projectdiscovery/nuclei · error

failed to send encryption packet: %w

Error message

failed to send encryption packet: %w

What it means

In telnetmini's connection/negotiation phase (telnet.go:104), nuclei writes the 6-byte encryption probe IAC DO ENCRYPT / IAC WILL ENCRYPT (FF FD 26 FF FB 26) to start NTLM negotiation, after setting a deadline (default 7s). A write error — connection reset, network unreachable, deadline already exceeded — returns 'failed to send encryption packet: %w' wrapping the underlying net error.

Source

Thrown at pkg/utils/telnetmini/telnet.go:104

// DetectEncryption detects if a telnet server supports encryption.
// Based on Nmap's telnet-encryption.nse script functionality.
// WARNING: The connection becomes unusable after calling this function
// due to the encryption negotiation packets sent.
func DetectEncryption(conn net.Conn, timeout time.Duration) (*EncryptionInfo, error) {
	if timeout == 0 {
		timeout = 7 * time.Second
	}

	// Set connection timeout
	_ = conn.SetDeadline(time.Now().Add(timeout))

	// Send encryption negotiation packet (based on Nmap script)
	// FF FD 26 FF FB 26 = IAC DO ENCRYPT IAC WILL ENCRYPT
	encryptionPacket := []byte{IAC, DO, ENCRYPT, IAC, WILL, ENCRYPT}
	_, err := conn.Write(encryptionPacket)
	if err != nil {
		return nil, fmt.Errorf("failed to send encryption packet: %w", err)
	}

	// Process server responses
	options := make(map[int][]int)
	supportsEncryption := false
	banner := ""

	// Read responses until we get encryption info or timeout
	for {
		_ = conn.SetReadDeadline(time.Now().Add(1 * time.Second))
		buffer := make([]byte, 1024)
		n, err := conn.Read(buffer)
		if err != nil {
			// Timeout or connection closed, break
			break
		}

		if n > 0 {

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Verify basic reachability independently: `nc -vz target 23` and a manual `telnet target` to see if the server tolerates negotiation
2. Reduce scan concurrency / add delay between connections — connection-limit resets are the most common cause
3. Retry the probe once after a short backoff; transient RSTs are common on throttled hosts
4. Check the wrapped error: i/o timeout points to the deadline (raise the timeout parameter), connection reset points to the server/firewall

// Pre-flight the connection before writing the probe:
conn.SetDeadline(time.Now().Add(timeout))
if err := conn.SetWriteDeadline(time.Now().Add(2 * time.Second)); err != nil {
    return nil, err
}

var resp []byte
err := backoff.Retry(func() error {
    var e error
    resp, e = telnetmini.NegotiateEncryption(conn, timeout)
    if e != nil && strings.Contains(e.Error(), "failed to send encryption packet") {
        return e // retryable: reset/throttle class of failure
    }
    return backoff.Permanent(e)
}, backoff.WithMaxRetries(backoff.NewExponentialBackOff(), 2))

When it happens

Trigger: The TCP connection was established but died before/while writing: server RST immediately after accept (inetd rate limits, hosts.deny, fail2ban), a firewall that completes the handshake then kills data, a dialer whose context deadline expired so the first write fails, or a non-telnet service on port 23 that closes on binary data.

Common situations: Scanning ranges where port 23 is filtered by tarpalling middleboxes; targets protected by fail2ban/MaxStartups-style throttling when concurrency is high; probes against services that are not telnet (banner-grab time).

Related errors

• failed to read response: %w
• waiting for password prompt: %w
• sending password: %w
• authentication failed
• prompt not found (read cap reached)

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/f176753216557e60. Report an issue: GitHub.