What causes "message_length_too_large: %d" in shadow1ng/fscan?

Verify the probed port actually speaks SMB (445/139); adjust probe port configuration.

message_length_too_large

message_length_too_large

Error message

message_length_too_large: %d

What it means

readSMBMessage validates the 4-byte NetBIOS session header length field and rejects any message larger than 1 MiB with 'message_length_too_large'. This guards against malformed or hostile servers advertising absurd message sizes that would exhaust memory.

Source

Thrown at plugins/services/smb_protocol.go:706

		"0xc000006a",
		"0xc0000064",
		"0xc0000234",
	}

	return ClassifyError(err, smbAuthErrors, CommonNetworkErrors)
}

// readSMBMessage 从连接读取NetBIOS消息
func readSMBMessage(conn net.Conn) ([]byte, error) {
	headerBuf := make([]byte, 4)
	if _, err := io.ReadFull(conn, headerBuf); err != nil {
		return nil, err
	}

	messageLength := int(headerBuf[0])<<24 | int(headerBuf[1])<<16 | int(headerBuf[2])<<8 | int(headerBuf[3])

	if messageLength > 1024*1024 {
		return nil, fmt.Errorf(i18n.GetText("message_length_too_large")+": %d", messageLength)
	}

	if messageLength == 0 {
		return headerBuf, nil
	}

	messageBuf := make([]byte, messageLength)
	if _, err := io.ReadFull(conn, messageBuf); err != nil {
		return nil, err
	}

	result := make([]byte, 0, 4+messageLength)
	result = append(result, headerBuf...)
	result = append(result, messageBuf...)

	return result, nil
}

View on GitHub (pinned to 95cc12e753)

Solutions

Verify the probed port actually speaks SMB (445/139); adjust probe port configuration.
Increase the 1 MiB limit in the plugin if the target legitimately sends large messages.
Add pre-filtering so non-SMB services are not probed as SMB.
Treat it as a signal the target is not an SMB server and skip it.

Example fix

// before
if messageLength > 1024*1024 {
    return nil, fmt.Errorf(i18n.GetText("message_length_too_large")+": %d", messageLength)
}
// after
const maxSMBMessageLen = 16 * 1024 * 1024 // allow larger legal SMB messages
if messageLength > maxSMBMessageLen {
    return nil, fmt.Errorf(i18n.GetText("message_length_too_large")+": %d", messageLength)
}

Defensive patterns

Strategy: validation

Validate before calling

if len(banner) >= 4 {
    l := int(banner[0])<<24 | int(banner[1])<<16 | int(banner[2])<<8 | int(banner[3])
    if l > 1024*1024 { /* reject: not a sane SMB server */ }
}

Prevention

Only probe ports known/likely to serve SMB
Treat oversized lengths as a sign the target is not SMB
Keep length limits to bound memory use
Log the advertised length for triage

When it happens

Trigger: Calling readSMBMessage (via probeTarget/probeSMBv1/probeSMBv2) against a server whose NetBIOS header declares a length over 1024*1024 bytes, or a non-SMB service returning garbage that parses as a huge length.

Common situations: Probing a port that is not actually SMB (e.g. a web or mail server), corrupted/garbled responses, deliberately malicious responses from honeypots, extremely large SMB responses from unusual servers.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/752b5fd0bbccffbf. Report an issue: GitHub.