shadow1ng/fscan · warning

netbios_smb_negotiate_read_failed: %w

Error message

netbios_smb_negotiate_read_failed: %w

What it means

This error occurs in queryNetBIOSSession when reading the SMB negotiate response (response1) from the TCP 139 connection fails. The library wraps the net.Conn.Read error with the i18n message 'netbios_smb_negotiate_read_failed'. Typically the remote host closed the connection or the read deadline expired without any SMB response arriving.

Source

Thrown at plugins/services/netbios.go:223

		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02, 0x50, 0x43, 0x20, 0x4E, 0x45, 0x54, 0x57, 0x4F,
		0x52, 0x4B, 0x20, 0x50, 0x52, 0x4F, 0x47, 0x52, 0x41, 0x4D, 0x20, 0x31, 0x2E, 0x30, 0x00, 0x02,
		0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x31, 0x2E, 0x30, 0x00, 0x02, 0x57, 0x69, 0x6E, 0x64, 0x6F,
		0x77, 0x73, 0x20, 0x66, 0x6F, 0x72, 0x20, 0x57, 0x6F, 0x72, 0x6B, 0x67, 0x72, 0x6F, 0x75, 0x70,
		0x73, 0x20, 0x33, 0x2E, 0x31, 0x61, 0x00, 0x02, 0x4C, 0x4D, 0x31, 0x2E, 0x32, 0x58, 0x30, 0x30,
		0x32, 0x00, 0x02, 0x4C, 0x41, 0x4E, 0x4D, 0x41, 0x4E, 0x32, 0x2E, 0x31, 0x00, 0x02, 0x4E, 0x54,
		0x20, 0x4C, 0x4D, 0x20, 0x30, 0x2E, 0x31, 0x32, 0x00,
	}

	_, err = conn.Write(smbNegotiate1)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_negotiate_send_failed"), err)
	}

	response1 := make([]byte, 1024)
	_, err = conn.Read(response1)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_negotiate_read_failed"), err)
	}

	// 发送Session Setup请求
	smbSessionSetup := []byte{
		0x00, 0x00, 0x01, 0x0A, 0xFF, 0x53, 0x4D, 0x42, 0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0xC8,
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFE,
		0x00, 0x00, 0x40, 0x00, 0x0C, 0xFF, 0x00, 0x0A, 0x01, 0x04, 0x41, 0x32, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x00, 0x00, 0x4A, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD4, 0x00, 0x00, 0xA0, 0xCF, 0x00, 0x60,
		0x48, 0x06, 0x06, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x02, 0xA0, 0x3E, 0x30, 0x3C, 0xA0, 0x0E, 0x30,
		0x0C, 0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x02, 0x0A, 0xA2, 0x2A, 0x04,
		0x28, 0x4E, 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x82, 0x08,
		0xA2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x05, 0x02, 0xCE, 0x0E, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00,
		0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,
		0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00,
		0x20, 0x00, 0x33, 0x00, 0x37, 0x00, 0x39, 0x00, 0x30, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,
		0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00,
		0x63, 0x00, 0x6B, 0x00, 0x20, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00,

View on GitHub (pinned to 95cc12e753)

Solutions

1. Increase config.ModuleTimeout() to allow slow hosts time to answer the SMB negotiate.
2. Treat EOF/reset on read as 'not a NetBIOS/SMB host' and skip the host rather than retrying.
3. Verify SMB is enabled and reachable on the target (port 445 fallback or smb client test).
4. Check the wrapped error via errors.As for net.Error timeout to separate timeouts from resets.

Example fix

// before
response1 := make([]byte, 1024)
_, err = conn.Read(response1)
if err != nil {
    return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_negotiate_read_failed"), err)
}

// after
response1 := make([]byte, 1024)
_, err = conn.Read(response1)
if err != nil {
    var nerr net.Error
    if errors.As(err, &nerr) && nerr.Timeout() {
        return nil, fmt.Errorf("host %s: no SMB negotiate response within deadline", host)
    }
    return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_negotiate_read_failed"), err)
}

// ensure the deadline allows a full round-trip before reading
deadline := time.Now().Add(session.Config.ModuleTimeout())
if err := conn.SetDeadline(deadline); err != nil {
    return fmt.Errorf("cannot set read deadline: %w", err)
}

func isTimeoutOrReset(err error) bool {
    var nerr net.Error
    return errors.As(err, &nerr) && nerr.Timeout() ||
        errors.Is(err, io.EOF) || errors.Is(err, syscall.ECONNRESET)
}

response1 := make([]byte, 1024)
_, err = conn.Read(response1)
if err != nil {
    var nerr net.Error
    switch {
    case errors.As(err, &nerr) && nerr.Timeout():
        return nil, fmt.Errorf("no SMB negotiate response from %s within deadline", host)
    case errors.Is(err, io.EOF), errors.Is(err, syscall.ECONNRESET):
        return nil, fmt.Errorf("%s closed connection during negotiate", host)
    default:
        return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_negotiate_read_failed"), err)
    }
}

When it happens

Trigger: Scan -> queryNetBIOSSession writes smbNegotiate1 successfully, then conn.Read(response1) returns an error: EOF because the host closed the socket after the negotiate packet, i/o timeout because SetDeadline(ModuleTimeout) elapsed, or connection reset.

Common situations: Hosts that accept TCP 139 but never answer SMB negotiate (misconfigured/teardrop firewalls, tcpwrappers tarpits); Windows hosts hardened with SMB signing or blocking legacy NetBIOS session service; slow hosts where ModuleTimeout is too aggressive; honeyports that accept and immediately close.

Understand the failure class

Background: Request timed out: what client-side request timeouts mean across libraries (Request timed out, TIMED_OUT, APITimeoutError) — this error's family across 39 libraries.

Related errors

• failed to get SMB1 response about header: %s
• netbios_smb_negotiate_send_failed: %w
• netbios_smb_session_send_failed: %w
• netbios_smb_session_read_failed: %w
• service_connection_failed

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/3755d94bf5af67a9. Report an issue: GitHub.