shadow1ng/fscan · error

netbios_smb_response_too_short

Error message

netbios_smb_response_too_short

What it means

Guard in parseNetBIOSSession: the TCP 139 session response is shorter than the 47 bytes required to contain the NetBIOS session header and SMB negotiation fields. The truncated payload cannot be parsed for OS version or names, so the result stays invalid.

Source

Thrown at plugins/services/netbios.go:338

					case "WorkstationService":
						info.WorkstationService = name
					case "ServerService":
						info.ServerService = name
					}
				}
			}
		}
	}

	return info, nil
}

// parseNetBIOSSession 解析NetBIOS会话响应
func (p *NetBIOSPlugin) parseNetBIOSSession(data []byte) (*NetBIOSInfo, error) {
	info := &NetBIOSInfo{Valid: false}

	if len(data) < 47 {
		return info, fmt.Errorf("%s", i18n.GetText("netbios_smb_response_too_short"))
	}

	info.Valid = true

	// 解析OS版本信息
	blobLength := int(data[43]) + int(data[44])*256
	if len(data) >= 48+blobLength {
		osVersion := data[47+blobLength:]
		osText := p.cleanOSString(osVersion)
		if osText != "" {
			info.OSVersion = osText
		}
	}

	// 查找NTLM数据
	ntlmStart := bytes.Index(data, []byte("NTLMSSP"))
	if ntlmStart != -1 && len(data) > ntlmStart+45 {
		p.parseNTLMInfo(data[ntlmStart:], info)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Increase the read timeout so the full session response arrives
2. Verify the endpoint on 139 actually speaks the NetBIOS session protocol
3. Retry the session setup; mid-response resets cause truncation

When it happens

Trigger: Thrown at plugins/services/netbios.go:338 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/aae78157d8c59a07. Report an issue: GitHub.