{"record":{"id":"87475936f51d35f3","repo":"netbirdio/netbird","slug":"invalid-destination-port-v","errorCode":null,"errorMessage":"invalid destination port: %v","messagePattern":"invalid destination port: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"client/cmd/trace.go","lineNumber":59,"sourceCode":"\nfunc tracePacket(cmd *cobra.Command, args []string) error {\n\tdirection := strings.ToLower(args[0])\n\tif direction != \"in\" && direction != \"out\" {\n\t\treturn fmt.Errorf(\"invalid direction: use 'in' or 'out'\")\n\t}\n\n\tprotocol := cmd.Flag(\"protocol\").Value.String()\n\tif protocol != \"tcp\" && protocol != \"udp\" && protocol != \"icmp\" {\n\t\treturn fmt.Errorf(\"invalid protocol: use tcp/udp/icmp\")\n\t}\n\n\tsport, err := cmd.Flags().GetUint16(\"sport\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid source port: %v\", err)\n\t}\n\tdport, err := cmd.Flags().GetUint16(\"dport\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid destination port: %v\", err)\n\t}\n\n\t// For TCP/UDP, generate random ephemeral port (49152-65535) if not specified\n\tif protocol != \"icmp\" {\n\t\tif sport == 0 {\n\t\t\tsport = uint16(rand.Intn(16383) + 49152)\n\t\t}\n\t\tif dport == 0 {\n\t\t\tdport = uint16(rand.Intn(16383) + 49152)\n\t\t}\n\t}\n\n\tvar tcpFlags *proto.TCPFlags\n\tif protocol == \"tcp\" {\n\t\tsyn, _ := cmd.Flags().GetBool(\"syn\")\n\t\tack, _ := cmd.Flags().GetBool(\"ack\")\n\t\tfin, _ := cmd.Flags().GetBool(\"fin\")\n\t\trst, _ := cmd.Flags().GetBool(\"rst\")","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/trace.go#L41-L77","documentation":"Thrown by tracePacket (client/cmd/trace.go:59). cmd.Flags().GetUint16(\"dport\") failed: the --dport value is not a parseable unsigned 16-bit integer (non-numeric or outside 0-65535). Identical mechanism to the source-port check two lines above; 0 means 'random ephemeral port' for tcp/udp.","triggerScenarios":"'netbird debug trace ... --dport 65536', '--dport https', or an empty value from an unset script variable.","commonSituations":"Passing service names (https, ssh) instead of numbers; arithmetic in scripts producing out-of-range values.","solutions":["Pass a decimal port in 0-65535, or omit --dport for a random ephemeral port","Validate script-supplied ports before building the command line"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if v, err := strconv.ParseUint(dportStr, 10, 16); err != nil || v > 65535 {\n    log.Fatalf(\"--dport must be 0-65535, got %q\", dportStr)\n}","typeGuard":"func isValidPort16(s string) bool {\n    v, err := strconv.ParseUint(s, 10, 16)\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Never pass service names (https, ssh) - numeric ports only","Boundary-test generated ports in scripts before invoking netbird"],"tags":["cli","validation","trace","port","user-input","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}