{"record":{"id":"3755d94bf5af67a9","repo":"shadow1ng/fscan","slug":"netbios-smb-negotiate-read-failed-w","errorCode":null,"errorMessage":"netbios_smb_negotiate_read_failed: %w","messagePattern":"netbios_smb_negotiate_read_failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/netbios.go","lineNumber":223,"sourceCode":"\t\t0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,\n\t\t0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4E, 0x45, 0x54, 0x57, 0x4F,\n\t\t0x52, 0x4B, 0x20, 0x50, 0x52, 0x4F, 0x47, 0x52, 0x41, 0x4D, 0x20, 0x31, 0x2E, 0x30, 0x00, 0x02,\n\t\t0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x31, 0x2E, 0x30, 0x00, 0x02, 0x57, 0x69, 0x6E, 0x64, 0x6F,\n\t\t0x77, 0x73, 0x20, 0x66, 0x6F, 0x72, 0x20, 0x57, 0x6F, 0x72, 0x6B, 0x67, 0x72, 0x6F, 0x75, 0x70,\n\t\t0x73, 0x20, 0x33, 0x2E, 0x31, 0x61, 0x00, 0x02, 0x4C, 0x4D, 0x31, 0x2E, 0x32, 0x58, 0x30, 0x30,\n\t\t0x32, 0x00, 0x02, 0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x32, 0x2E, 0x31, 0x00, 0x02, 0x4E, 0x54,\n\t\t0x20, 0x4C, 0x4D, 0x20, 0x30, 0x2E, 0x31, 0x32, 0x00,\n\t}\n\n\t_, err = conn.Write(smbNegotiate1)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_negotiate_send_failed\"), err)\n\t}\n\n\tresponse1 := make([]byte, 1024)\n\t_, err = conn.Read(response1)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_negotiate_read_failed\"), err)\n\t}\n\n\t// 发送Session Setup请求\n\tsmbSessionSetup := []byte{\n\t\t0x00, 0x00, 0x01, 0x0A, 0xFF, 0x53, 0x4D, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8,\n\t\t0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,\n\t\t0x00, 0x00, 0x40, 0x00, 0x0C, 0xFF, 0x00, 0x0A, 0x01, 0x04, 0x41, 0x32, 0x00, 0x00, 0x00, 0x00,\n\t\t0x00, 0x00, 0x00, 0x4A, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD4, 0x00, 0x00, 0xA0, 0xCF, 0x00, 0x60,\n\t\t0x48, 0x06, 0x06, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x02, 0xA0, 0x3E, 0x30, 0x3C, 0xA0, 0x0E, 0x30,\n\t\t0x0C, 0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x02, 0x0A, 0xA2, 0x2A, 0x04,\n\t\t0x28, 0x4E, 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x82, 0x08,\n\t\t0xA2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\n\t\t0x00, 0x05, 0x02, 0xCE, 0x0E, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00,\n\t\t0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,\n\t\t0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00,\n\t\t0x20, 0x00, 0x33, 0x00, 0x37, 0x00, 0x39, 0x00, 0x30, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,\n\t\t0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00,\n\t\t0x63, 0x00, 0x6B, 0x00, 0x20, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00,","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/netbios.go#L205-L241","documentation":"This error occurs in queryNetBIOSSession when reading the SMB negotiate response (response1) from the TCP 139 connection fails. The library wraps the net.Conn.Read error with the i18n message 'netbios_smb_negotiate_read_failed'. Typically the remote host closed the connection or the read deadline expired without any SMB response arriving.","triggerScenarios":"Scan -> queryNetBIOSSession writes smbNegotiate1 successfully, then conn.Read(response1) returns an error: EOF because the host closed the socket after the negotiate packet, i/o timeout because SetDeadline(ModuleTimeout) elapsed, or connection reset.","commonSituations":"Hosts that accept TCP 139 but never answer SMB negotiate (misconfigured/teardrop firewalls, tcpwrappers tarpits); Windows hosts hardened with SMB signing or blocking legacy NetBIOS session service; slow hosts where ModuleTimeout is too aggressive; honeyports that accept and immediately close.","solutions":["Increase config.ModuleTimeout() to allow slow hosts time to answer the SMB negotiate.","Treat EOF/reset on read as 'not a NetBIOS/SMB host' and skip the host rather than retrying.","Verify SMB is enabled and reachable on the target (port 445 fallback or smb client test).","Check the wrapped error via errors.As for net.Error timeout to separate timeouts from resets."],"exampleFix":"// before\nresponse1 := make([]byte, 1024)\n_, err = conn.Read(response1)\nif err != nil {\n    return nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_negotiate_read_failed\"), err)\n}\n\n// after\nresponse1 := make([]byte, 1024)\n_, err = conn.Read(response1)\nif err != nil {\n    var nerr net.Error\n    if errors.As(err, &nerr) && nerr.Timeout() {\n        return nil, fmt.Errorf(\"host %s: no SMB negotiate response within deadline\", host)\n    }\n    return nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_negotiate_read_failed\"), err)\n}","handlingStrategy":"retry","validationCode":"// ensure the deadline allows a full round-trip before reading\ndeadline := time.Now().Add(session.Config.ModuleTimeout())\nif err := conn.SetDeadline(deadline); err != nil {\n    return fmt.Errorf(\"cannot set read deadline: %w\", err)\n}","typeGuard":"func isTimeoutOrReset(err error) bool {\n    var nerr net.Error\n    return errors.As(err, &nerr) && nerr.Timeout() ||\n        errors.Is(err, io.EOF) || errors.Is(err, syscall.ECONNRESET)\n}","tryCatchPattern":"response1 := make([]byte, 1024)\n_, err = conn.Read(response1)\nif err != nil {\n    var nerr net.Error\n    switch {\n    case errors.As(err, &nerr) && nerr.Timeout():\n        return nil, fmt.Errorf(\"no SMB negotiate response from %s within deadline\", host)\n    case errors.Is(err, io.EOF), errors.Is(err, syscall.ECONNRESET):\n        return nil, fmt.Errorf(\"%s closed connection during negotiate\", host)\n    default:\n        return nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_negotiate_read_failed\"), err)\n    }\n}","preventionTips":["Retry the negotiate once with a doubled timeout before giving up on a host.","Classify EOF/reset as 'not an SMB host' and continue the scan rather than failing.","Test with a known-good Windows host first to validate ModuleTimeout tuning.","Watch for firewalls that RST SMB traffic and whitelist the scanner."],"tags":["network","netbios","smb","tcp","timeout"],"backgroundTag":"request-timeout","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}