{"record":{"id":"56149f219a6322b7","repo":"projectdiscovery/nuclei","slug":"sending-over-udp-failed-to-s-v","errorCode":null,"errorMessage":"sending over UDP failed to %s: %v","messagePattern":"sending over UDP failed to (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/kerberos/sendtokdc.go","lineNumber":162,"sourceCode":"\t}\n\treturn nil, nil\n}\n\n// sendUDP sends bytes to connection over UDP.\nfunc sendUDP(conn *net.UDPConn, b []byte) ([]byte, error) {\n\tvar r []byte\n\tdefer func() {\n\t\t_ = conn.Close()\n\t}()\n\t_, err := conn.Write(b)\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"error sending to (%s): %v\", conn.RemoteAddr().String(), err)\n\t}\n\tudpbuf := make([]byte, 4096)\n\tn, _, err := conn.ReadFrom(udpbuf)\n\tr = udpbuf[:n]\n\tif err != nil {\n\t\treturn r, fmt.Errorf(\"sending over UDP failed to %s: %v\", conn.RemoteAddr().String(), err)\n\t}\n\tif len(r) < 1 {\n\t\treturn r, fmt.Errorf(\"no response data from %s\", conn.RemoteAddr().String())\n\t}\n\treturn r, nil\n}\n\n// sendTCP sends bytes to connection over TCP.\nfunc sendTCP(conn *net.TCPConn, b []byte) ([]byte, error) {\n\tdefer func() {\n\t\t_ = conn.Close()\n\t}()\n\tvar r []byte\n\t// RFC 4120 7.2.2 specifies the first 4 bytes indicate the length of the message in big endian order.\n\thb := make([]byte, 4)\n\tbinary.BigEndian.PutUint32(hb, uint32(len(b)))\n\tb = append(hb, b...)\n","sourceCodeStart":144,"sourceCodeEnd":180,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/kerberos/sendtokdc.go#L144-L180","documentation":"The UDP write succeeded but the subsequent ReadFrom failed. A read deadline of config.timeout seconds (default 5) is set before the exchange, so the usual cause is the deadline expiring with no reply, or ICMP port-unreachable being reflected back on the connected UDP socket as a read error.","triggerScenarios":"KDC not listening on UDP/88 (ICMP unreachable); packet loss on lossy links; reply arriving after the 5s deadline; middleboxes dropping UDP payloads of the Kerberos size.","commonSituations":"TCP-only KDC hardening; unreliable VPN links; oversized ticket replies lost to fragmentation; slow DCs under load missing the 5s window.","solutions":["Raise the client timeout above the 5s default","Confirm the KDC actually serves UDP/88, otherwise rely on the TCP path","Retry once for transient loss before concluding the KDC is unreachable"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  const resp = kerberos.SendToKDC(client, msg);\n} catch (e) {\n  // UDP read timed out or got ICMP-unreachable: raise the 5s default timeout or confirm the KDC serves UDP/88\n}","preventionTips":["Raise the client timeout for slow or remote KDCs","Check whether the KDC is TCP-only before relying on UDP replies"],"tags":["kerberos","udp","timeout","network"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}