{"record":{"id":"8f9c012f1dd9c314","repo":"shadow1ng/fscan","slug":"netbios-response-too-short","errorCode":null,"errorMessage":"netbios_response_too_short","messagePattern":"netbios_response_too_short","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"plugins/services/netbios.go","lineNumber":266,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_session_send_failed\"), err)\n\t}\n\n\tresponse2 := make([]byte, 2048)\n\tn, err := conn.Read(response2)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_session_read_failed\"), err)\n\t}\n\n\treturn p.parseNetBIOSSession(response2[:n])\n}\n\n// parseNetBIOSNames 解析NetBIOS名称查询响应\nfunc (p *NetBIOSPlugin) parseNetBIOSNames(data []byte) (*NetBIOSInfo, error) {\n\tinfo := &NetBIOSInfo{Valid: false}\n\n\tif len(data) < 57 {\n\t\treturn info, fmt.Errorf(\"%s\", i18n.GetText(\"netbios_response_too_short\"))\n\t}\n\n\t// 获取名称记录数量\n\tnumNames := int(data[56])\n\tif numNames == 0 {\n\t\treturn info, fmt.Errorf(\"%s\", i18n.GetText(\"netbios_no_name_records\"))\n\t}\n\n\tnameData := data[57:]\n\n\t// 服务类型映射\n\tuniqueNames := map[byte]string{\n\t\t0x00: \"WorkstationService\",\n\t\t0x03: \"Messenger Service\",\n\t\t0x06: \"RAS Server Service\",\n\t\t0x1F: \"NetDDE Service\",\n\t\t0x20: \"ServerService\",\n\t\t0x21: \"RAS Client Service\",","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/netbios.go#L248-L284","documentation":"This error is returned by parseNetBIOSNames when the UDP 137 name-query response is shorter than 57 bytes, the minimum size of a valid NetBIOS name service response header plus fixed fields (data[56] holds the name record count). The library returns an invalid NetBIOSInfo (Valid:false) with the i18n message 'netbios_response_too_short', meaning the reply cannot be parsed as a NBNS response.","triggerScenarios":"queryNetBIOSNames (or an anonymous UDP read handler) receives a response on the UDP 137 socket and passes it to parseNetBIOSNames with len(data) < 57: e.g., an ICMP port-unreachable payload, a truncated/duplicated datagram, an empty read, or a non-NBNS service replying on port 137.","commonSituations":"Scanning devices that reply on UDP 137 with junk (printers, IoT, load balancers); path MTU issues truncating large responses; NAT middleboxes sending ICMP-derived short packets; misconfigured hosts running unrelated UDP services on port 137.","solutions":["Check len(data) before calling parseNetBIOSNames and skip/ignore hosts returning short payloads instead of treating them as errors.","Validate the response looks like a NBNS reply (transaction ID and flags match the queryPacket) before parsing.","Ignore the error and continue scanning; a short response simply means the host is not a valid NetBIOS name server.","If responses are consistently truncated, check network path MTU/fragmentation between scanner and target."],"exampleFix":"// before\ninfo, err := p.queryNetBIOSNames(host, config, state)\n\n// after\nconn.SetReadDeadline(time.Now().Add(config.ModuleTimeout()))\nn, err := conn.Read(response)\nif err != nil || n < 57 {\n    // not a valid NBNS response; skip host\n    return nil, nil\n}\ninfo, err := p.parseNetBIOSNames(response[:n])","handlingStrategy":"validation","validationCode":"// validate the datagram before parsing\nfunc isPlausibleNBNSResponse(data []byte) bool {\n    return len(data) >= 57\n}\n\n// usage\nif !isPlausibleNBNSResponse(response[:n]) {\n    return nil, nil // not a NBNS reply; skip host silently\n}\ninfo, err := p.parseNetBIOSNames(response[:n])","typeGuard":"func hasMinNBNSLength(data []byte) bool {\n    return len(data) >= 57\n}","tryCatchPattern":"info, err := p.parseNetBIOSNames(data)\nif err != nil {\n    if strings.Contains(err.Error(), i18n.GetText(\"netbios_response_too_short\")) {\n        log.Printf(\"host sent short/invalid NBNS reply (%d bytes); skipping\", len(data))\n        return nil, nil\n    }\n    return nil, err\n}","preventionTips":["Always check len(data) >= 57 before parsing NBNS responses.","Match the NBNS transaction ID against the query packet to filter unrelated UDP replies.","Treat short replies as a normal 'not a NetBIOS host' outcome, not a scan failure.","Investigate MTU/fragmentation only if valid hosts' responses are consistently truncated."],"tags":["netbios","udp","protocol","parsing","scan"],"backgroundTag":"unexpected-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}