{"record":{"id":"f33e566bd3c1432c","repo":"shadow1ng/fscan","slug":"netbios-smb-session-read-failed-w","errorCode":null,"errorMessage":"netbios_smb_session_read_failed: %w","messagePattern":"netbios_smb_session_read_failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"plugins/services/netbios.go","lineNumber":255,"sourceCode":"\t\t0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,\n\t\t0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00,\n\t\t0x20, 0x00, 0x33, 0x00, 0x37, 0x00, 0x39, 0x00, 0x30, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,\n\t\t0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00,\n\t\t0x63, 0x00, 0x6B, 0x00, 0x20, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00,\n\t\t0x6E, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,\n\t\t0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00,\n\t\t0x33, 0x00, 0x20, 0x00, 0x35, 0x00, 0x2E, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00,\n\t}\n\n\t_, err = conn.Write(smbSessionSetup)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_session_send_failed\"), err)\n\t}\n\n\tresponse2 := make([]byte, 2048)\n\tn, err := conn.Read(response2)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_session_read_failed\"), err)\n\t}\n\n\treturn p.parseNetBIOSSession(response2[:n])\n}\n\n// parseNetBIOSNames 解析NetBIOS名称查询响应\nfunc (p *NetBIOSPlugin) parseNetBIOSNames(data []byte) (*NetBIOSInfo, error) {\n\tinfo := &NetBIOSInfo{Valid: false}\n\n\tif len(data) < 57 {\n\t\treturn info, fmt.Errorf(\"%s\", i18n.GetText(\"netbios_response_too_short\"))\n\t}\n\n\t// 获取名称记录数量\n\tnumNames := int(data[56])\n\tif numNames == 0 {\n\t\treturn info, fmt.Errorf(\"%s\", i18n.GetText(\"netbios_no_name_records\"))\n\t}","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/netbios.go#L237-L273","documentation":"This error occurs in queryNetBIOSSession when reading the SMB Session Setup response (response2) from the TCP 139 connection fails. The library wraps the net.Conn.Read error with the i18n message 'netbios_smb_session_read_failed'. The session-setup request was sent, but no reply arrived before the connection died or the deadline expired.","triggerScenarios":"Scan -> queryNetBIOSSession sends smbSessionSetup successfully, then conn.Read(response2) errors: EOF/reset because the server rejected the NTLM session setup and closed, or i/o timeout because SetDeadline(ModuleTimeout) elapsed without a response.","commonSituations":"Hosts requiring NTLMv2 or SMB signing that silently drop the NTLMSSP negotiate; auth-hardened Windows hosts closing the connection on anonymous session setup; packet loss on congested networks with a short ModuleTimeout; honeypots that accept writes but never respond.","solutions":["Increase config.ModuleTimeout() to give the host time to respond to session setup.","Treat EOF/reset after session setup as an auth-policy rejection and record the host as 'SMB present but session refused'.","Prefer probing SMB2/3 on port 445 for hosts that don't complete legacy NetBIOS session setup.","Inspect the wrapped error with errors.As(net.Error) to classify timeout vs connection reset."],"exampleFix":"// before\nresponse2 := make([]byte, 2048)\nn, err := conn.Read(response2)\nif err != nil {\n    return nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_session_read_failed\"), err)\n}\n\n// after\nresponse2 := make([]byte, 2048)\nn, err := conn.Read(response2)\nif err != nil {\n    var nerr net.Error\n    if errors.As(err, &nerr) && nerr.Timeout() {\n        return nil, fmt.Errorf(\"%s: session setup response timeout for %s\", i18n.GetText(\"netbios_smb_session_read_failed\"), host)\n    }\n    return nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_session_read_failed\"), err)\n}","handlingStrategy":"fallback","validationCode":"// only read if the write succeeded and the deadline still has headroom\nif time.Until(deadline) <= 0 {\n    return fmt.Errorf(\"deadline already expired before reading session setup response\")\n}","typeGuard":"func classifySessionReadErr(err error) string {\n    var nerr net.Error\n    switch {\n    case errors.As(err, &nerr) && nerr.Timeout():\n        return \"timeout\"\n    case errors.Is(err, io.EOF), errors.Is(err, syscall.ECONNRESET):\n        return \"closed-by-peer\"\n    default:\n        return \"other\"\n    }\n}","tryCatchPattern":"response2 := make([]byte, 2048)\nn, err := conn.Read(response2)\nif err != nil {\n    if classifySessionReadErr(err) != \"other\" {\n        // fall back to names-only info gathered via UDP 137\n        return p.queryNetBIOSNames(host, session.Config, session.State)\n    }\n    return nil, fmt.Errorf(\"%s: %w\", i18n.GetText(\"netbios_smb_session_read_failed\"), err)\n}","preventionTips":["Fall back to the UDP 137 names query (queryNetBIOSNames) when the session flow fails.","Increase ModuleTimeout; NTLM session setup responses can be slow on loaded hosts.","Record 'session refused' hosts separately; they often have auth policies (NTLMv2-only, signing required).","Retry once before classifying a host as unreachable."],"tags":["network","netbios","smb","ntlm","timeout"],"backgroundTag":"request-timeout","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}