{"record":{"id":"5a6d7e55e5766e3a","repo":"cloudflare/cloudflared","slug":"unknown-protocol-v","errorCode":null,"errorMessage":"unknown protocol %v","messagePattern":"unknown protocol (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"tunnelrpc/quic/cloudflared_server.go","lineNumber":48,"sourceCode":"\t\tconfigManager:   configManager,\n\t\tresponseTimeout: responseTimeout,\n\t}\n}\n\n// Serve executes the defined handlers in ServerStream on the provided stream if it is a proper RPC stream with the\n// correct preamble protocol signature.\nfunc (s *CloudflaredServer) Serve(ctx context.Context, stream io.ReadWriteCloser) error {\n\tsignature, err := determineProtocol(stream)\n\tif err != nil {\n\t\treturn err\n\t}\n\tswitch signature {\n\tcase dataStreamProtocolSignature:\n\t\treturn s.handleRequest(ctx, &RequestServerStream{stream})\n\tcase rpcStreamProtocolSignature:\n\t\treturn s.handleRPC(ctx, stream)\n\tdefault:\n\t\treturn fmt.Errorf(\"unknown protocol %v\", signature)\n\t}\n}\n\nfunc (s *CloudflaredServer) handleRPC(ctx context.Context, stream io.ReadWriteCloser) error {\n\tctx, cancel := context.WithTimeout(ctx, s.responseTimeout)\n\tdefer cancel()\n\ttransport := tunnelrpc.SafeTransport(stream)\n\tdefer transport.Close()\n\n\tmain := pogs.CloudflaredServer_ServerToClient(s.sessionManager, s.configManager)\n\trpcConn := tunnelrpc.NewServerConn(transport, main.Client)\n\tdefer rpcConn.Close()\n\n\t// We ignore the errors here because if cloudflared fails to handle a request, we will just move on.\n\tselect {\n\tcase <-rpcConn.Done():\n\tcase <-ctx.Done():\n\t}","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/tunnelrpc/quic/cloudflared_server.go#L30-L66","documentation":"CloudflaredServer.Serve reads the 6-byte protocol signature from an incoming QUIC stream and dispatches on it. If the signature matches neither the data-stream nor RPC-stream signature, the server returns this error because it cannot identify the protocol.","triggerScenarios":"A client opens a QUIC stream to CloudflaredServer and writes a first payload whose signature bytes match neither dataStreamProtocolSignature (0x0A36CD12A13E) nor rpcStreamProtocolSignature (0x52BB825CDB65).","commonSituations":"See trigger scenarios.","solutions":["Ensure client and server run compatible cloudflared versions (update both).","Confirm the client is actually a cloudflared transport and not other traffic pointed at the tunnel port.","Re-establish the connection; a garbled first packet is transient."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"var sig protocolSignature\nif _, err := io.ReadFull(r, sig[:]); err != nil { return err }\nif sig != dataStreamProtocolSignature && sig != rpcStreamProtocolSignature {\n    return fmt.Errorf(\"unknown protocol %v\", sig)\n}","typeGuard":"func knownSignature(s protocolSignature) bool {\n    return s == dataStreamProtocolSignature || s == rpcStreamProtocolSignature\n}","tryCatchPattern":null,"preventionTips":["Pin matching cloudflared versions on both ends of a tunnel","Only point cloudflared-capable clients at the muxer port","Log the raw signature bytes on dispatch failure to diagnose skew"],"tags":["protocol","quic","handshake","version-skew"],"backgroundTag":"unknown-protocol","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}