netbirdio/netbird · warning

invalid source port: %v

Error message

invalid source port: %v

What it means

Thrown by tracePacket (client/cmd/trace.go:55). cmd.Flags().GetUint16("sport") failed, which cobra/pflag reports when the --sport value cannot be parsed as an unsigned 16-bit integer - non-numeric text or a number outside 0-65535. Note 0 is valid and means 'pick a random ephemeral port'.

Source

Thrown at client/cmd/trace.go:55

	traceCmd.Flags().Bool("rst", false, "TCP RST flag")
	traceCmd.Flags().Bool("psh", false, "TCP PSH flag")
	traceCmd.Flags().Bool("urg", false, "TCP URG flag")
}

func tracePacket(cmd *cobra.Command, args []string) error {
	direction := strings.ToLower(args[0])
	if direction != "in" && direction != "out" {
		return fmt.Errorf("invalid direction: use 'in' or 'out'")
	}

	protocol := cmd.Flag("protocol").Value.String()
	if protocol != "tcp" && protocol != "udp" && protocol != "icmp" {
		return fmt.Errorf("invalid protocol: use tcp/udp/icmp")
	}

	sport, err := cmd.Flags().GetUint16("sport")
	if err != nil {
		return fmt.Errorf("invalid source port: %v", err)
	}
	dport, err := cmd.Flags().GetUint16("dport")
	if err != nil {
		return fmt.Errorf("invalid destination port: %v", err)
	}

	// For TCP/UDP, generate random ephemeral port (49152-65535) if not specified
	if protocol != "icmp" {
		if sport == 0 {
			sport = uint16(rand.Intn(16383) + 49152)
		}
		if dport == 0 {
			dport = uint16(rand.Intn(16383) + 49152)
		}
	}

	var tcpFlags *proto.TCPFlags
	if protocol == "tcp" {

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Pass a decimal port in 0-65535, or omit --sport to let the tool choose a random ephemeral port
2. If scripting, validate with a bounds check before invoking the CLI

if v, err := strconv.ParseUint(sportStr, 10, 16); err != nil || v > 65535 {
    log.Fatalf("--sport must be 0-65535, got %q", sportStr)
}

func isValidPort16(s string) bool {
    v, err := strconv.ParseUint(s, 10, 16)
    return err == nil // ParseUint(_, 16) already enforces <= 65535
}

When it happens

Trigger: 'netbird debug trace ... --sport 70000' (above 65535), '--sport -1', or '--sport abc'. Ports are uint16; anything outside [0,65535] or non-numeric fails here.

Common situations: Copy-pasting a service name instead of a port; ephemeral-port range math off by one (49152-65535 is the range the tool itself randomizes into); locale/format artifacts in scripts.

Related errors

• invalid destination port: %v
• invalid direction: use 'in' or 'out'
• invalid protocol: use tcp/udp/icmp
• failed initializing log %v
• listen_port is required for TLS services

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/fb38572b8cc032f8. Report an issue: GitHub.