cloudflare/cloudflared · warning · errRPCStreamNotSupported

rpc protocol not supported

Error message

rpc protocol not supported

What it means

errRPCStreamNotSupported is the sentinel returned when the RPC stream signature arrives at a server that does not handle RPC streams (e.g., the data/request server). It signals a stream was demultiplexed to the wrong server type.

Source

Thrown at tunnelrpc/quic/protocol.go:20

import (
	"fmt"
	"io"
)

// protocolSignature defines the first 6 bytes of the stream, which is used to distinguish the type of stream. It
// ensures whoever performs a handshake does not write data before writing the metadata.
type protocolSignature [6]byte

var (
	// dataStreamProtocolSignature is a custom protocol signature for data stream
	dataStreamProtocolSignature = protocolSignature{0x0A, 0x36, 0xCD, 0x12, 0xA1, 0x3E}

	// rpcStreamProtocolSignature is a custom protocol signature for RPC stream
	rpcStreamProtocolSignature = protocolSignature{0x52, 0xBB, 0x82, 0x5C, 0xDB, 0x65}

	errDataStreamNotSupported = fmt.Errorf("data protocol not supported")
	errRPCStreamNotSupported  = fmt.Errorf("rpc protocol not supported")
)

type protocolVersion string

const (
	protocolV1 protocolVersion = "01"

	protocolVersionLength = 2
)

// determineProtocol reads the first 6 bytes from the stream to determine which protocol is spoken by the client.
// The protocols are magic byte arrays understood by both sides of the stream.
func determineProtocol(stream io.Reader) (protocolSignature, error) {
	signature, err := readSignature(stream)
	if err != nil {
		return protocolSignature{}, err
	}
	switch signature {

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Update cloudflared on both ends to matching versions.
2. Route RPC streams to the session/RPC server in the demultiplexer.
3. Reconnect to rule out a transiently corrupted signature read.

func isRPCStreamSig(s protocolSignature) bool { return s == rpcStreamProtocolSignature }

if err := requestServer.Serve(ctx, stream); errors.Is(err, errRPCStreamNotSupported) {
    // reroute stream to the RPC/session server
    return sessionServer.Serve(ctx, stream)
}

When it happens

Trigger: A QUIC stream presenting rpcStreamProtocolSignature (0x52BB825CDB65) reaches a Serve dispatch that only handles data streams — the mirror case of errDataStreamNotSupported.

Common situations: Version skew between cloudflared client and server demux logic; stream misrouted to the request server; corrupted handshake bytes accidentally matching the RPC signature.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• data protocol not supported
• invalid datagram type expected
• unsupported error type: %s
• ErrDatagramHeaderTooSmall
• ErrDatagramResponseMsgTooLargeMaximum

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/78c51d6c3103a14d. Report an issue: GitHub.