{"record":{"id":"a43226817ce8cf84","repo":"shadow1ng/fscan","slug":"unexpected-oracle-packet-type-d","errorCode":null,"errorMessage":"unexpected oracle packet type %d","messagePattern":"unexpected oracle packet type (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"plugins/services/oracle_raw.go","lineNumber":216,"sourceCode":"\t\tif s.version >= 315 {\n\t\t\ts.sessionDataUnit = binary.BigEndian.Uint32(p.raw[32:36])\n\t\t\ts.transportDataUnit = binary.BigEndian.Uint32(p.raw[36:40])\n\t\t}\n\t\tif s.transportDataUnit < s.sessionDataUnit {\n\t\t\ts.sessionDataUnit = s.transportDataUnit\n\t\t}\n\t\ts.acfl0 = p.raw[22]\n\t\ts.acfl1 = p.raw[23]\n\t\tif s.version >= 315 {\n\t\t\ts.handshakeComplete = true\n\t\t}\n\t\treturn nil\n\tcase oraclePacketRefuse:\n\t\treturn oracleRefuseError(p.raw)\n\tcase oraclePacketRedirect:\n\t\treturn errors.New(\"oracle redirect is not supported by lightweight auth\")\n\tdefault:\n\t\treturn fmt.Errorf(\"unexpected oracle packet type %d\", p.typ)\n\t}\n}\n\nfunc oracleConnectData(host string, port int, serviceName string) string {\n\taddress := fmt.Sprintf(\"(ADDRESS=(PROTOCOL=tcp)(HOST=%s)(PORT=%d))\", host, port)\n\tconnectData := \"(CONNECT_DATA=(SERVICE_NAME=\" + serviceName + \"))\"\n\treturn \"(DESCRIPTION=\" + address + connectData + \")\"\n}\n\ntype oraclePacket struct {\n\ttyp  uint8\n\tflag uint8\n\traw  []byte\n\tdata []byte\n}\n\nfunc (s *oracleSession) readPacket() (*oraclePacket, error) {\n\theader := make([]byte, 8)","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/oracle_raw.go#L198-L234","documentation":"When the TNS session receives a packet whose type is not Accept, Refuse, or Redirect, connect reports it via 'unexpected oracle packet type %d'. The raw protocol layer only understands these three response types during connection setup, so anything else means the peer is not behaving like an Oracle listener.","triggerScenarios":"oracleRawAuth -> connect reads a packet after sending the TNS CONNECT data and its type byte is outside the known set (oraclePacketAccept/Refuse/Redirect).","commonSituations":"Target port is not Oracle (HTTP or SSH server echoing bytes); a proxy answers with its own protocol; corrupt stream desynchronizes packet framing so a payload byte is read as a type.","solutions":["Verify the target actually runs an Oracle listener on that port","Check for port forwarding/proxy that injects non-TNS bytes","Re-sync the parser — ensure prior reads consumed exactly the packet length (see invalid oracle packet length handling)","Add the unknown type's numeric value to diagnostics when reporting"],"exampleFix":"// before\ndefault:\n    return fmt.Errorf(\"unexpected oracle packet type %d\", p.typ)\n// after\ndefault:\n    return fmt.Errorf(\"unexpected oracle packet type %d (raw % x)\", p.typ, p.raw)","handlingStrategy":"validation","validationCode":"// pre-verify the port speaks TNS before protocol work\ntn, err := net.DialTimeout(\"tcp\", addr, 3*time.Second)\nif err != nil { return err }\n// optionally send an empty TNS probe and check for a recognizable reply","typeGuard":"func isKnownOraclePacket(typ byte) bool {\n    return typ == oraclePacketAccept || typ == oraclePacketRefuse || typ == oraclePacketRedirect\n}","tryCatchPattern":"if err := s.connect(ctx, host, port, svc); err != nil {\n    if strings.Contains(err.Error(), \"unexpected oracle packet type\") {\n        return ErrNotOracleListener // classify target as non-Oracle, skip\n    }\n    return err\n}","preventionTips":["Verify the target service fingerprint before TNS parsing","Never continue parsing after a framing error — reconnect to resynchronize","Log the raw packet bytes when an unknown type appears"],"tags":["oracle","tns","protocol-violation"],"backgroundTag":"unexpected-api-response-shape","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}