{"record":{"id":"f176753216557e60","repo":"projectdiscovery/nuclei","slug":"failed-to-send-encryption-packet-w","errorCode":null,"errorMessage":"failed to send encryption packet: %w","messagePattern":"failed to send encryption packet: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/utils/telnetmini/telnet.go","lineNumber":104,"sourceCode":"\n// DetectEncryption detects if a telnet server supports encryption.\n// Based on Nmap's telnet-encryption.nse script functionality.\n// WARNING: The connection becomes unusable after calling this function\n// due to the encryption negotiation packets sent.\nfunc DetectEncryption(conn net.Conn, timeout time.Duration) (*EncryptionInfo, error) {\n\tif timeout == 0 {\n\t\ttimeout = 7 * time.Second\n\t}\n\n\t// Set connection timeout\n\t_ = conn.SetDeadline(time.Now().Add(timeout))\n\n\t// Send encryption negotiation packet (based on Nmap script)\n\t// FF FD 26 FF FB 26 = IAC DO ENCRYPT IAC WILL ENCRYPT\n\tencryptionPacket := []byte{IAC, DO, ENCRYPT, IAC, WILL, ENCRYPT}\n\t_, err := conn.Write(encryptionPacket)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to send encryption packet: %w\", err)\n\t}\n\n\t// Process server responses\n\toptions := make(map[int][]int)\n\tsupportsEncryption := false\n\tbanner := \"\"\n\n\t// Read responses until we get encryption info or timeout\n\tfor {\n\t\t_ = conn.SetReadDeadline(time.Now().Add(1 * time.Second))\n\t\tbuffer := make([]byte, 1024)\n\t\tn, err := conn.Read(buffer)\n\t\tif err != nil {\n\t\t\t// Timeout or connection closed, break\n\t\t\tbreak\n\t\t}\n\n\t\tif n > 0 {","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/utils/telnetmini/telnet.go#L86-L122","documentation":"In telnetmini's connection/negotiation phase (telnet.go:104), nuclei writes the 6-byte encryption probe IAC DO ENCRYPT / IAC WILL ENCRYPT (FF FD 26 FF FB 26) to start NTLM negotiation, after setting a deadline (default 7s). A write error — connection reset, network unreachable, deadline already exceeded — returns 'failed to send encryption packet: %w' wrapping the underlying net error.","triggerScenarios":"The TCP connection was established but died before/while writing: server RST immediately after accept (inetd rate limits, hosts.deny, fail2ban), a firewall that completes the handshake then kills data, a dialer whose context deadline expired so the first write fails, or a non-telnet service on port 23 that closes on binary data.","commonSituations":"Scanning ranges where port 23 is filtered by tarpalling middleboxes; targets protected by fail2ban/MaxStartups-style throttling when concurrency is high; probes against services that are not telnet (banner-grab time).","solutions":["Verify basic reachability independently: `nc -vz target 23` and a manual `telnet target` to see if the server tolerates negotiation","Reduce scan concurrency / add delay between connections — connection-limit resets are the most common cause","Retry the probe once after a short backoff; transient RSTs are common on throttled hosts","Check the wrapped error: i/o timeout points to the deadline (raise the timeout parameter), connection reset points to the server/firewall"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight the connection before writing the probe:\nconn.SetDeadline(time.Now().Add(timeout))\nif err := conn.SetWriteDeadline(time.Now().Add(2 * time.Second)); err != nil {\n    return nil, err\n}","typeGuard":null,"tryCatchPattern":"var resp []byte\nerr := backoff.Retry(func() error {\n    var e error\n    resp, e = telnetmini.NegotiateEncryption(conn, timeout)\n    if e != nil && strings.Contains(e.Error(), \"failed to send encryption packet\") {\n        return e // retryable: reset/throttle class of failure\n    }\n    return backoff.Permanent(e)\n}, backoff.WithMaxRetries(backoff.NewExponentialBackOff(), 2))","preventionTips":["Dial and write under the same explicit deadline; don't rely on OS defaults","Throttle parallel connections per host — fail2ban and inetd limits cause instant RSTs","Confirm port 23 speaks telnet with a banner grab before the NTLM probe","Classify the wrapped error: i/o timeout → raise timeout; ECONNRESET → server-side kill"],"tags":["telnet","network","connection-reset","timeout","firewall"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}