bettercap/bettercap · error

could not find original destination in pf state table for %s

Error message

could not find original destination in pf state table for %s -> %s

What it means

Raised in getOriginalDst (macOS) after parsing the pf state table when no entry matches the connection's remote->local pair or the candidate field does not look like host:port. The connection was not created by an pf rdr rule (or its state already expired), so the original destination cannot be recovered.

Source

Thrown at modules/ssh_proxy/ssh_origdst_darwin.go:79

				arrowPositions = append(arrowPositions, i)
			}
		}

		if len(arrowPositions) >= 2 {
			// The field before the first arrow is the source
			// The field between the two arrows is the original destination
			origDstIdx := arrowPositions[0] + 1
			if origDstIdx < len(fields) {
				origDst := fields[origDstIdx]
				// Validate it looks like host:port
				if _, _, err := net.SplitHostPort(origDst); err == nil {
					return origDst, nil
				}
			}
		}
	}

	return "", fmt.Errorf("could not find original destination in pf state table for %s -> %s", remoteAddr, localAddr)
}

View on GitHub (pinned to 8eca2820f3)

Solutions

1. Verify the pf rdr rule matches the proxied traffic
2. Set ssh.address explicitly to hardcode the upstream destination

When it happens

Trigger: Thrown at modules/ssh_proxy/ssh_origdst_darwin.go:79 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of bettercap/bettercap@8eca2820f3 (2026-09-02). Data as JSON: /api/errors/26901f37d8eccf68. Report an issue: GitHub.