cloudflare/cloudflared · warning · errDataStreamNotSupported

data protocol not supported

Error message

data protocol not supported

What it means

The QUIC session server only serves RPC streams; when an incoming stream presents the data-stream protocol signature it immediately returns errDataStreamNotSupported. This is a deliberate, sentinel refusal: data streams are handled by a different server (the request server), not the session RPC server.

Source

Thrown at tunnelrpc/quic/protocol.go:19

package quic

import (
	"fmt"
	"io"
)

// protocolSignature defines the first 6 bytes of the stream, which is used to distinguish the type of stream. It
// ensures whoever performs a handshake does not write data before writing the metadata.
type protocolSignature [6]byte

var (
	// dataStreamProtocolSignature is a custom protocol signature for data stream
	dataStreamProtocolSignature = protocolSignature{0x0A, 0x36, 0xCD, 0x12, 0xA1, 0x3E}

	// rpcStreamProtocolSignature is a custom protocol signature for RPC stream
	rpcStreamProtocolSignature = protocolSignature{0x52, 0xBB, 0x82, 0x5C, 0xDB, 0x65}

	errDataStreamNotSupported = fmt.Errorf("data protocol not supported")
	errRPCStreamNotSupported  = fmt.Errorf("rpc protocol not supported")
)

type protocolVersion string

const (
	protocolV1 protocolVersion = "01"

	protocolVersionLength = 2
)

// determineProtocol reads the first 6 bytes from the stream to determine which protocol is spoken by the client.
// The protocols are magic byte arrays understood by both sides of the stream.
func determineProtocol(stream io.Reader) (protocolSignature, error) {
	signature, err := readSignature(stream)
	if err != nil {
		return protocolSignature{}, err
	}

View on GitHub (pinned to 2253eeeb25)

Solutions

  1. Update cloudflared on both ends so stream demultiplexing matches.
  2. Ensure data streams are sent to the request/stream server, not the session server.
  3. Reconnect; if persistent, report a version-mismatch between client and edge.
Defensive patterns

Strategy: fallback

Type guard

func isDataStreamSig(s protocolSignature) bool { return s == dataStreamProtocolSignature }

Try / catch

if err := sessionServer.Serve(ctx, stream); errors.Is(err, errDataStreamNotSupported) {
    // reroute stream to the request/stream server
    return requestServer.Serve(ctx, stream)
}

Prevention

When it happens

Trigger: A QUIC stream with dataStreamProtocolSignature (0x0A36CD12A13E) reaches the session server's Serve dispatch (session_server.go), which only accepts rpcStreamProtocolSignature.

Common situations: Client demultiplexing bug sending a data stream to the session server; version skew where the client expects data streams on this server; misrouted stream after reconnect.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/f1293f06b92b8aed. Report an issue: GitHub.