{"record":{"id":"5356c54dfbc259a0","repo":"slackhq/nebula","slug":"errpackettooshort-5356c5","errorCode":"ErrPacketTooShort","errorMessage":"packet is too short","messagePattern":"packet is too short","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"outside.go","lineNumber":311,"sourceCode":"\t\t\t\t\t\"newAddr\", via.UdpAddr,\n\t\t\t\t)\n\t\t\t}\n\t\t\treturn\n\t\t}\n\n\t\thostinfo.logger(f.l).Info(\"Host roamed to new udp ip/port.\",\n\t\t\t\"udpAddr\", curRemote,\n\t\t\t\"newAddr\", via.UdpAddr,\n\t\t)\n\t\thostinfo.lastRoam = time.Now()\n\t\thostinfo.lastRoamRemote = curRemote\n\t\thostinfo.SetRemote(via.UdpAddr)\n\t}\n\n}\n\nvar (\n\tErrPacketTooShort          = errors.New(\"packet is too short\")\n\tErrUnknownIPVersion        = errors.New(\"packet is an unknown ip version\")\n\tErrIPv4InvalidHeaderLength = errors.New(\"invalid ipv4 header length\")\n\tErrIPv4PacketTooShort      = errors.New(\"ipv4 packet is too short\")\n\tErrIPv6PacketTooShort      = errors.New(\"ipv6 packet is too short\")\n)\n\n// newPacket validates and parses the interesting bits for the firewall out of the ip and sub protocol headers\nfunc newPacket(data []byte, incoming bool, fp *firewall.ParsedPacket) error {\n\t// fp is reused across packets; reset the parse byproducts so an early-error return cannot\n\t// leak the previous packet's offsets.\n\tfp.IPHdrLen = 0\n\tfp.FragAny = false\n\tif len(data) < 1 {\n\t\treturn ErrPacketTooShort\n\t}\n\n\tversion := int((data[0] >> 4) & 0x0f)\n\tswitch version {","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/outside.go#L293-L329","documentation":"ErrPacketTooShort (declared in handshake/errors.go as \"packet too short\" and in outside.go as \"packet is too short\") is returned when a received packet is shorter than the minimal header length required to parse it — either the handshake header (machine.go) or the minimum firewall packet length.","triggerScenarios":"ProcessPacket/newPacket receives a packet shorter than header.Len (handshake/machine.go:208) or the minimal packet length (outside.go:311).","commonSituations":"UDP payloads truncated by MTU issues or middleboxes, garbage/scanner traffic hitting the nebula port, version mismatch causing header length misinterpretation.","solutions":["Capture the traffic hitting the port and identify the source of malformed packets.","Check for NAT/firewall middleboxes truncating UDP payloads.","Confirm both peers run compatible nebula versions with the same header layout."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(packet) < handshake.HeaderLen {\n    // reject before calling ProcessPacket\n    return errors.New(\"packet below minimum handshake header size\")\n}","typeGuard":null,"tryCatchPattern":"p, h, err := m.ProcessPacket(packet)\nif errors.Is(err, handshake.ErrPacketTooShort) {\n    // log source addr and drop\n}","preventionTips":["Firewall the nebula UDP port to reduce scanner noise.","Check middleboxes for UDP payload truncation.","Keep peer binaries version-compatible."],"tags":["packet-parsing","malformed-packet","network"],"backgroundTag":"packet-too-short","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}