What causes "error sending to (%s): %v" in projectdiscovery/nuclei?

Verify IP-level reachability of the KDC host (ping / traceroute to the DC)

error sending to (%s): %v

Error message

error sending to (%s): %v

What it means

The innermost UDP send in sendUDP failed at conn.Write: the datagram could not be handed to the socket for the remote KDC address embedded in the message. This is a write-side failure (for example network unreachable or an invalid socket), and it propagates up into the per-KDC error list aggregated by sendToKDCUdp.

Source

Thrown at pkg/js/libs/kerberos/sendtokdc.go:156

		}
		return rb, nil
	}
	if len(errs) > 0 {
		// fallback to tcp
		return nil, fmt.Errorf("error sending to a KDC: %s", strings.Join(errs, "; "))
	}
	return nil, nil
}

// sendUDP sends bytes to connection over UDP.
func sendUDP(conn *net.UDPConn, b []byte) ([]byte, error) {
	var r []byte
	defer func() {
		_ = conn.Close()
	}()
	_, err := conn.Write(b)
	if err != nil {
		return r, fmt.Errorf("error sending to (%s): %v", conn.RemoteAddr().String(), err)
	}
	udpbuf := make([]byte, 4096)
	n, _, err := conn.ReadFrom(udpbuf)
	r = udpbuf[:n]
	if err != nil {
		return r, fmt.Errorf("sending over UDP failed to %s: %v", conn.RemoteAddr().String(), err)
	}
	if len(r) < 1 {
		return r, fmt.Errorf("no response data from %s", conn.RemoteAddr().String())
	}
	return r, nil
}

// sendTCP sends bytes to connection over TCP.
func sendTCP(conn *net.TCPConn, b []byte) ([]byte, error) {
	defer func() {
		_ = conn.Close()
	}()

View on GitHub (pinned to 265b3a3dec)

Solutions

Verify IP-level reachability of the KDC host (ping / traceroute to the DC)
Check local firewall or iptables rules blocking outbound UDP
Retry the request; if it persists, switch expectations to the TCP path

Defensive patterns

Strategy: retry

Try / catch

try {
  const resp = kerberos.SendToKDC(client, msg);
} catch (e) {
  // UDP write failed to the KDC: check routing/firewall for the DC address in the message
}

Prevention

Verify IP reachability of domain controllers before the scan
Retry once for transient routing issues before concluding failure

When it happens

Trigger: Routing to the KDC subnet missing (network unreachable); the connection already closed underneath the caller; local firewall rejecting the outgoing datagram.

Common situations: Containers or CI runners without routes to the AD segment; scanning hosts where the VPN dropped mid-run; transient interface changes during long scans.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/7e0edafbca849c0a. Report an issue: GitHub.