What causes "failed to send SMB2 header: %s" in shadow1ng/fscan?

Lower the grooms concurrency so the target can accept the flood

failed to send SMB2 header: %s

Error message

failed to send SMB2 header: %s

What it means

In smb2Grooms, after each successful dial, the SMB2 header is written to the new connection. If conn.Write(header) fails, the loop aborts with 'failed to send SMB2 header' and closes prior connections. This is a write failure on a freshly groomed socket.

Source

Thrown at plugins/services/ms17010_exp.go:926

		conns []net.Conn
		ok    bool
	)
	defer func() {
		if ok {
			return
		}
		for i := 0; i < len(conns); i++ {
			_ = conns[i].Close()
		}
	}()
	for i := 0; i < grooms; i++ {
		conn, err := net.Dial("tcp", address)
		if err != nil {
			return nil, fmt.Errorf("failed to connect target: %s", err)
		}
		_, err = conn.Write(header)
		if err != nil {
			return nil, fmt.Errorf("failed to send SMB2 header: %s", err)
		}
		conns = append(conns, conn)
	}
	ok = true
	return conns, nil
}

func makeSMB2Header() []byte {
	buf := bytes.Buffer{}
	buf.Write([]byte{0x00, 0x00, 0xFF, 0xF7, 0xFE})
	buf.WriteString("SMB")
	buf.Write(makeZero(124))
	return buf.Bytes()
}

const (
	packetMaxLen   = 4204
	packetSetupLen = 497

View on GitHub (pinned to 95cc12e753)

Solutions

Lower the grooms concurrency so the target can accept the flood
Verify no SYN-proxy or IPS is resetting accepted connections
Add a small delay or retry around the header write
Check target-side event logs for SMB server resource exhaustion

Defensive patterns

Strategy: retry

Validate before calling

// after dial, wait briefly for the target stack to be ready
if tc, ok := conn.(*net.TCPConn); ok {
    _ = tc.SetWriteDeadline(time.Now().Add(10 * time.Second))
}

Try / catch

if _, err := conn.Write(header); err != nil {
    if errors.Is(err, syscall.ECONNRESET) {
        // target reset on accept: reduce concurrency and retry
    }
    return fmt.Errorf("failed to send SMB2 header: %w", err)
}

Prevention

Reduce groom concurrency if the target resets accepted sockets
Confirm no SYN-proxy/IPS is terminating fresh connections
Set write deadlines so failures surface quickly and retry-ably
Monitor target SMB server logs for resource exhaustion

When it happens

Trigger: exploit → smb2Grooms → conn.Write(header) fails: the target accepted the TCP handshake then reset (backlog overflow, SYN-proxy, half-open limits) before data could be sent.

Common situations: Target kernel dropping connections under a groom flood; TCP buffers full on slow links; inline security device resetting SMB2 patterns.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/b72548cd53bee7d4. Report an issue: GitHub.