{"record":{"id":"8639727ae4b799a3","repo":"XTLS/Xray-core","slug":"not-found","errorCode":null,"errorMessage":"not found","messagePattern":"not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"common/net/find_process_windows.go","lineNumber":168,"sourceCode":"\t\t//     little endian: [ MSB LSB  0   0  ]   interpret as native uint32 is ((LSB<<8)|MSB)\n\t\t//       big  endian: [  0   0  MSB LSB ]   interpret as native uint32 is ((MSB<<8)|LSB)\n\t\t// so we need an syscall.Ntohs on the lower 16 bits after read the port as native uint32\n\t\tsrcPort := syscall.Ntohs(uint16(readNativeUint32(row[s.port : s.port+4])))\n\t\tif srcPort != port {\n\t\t\tcontinue\n\t\t}\n\n\t\tsrcIP, _ := netip.AddrFromSlice(row[s.ip : s.ip+s.ipSize])\n\t\tsrcIP = srcIP.Unmap()\n\t\t// windows binds an unbound udp socket to 0.0.0.0/[::] while first sendto\n\t\tif ip != srcIP && (!srcIP.IsUnspecified() || s.tcpState != -1) {\n\t\t\tcontinue\n\t\t}\n\n\t\tpid := readNativeUint32(row[s.pid : s.pid+4])\n\t\treturn pid, nil\n\t}\n\treturn 0, errors.New(\"not found\")\n}\n\nfunc newSearcher(network Network, family AddressFamily) *searcher {\n\tvar itemSize, port, ip, ipSize, pid int\n\ttcpState := -1\n\tswitch network {\n\tcase Network_TCP:\n\t\tif family == AddressFamilyIPv4 {\n\t\t\t// struct MIB_TCPROW_OWNER_PID\n\t\t\titemSize, port, ip, ipSize, pid, tcpState = 24, 8, 4, 4, 20, 0\n\t\t}\n\t\tif family == AddressFamilyIPv6 {\n\t\t\t// struct MIB_TCP6ROW_OWNER_PID\n\t\t\titemSize, port, ip, ipSize, pid, tcpState = 56, 20, 0, 16, 52, 48\n\t\t}\n\tcase Network_UDP:\n\t\tif family == AddressFamilyIPv4 {\n\t\t\t// struct MIB_UDPROW_OWNER_PID","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/net/find_process_windows.go#L150-L186","documentation":"Returned by the Windows process searcher after it walked the full MIB TCP/UDP owner table without finding a row whose local address matches the queried IP and port. It means no live socket in that transport table corresponds to the (ip, port) pair at the moment of the snapshot.","triggerScenarios":"Calling process lookup for a connection that already closed (TIME_WAIT/closed rows with tcpState filtering), a UDP socket whose row is bound to 0.0.0.0 but the code requires a specific IP (or vice versa via the tcpState != -1 condition), or an IPv4/IPv6 family mismatch between the query and the table.","commonSituations":"Race between connection teardown and lookup (very common with short-lived UDP/TCP), sockets bound to wildcard addresses, or querying an IPv4 address while only the IPv6 table was fetched.","solutions":["Treat 'not found' as an expected, non-fatal result: log at debug level and skip process attribution","Retry the lookup once after a short delay if the connection was just created","Verify the network family (AF_INET vs AF_INET6) matches the IP you query"],"exampleFix":"// before\npid, err := findProcess(network, ip, port)\nif err != nil { return err }\n\n// after\npid, err := findProcess(network, ip, port)\nif err != nil {\n    if strings.Contains(err.Error(), \"not found\") {\n        pid = 0 // unknown process, continue\n    } else {\n        return err\n    }\n}","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"pid, err := findPid(network, ip, port)\nif err != nil {\n    pid = 0 // process unknown; not an error condition\n    log.Debug(\"process not found for \", ip, \":\", port)\n}","preventionTips":["Treat not-found as expected for racing teardown","Match address family before querying","One short retry for just-created sockets"],"tags":["windows","process-lookup","race-condition","network"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}