{"record":{"id":"1ce707a0c69cc9e8","repo":"shadow1ng/fscan","slug":"service-not-identified-1ce707","errorCode":null,"errorMessage":"service_not_identified","messagePattern":"service_not_identified","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/rsync.go","lineNumber":383,"sourceCode":"\n\tvar banner string\n\n\tif strings.Contains(responseStr, \"@RSYNCD\") {\n\t\tlines := strings.Split(responseStr, \"\\n\")\n\t\tfor _, line := range lines {\n\t\t\tif strings.HasPrefix(line, \"@RSYNCD:\") {\n\t\t\t\tbanner = i18n.Tr(\"rsync_service_info\", strings.TrimSpace(line))\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif banner == \"\" {\n\t\t\tbanner = i18n.GetText(\"rsync_file_sync_service\")\n\t\t}\n\t} else {\n\t\treturn &ScanResult{\n\t\t\tSuccess: false,\n\t\t\tService: \"rsync\",\n\t\t\tError:   fmt.Errorf(\"%s\", i18n.Tr(\"service_not_identified\", \"Rsync\")),\n\t\t}\n\t}\n\n\tsession.LogSuccess(i18n.Tr(\"rsync_service\", target, banner))\n\n\treturn &ScanResult{\n\t\tSuccess: true,\n\t\tType:    plugins.ResultTypeService,\n\t\tService: \"rsync\",\n\t\tBanner:  banner,\n\t}\n}\n\nfunc readRsyncLine(conn interface {\n\tRead([]byte) (int, error)\n}, max int) (string, error) {\n\tvar line strings.Builder\n\tvar b [1]byte","sourceCodeStart":365,"sourceCodeEnd":401,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/rsync.go#L365-L401","documentation":"identifyService reaches the branch where the banner could not be classified as an rsync service. If the probe response does not match the expected rsync banner patterns, the plugin returns service_not_identified (parameterized with \"Rsync\"), meaning the port answered but was not confirmed as rsync, so the module refuses to continue.","triggerScenarios":"After connecting in identifyService, the banner/response fails all rsync pattern checks and falls into the else branch at rsync.go:383, raising i18n.Tr(\"service_not_identified\", \"Rsync\").","commonSituations":"A different service (FTP, HTTP, custom TCP app) on the scanned port; an rsync daemon behind a wrapper that alters the greeting; SSL/TLS-wrapped rsync presenting a binary handshake; proxy interception mangling the banner.","solutions":["Verify what actually listens on the port (nmap -sV or manual banner grab) before including it as an rsync target.","If the service is TLS-wrapped rsync, scan it with the appropriate TLS-enabled module or plain port.","Exclude the port from rsync scan targets if it belongs to another service.","Check for middleware/proxies rewriting the @RSYNCD greeting and connect directly to the daemon."],"exampleFix":"// before (port hosts HTTP)\ntarget := \"10.0.0.5:8080\" // service_not_identified: Rsync\n// after\ntarget := \"10.0.0.5:873\" // banner \"@RSYNCD 31.0\" identified","handlingStrategy":"validation","validationCode":"conn, _ := net.DialTimeout(\"tcp\", host+\":873\", 5*time.Second)\nbuf := make([]byte, 64)\nconn.SetReadDeadline(time.Now().Add(3 * time.Second))\nn, _ := conn.Read(buf)\nif !strings.HasPrefix(string(buf[:n]), \"@RSYNCD\") { /* not rsync: drop target */ }\nconn.Close()","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"service_not_identified\") {\n    // remove target from rsync module queue; route to generic banner grabber\n}","preventionTips":["Grab the banner manually (nmap -sV) before assigning a port to the rsync module.","Do not assume port 873 always runs rsync in shared hosting environments.","Exclude TLS-wrapped endpoints from plain-rsync scanning."],"tags":["rsync","service-discovery","banner","misconfiguration"],"backgroundTag":"resource-not-found","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}