{"record":{"id":"d456a41178e393be","repo":"XTLS/Xray-core","slug":"unexpected-network","errorCode":null,"errorMessage":"unexpected network ","messagePattern":"unexpected network ","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/mux/server.go","lineNumber":191,"sourceCode":"\t\t}\n\t}\n\terrors.LogInfo(ctx, \"received request for \", meta.Target)\n\t{\n\t\tmsg := &log.AccessMessage{\n\t\t\tTo:     meta.Target,\n\t\t\tStatus: log.AccessAccepted,\n\t\t\tReason: \"\",\n\t\t}\n\t\tif inbound := session.InboundFromContext(ctx); inbound != nil && inbound.Source.IsValid() {\n\t\t\tmsg.From = inbound.Source\n\t\t\tmsg.Email = inbound.User.Email\n\t\t}\n\t\tctx = log.ContextWithAccessMessage(ctx, msg)\n\t}\n\n\tif network := session.AllowedNetworkFromContext(ctx); network != net.Network_Unknown {\n\t\tif meta.Target.Network != network {\n\t\t\treturn errors.New(\"unexpected network \", meta.Target.Network) // it will break the whole Mux connection\n\t\t}\n\t}\n\n\tif meta.GlobalID != [8]byte{} { // MUST ignore empty Global ID\n\t\tmb, err := NewPacketReader(reader, &meta.Target).ReadMultiBuffer()\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tXUDPManager.Lock()\n\t\tx := XUDPManager.Map[meta.GlobalID]\n\t\tif x == nil {\n\t\t\tx = &XUDP{GlobalID: meta.GlobalID}\n\t\t\tXUDPManager.Map[meta.GlobalID] = x\n\t\t\tXUDPManager.Unlock()\n\t\t} else {\n\t\t\tif x.Status == Initializing { // nearly impossible\n\t\t\t\tXUDPManager.Unlock()\n\t\t\t\terrors.LogWarningInner(ctx, errors.New(\"conflict\"), \"XUDP hit \", meta.GlobalID)","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/mux/server.go#L173-L209","documentation":"The mux server received a SessionStatusNew frame whose target network (TCP or UDP) does not match the network restriction attached to the context (session.AllowedNetworkFromContext, set by inbound sniffing/routing rules). Because one mux connection carries all substreams, this mismatch breaks the entire Mux connection, not just the substream.","triggerScenarios":"An inbound or routing rule restricts the connection to, say, TCP only, but the client multiplexes a UDP request (or vice versa) over the same mux connection.","commonSituations":"Routing/inbound config with network constraints (e.g. \"network\": \"tcp\" on an inbound or a routing rule) combined with a client that enables mux and sends both TCP and UDP traffic; XUDP over a TCP-only inbound.","solutions":["Remove or widen the network restriction (set inbound/route rule \"network\" to \"tcp,udp\") if both transports are expected over mux.","Disable mux for UDP traffic on the client, or disable XUDP, so UDP never rides the constrained connection.","Add a separate outbound/inbound pair without the network restriction for the other transport.","Confirm the rule that sets the allowed network via routing logs before changing config."],"exampleFix":"// inbound config: allow both transports when mux is used\n// before\n\"inbounds\": [{ \"port\": 443, \"protocol\": \"vless\", \"settings\": { \"decryption\": \"none\" }, \"streamSettings\": { \"network\": \"tcp\" } }]\n// after\n\"inbounds\": [{ \"port\": 443, \"protocol\": \"vless\", \"settings\": { \"decryption\": \"none\" }, \"streamSettings\": { \"network\": \"tcp,udp\" } }]","handlingStrategy":"validation","validationCode":"// Before multiplexing, verify the transport is allowed by your inbound/route config:\nallowed := net.Network_TCP // example restriction\nif target.Network != allowed {\n    return fmt.Errorf(\"cannot mux %v over %v-only inbound\", target.Network, allowed)\n}","typeGuard":null,"tryCatchPattern":"if err := w.handleStatusNew(ctx, &meta, reader); err != nil {\n    if strings.Contains(err.Error(), \"unexpected network\") {\n        // config issue: relax the network restriction or stop muxing the other transport\n    }\n    return err // intentionally breaks the mux connection\n}","preventionTips":["Set inbound/route 'network' to 'tcp,udp' wherever mux is enabled.","Do not enable XUDP over inbounds restricted to one network.","Remember mux shares fate: one network-rejected substream drops every substream on that connection."],"tags":["mux","routing","config","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}