shadow1ng/fscan · info

netbios_response_too_short

Error message

netbios_response_too_short

What it means

This error is returned by parseNetBIOSNames when the UDP 137 name-query response is shorter than 57 bytes, the minimum size of a valid NetBIOS name service response header plus fixed fields (data[56] holds the name record count). The library returns an invalid NetBIOSInfo (Valid:false) with the i18n message 'netbios_response_too_short', meaning the reply cannot be parsed as a NBNS response.

Source

Thrown at plugins/services/netbios.go:266

	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_session_send_failed"), err)
	}

	response2 := make([]byte, 2048)
	n, err := conn.Read(response2)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_session_read_failed"), err)
	}

	return p.parseNetBIOSSession(response2[:n])
}

// parseNetBIOSNames 解析NetBIOS名称查询响应
func (p *NetBIOSPlugin) parseNetBIOSNames(data []byte) (*NetBIOSInfo, error) {
	info := &NetBIOSInfo{Valid: false}

	if len(data) < 57 {
		return info, fmt.Errorf("%s", i18n.GetText("netbios_response_too_short"))
	}

	// 获取名称记录数量
	numNames := int(data[56])
	if numNames == 0 {
		return info, fmt.Errorf("%s", i18n.GetText("netbios_no_name_records"))
	}

	nameData := data[57:]

	// 服务类型映射
	uniqueNames := map[byte]string{
		0x00: "WorkstationService",
		0x03: "Messenger Service",
		0x06: "RAS Server Service",
		0x1F: "NetDDE Service",
		0x20: "ServerService",
		0x21: "RAS Client Service",

View on GitHub (pinned to 95cc12e753)

Solutions

1. Check len(data) before calling parseNetBIOSNames and skip/ignore hosts returning short payloads instead of treating them as errors.
2. Validate the response looks like a NBNS reply (transaction ID and flags match the queryPacket) before parsing.
3. Ignore the error and continue scanning; a short response simply means the host is not a valid NetBIOS name server.
4. If responses are consistently truncated, check network path MTU/fragmentation between scanner and target.

Example fix

// before
info, err := p.queryNetBIOSNames(host, config, state)

// after
conn.SetReadDeadline(time.Now().Add(config.ModuleTimeout()))
n, err := conn.Read(response)
if err != nil || n < 57 {
    // not a valid NBNS response; skip host
    return nil, nil
}
info, err := p.parseNetBIOSNames(response[:n])

// validate the datagram before parsing
func isPlausibleNBNSResponse(data []byte) bool {
    return len(data) >= 57
}

// usage
if !isPlausibleNBNSResponse(response[:n]) {
    return nil, nil // not a NBNS reply; skip host silently
}
info, err := p.parseNetBIOSNames(response[:n])

func hasMinNBNSLength(data []byte) bool {
    return len(data) >= 57
}

info, err := p.parseNetBIOSNames(data)
if err != nil {
    if strings.Contains(err.Error(), i18n.GetText("netbios_response_too_short")) {
        log.Printf("host sent short/invalid NBNS reply (%d bytes); skipping", len(data))
        return nil, nil
    }
    return nil, err
}

When it happens

Trigger: queryNetBIOSNames (or an anonymous UDP read handler) receives a response on the UDP 137 socket and passes it to parseNetBIOSNames with len(data) < 57: e.g., an ICMP port-unreachable payload, a truncated/duplicated datagram, an empty read, or a non-NBNS service replying on port 137.

Common situations: Scanning devices that reply on UDP 137 with junk (printers, IoT, load balancers); path MTU issues truncating large responses; NAT middleboxes sending ICMP-derived short packets; misconfigured hosts running unrelated UDP services on port 137.

Related errors

• netbios_smb_negotiate_send_failed: %w
• Unsupport FastPathPDU type 0x%x
• Unknown FastPathPDU type 0x%x
• NODE_RDP_PROTOCOL_PDU_SEC_BAD_LICENSE_HEADER
• Not a valid license packet

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/8f9c012f1dd9c314. Report an issue: GitHub.