bettercap/bettercap · error

failed to parse remote addr: %v

Error message

failed to parse remote addr: %v

What it means

Raised in getOriginalDst (macOS) when net.SplitHostPort cannot split the connection's remote address into host and port. This is a defensive guard on an address the kernel handed us; it only fires on a malformed remote address string, so in practice it indicates a corrupted or non-network connection rather than a configuration problem.

Source

Thrown at modules/ssh_proxy/ssh_origdst_darwin.go:28

	"strings"
)

// getOriginalDst retrieves the original destination for a redirected connection
// on macOS by querying the pf state table via `pfctl -s state`.
//
// When pf `rdr` redirects a connection, the state table contains entries like:
//   ALL tcp 192.168.1.50:54321 -> 192.168.1.100:22 -> 192.168.1.1:2222
//
// We look for the entry matching our connection's local+remote and extract
// the middle address (the original destination).
func getOriginalDst(conn net.Conn) (string, error) {
	localAddr := conn.LocalAddr().String()
	remoteAddr := conn.RemoteAddr().String()

	// Parse what we know about this connection
	remoteHost, _, err := net.SplitHostPort(remoteAddr)
	if err != nil {
		return "", fmt.Errorf("failed to parse remote addr: %v", err)
	}
	_, localPort, err := net.SplitHostPort(localAddr)
	if err != nil {
		return "", fmt.Errorf("failed to parse local addr: %v", err)
	}

	// Query pf state table
	out, err := exec.Command("pfctl", "-s", "state").CombinedOutput()
	if err != nil {
		return "", fmt.Errorf("pfctl -s state failed: %v (output: %s)", err, string(out))
	}

	// Parse state table looking for our connection
	// Format: ALL tcp <src> -> <original_dst> -> <rdr_dst>  ESTABLISHED:ESTABLISHED
	scanner := bufio.NewScanner(strings.NewReader(string(out)))
	for scanner.Scan() {
		line := scanner.Text()

View on GitHub (pinned to 8eca2820f3)

Solutions

1. Inspect the proxied connection's remote address for anomalies
2. Set ssh.address explicitly so original-destination detection is skipped

When it happens

Trigger: Thrown at modules/ssh_proxy/ssh_origdst_darwin.go:28 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of bettercap/bettercap@8eca2820f3 (2026-09-02). Data as JSON: /api/errors/fd94a5105de1632e. Report an issue: GitHub.