netbirdio/netbird · warning

invalid destination port: %v

Error message

invalid destination port: %v

What it means

Thrown by tracePacket (client/cmd/trace.go:59). cmd.Flags().GetUint16("dport") failed: the --dport value is not a parseable unsigned 16-bit integer (non-numeric or outside 0-65535). Identical mechanism to the source-port check two lines above; 0 means 'random ephemeral port' for tcp/udp.

Source

Thrown at client/cmd/trace.go:59

func tracePacket(cmd *cobra.Command, args []string) error {
	direction := strings.ToLower(args[0])
	if direction != "in" && direction != "out" {
		return fmt.Errorf("invalid direction: use 'in' or 'out'")
	}

	protocol := cmd.Flag("protocol").Value.String()
	if protocol != "tcp" && protocol != "udp" && protocol != "icmp" {
		return fmt.Errorf("invalid protocol: use tcp/udp/icmp")
	}

	sport, err := cmd.Flags().GetUint16("sport")
	if err != nil {
		return fmt.Errorf("invalid source port: %v", err)
	}
	dport, err := cmd.Flags().GetUint16("dport")
	if err != nil {
		return fmt.Errorf("invalid destination port: %v", err)
	}

	// For TCP/UDP, generate random ephemeral port (49152-65535) if not specified
	if protocol != "icmp" {
		if sport == 0 {
			sport = uint16(rand.Intn(16383) + 49152)
		}
		if dport == 0 {
			dport = uint16(rand.Intn(16383) + 49152)
		}
	}

	var tcpFlags *proto.TCPFlags
	if protocol == "tcp" {
		syn, _ := cmd.Flags().GetBool("syn")
		ack, _ := cmd.Flags().GetBool("ack")
		fin, _ := cmd.Flags().GetBool("fin")
		rst, _ := cmd.Flags().GetBool("rst")

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Pass a decimal port in 0-65535, or omit --dport for a random ephemeral port
2. Validate script-supplied ports before building the command line

if v, err := strconv.ParseUint(dportStr, 10, 16); err != nil || v > 65535 {
    log.Fatalf("--dport must be 0-65535, got %q", dportStr)
}

func isValidPort16(s string) bool {
    v, err := strconv.ParseUint(s, 10, 16)
    return err == nil
}

When it happens

Trigger: 'netbird debug trace ... --dport 65536', '--dport https', or an empty value from an unset script variable.

Common situations: Passing service names (https, ssh) instead of numbers; arithmetic in scripts producing out-of-range values.

Related errors

• invalid source port: %v
• invalid direction: use 'in' or 'out'
• invalid protocol: use tcp/udp/icmp
• failed initializing log %v
• listen_port is required for TLS services

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/87475936f51d35f3. Report an issue: GitHub.