeWithHeader(CLIENTAUTHENTICATION), readNextPacket() returns a Packet whose type != ACK. The server rejected/redirected the flow or sent an error in a non-ACK envelope.

Common situations: Server-side auth failure returned as a non-ACK packet; mid-handshake disconnect then reconnect; protocol version mismatch surfacing later than the handshake; network corruption truncating the packet.

Related errors

• unsupported version at this client.
• expect handshake but found other type.
• something goes wrong when doing authentication: {}
• end of stream when reading header
• auth : {} is failed

AI-assisted analysis of alibaba/canal@87be50e876 (2026-08-14). Data as JSON: /api/errors/e8435f98311e8f1e. Report an issue: GitHub.