cloudflare/cloudflared · error

packet with tracing context should have at least %d bytes, g

Error message

packet with tracing context should have at least %d bytes, got %v

What it means

This error is thrown by extractTracingIdentity in quic/datagramv2.go when a datagram packet is supposed to carry a Cloudflare tracing identity suffix but is shorter than the fixed identity length. The function slices the last tracing.IdentityLength bytes off the packet as the tracing identity; if the packet is too small to contain both identity and payload, the split is impossible. It indicates a malformed packet that reached the datagram v2 handler (extractTracingIdentity is invoked from handlePacket).

Source

Thrown at quic/datagramv2.go:209

			Spans:           spans,
			TracingIdentity: tracingIdentity,
		}
	case DatagramTypeUDP:
		return fmt.Errorf("unexpected datagram type %d in handlePacket", msgType)
	default:
		return fmt.Errorf("unexpected datagram type %d", msgType)
	}
	select {
	case <-ctx.Done():
		return ctx.Err()
	case dm.packetDemuxChan <- demuxedPacket:
		return nil
	}
}

func extractTracingIdentity(pk []byte) (tracingIdentity []byte, payload []byte, err error) {
	if len(pk) < tracing.IdentityLength {
		return nil, nil, fmt.Errorf("packet with tracing context should have at least %d bytes, got %v", tracing.IdentityLength, pk)
	}
	tracingIdentity = pk[len(pk)-tracing.IdentityLength:]
	payload = pk[:len(pk)-tracing.IdentityLength]
	return tracingIdentity, payload, nil
}

type RawPacket packet.RawPacket

func (rw RawPacket) Type() DatagramV2Type {
	return DatagramTypeIP
}

func (rw RawPacket) Payload() []byte {
	return rw.Data
}

func (rw RawPacket) Metadata() []byte {
	return []byte{}

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Check len(packet) >= tracing.IdentityLength before invoking handlePacket/extractTracingIdentity and drop or reject short packets.
2. Verify the sending side appends the tracing identity trailer to every datagram (cloudflared/quic v2 protocol requirement).
3. Inspect the network path (NAT, proxy, MTU fragmentation) for packet truncation.
4. Log the offending packet length and peer address to identify the misbehaving client.

Example fix

// before
tracingIdentity, payload, err := extractTracingIdentity(rawPacket)
if err != nil { return err }
// after
if len(rawPacket) < tracing.IdentityLength {
    logger.Warn().Int("len", len(rawPacket)).Msg("dropping short datagram without tracing identity")
    return nil
}
tracingIdentity, payload, err := extractTracingIdentity(rawPacket)

if len(packet) < tracing.IdentityLength {
    return fmt.Errorf("packet too short for tracing identity: %d bytes", len(packet))
}

if err != nil {
    if strings.Contains(err.Error(), "should have at least") {
        logger.Warn().Int("len", len(packet)).Msg("dropping malformed datagram")
        return nil
    }
    return err
}

When it happens

Trigger: Calling handlePacket on a datagram whose total length is less than tracing.IdentityLength, e.g. a zero-length or truncated UDP payload, or a peer sending packets without the tracing-identity trailer appended.

Common situations: Truncated or corrupted UDP datagrams in transit; a client implementation that omits the tracing-identity trailer; a misconfigured proxy/load balancer stripping packet suffixes; test harnesses feeding hand-crafted packets that are too short.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• payload length is too large to be bundled in datagram
• invalid datagram type expected
• payload length is too small to fit the datagram header
• datagram provided is an invalid size
• datagram response message is an invalid size

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/e371f5ded512b5ab. Report an issue: GitHub.