shadow1ng/fscan · warning

netbios_smb_session_send_failed: %w

Error message

netbios_smb_session_send_failed: %w

What it means

This error occurs in queryNetBIOSSession when writing the SMB Session Setup request (smbSessionSetup, an NTLMSSP negotiate packet) to the established TCP 139 connection fails. The library wraps the net.Conn.Write error with the i18n message 'netbios_smb_session_send_failed'. The SMB negotiate round-trip succeeded but the connection broke before the second request could be sent.

Source

Thrown at plugins/services/netbios.go:249

		0x00, 0x00, 0x00, 0x4A, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD4, 0x00, 0x00, 0xA0, 0xCF, 0x00, 0x60,
		0x48, 0x06, 0x06, 0x2B, 0x06, 0x01, 0x05, 0x05, 0x02, 0xA0, 0x3E, 0x30, 0x3C, 0xA0, 0x0E, 0x30,
		0x0C, 0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x02, 0x02, 0x0A, 0xA2, 0x2A, 0x04,
		0x28, 0x4E, 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x82, 0x08,
		0xA2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0x00, 0x05, 0x02, 0xCE, 0x0E, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6E, 0x00,
		0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,
		0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x33, 0x00,
		0x20, 0x00, 0x33, 0x00, 0x37, 0x00, 0x39, 0x00, 0x30, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,
		0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00,
		0x63, 0x00, 0x6B, 0x00, 0x20, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00,
		0x6E, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,
		0x72, 0x00, 0x76, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00,
		0x33, 0x00, 0x20, 0x00, 0x35, 0x00, 0x2E, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00,
	}

	_, err = conn.Write(smbSessionSetup)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_session_send_failed"), err)
	}

	response2 := make([]byte, 2048)
	n, err := conn.Read(response2)
	if err != nil {
		return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_session_read_failed"), err)
	}

	return p.parseNetBIOSSession(response2[:n])
}

// parseNetBIOSNames 解析NetBIOS名称查询响应
func (p *NetBIOSPlugin) parseNetBIOSNames(data []byte) (*NetBIOSInfo, error) {
	info := &NetBIOSInfo{Valid: false}

	if len(data) < 57 {
		return info, fmt.Errorf("%s", i18n.GetText("netbios_response_too_short"))
	}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Extend config.ModuleTimeout() so the second write is not cut off by the deadline.
2. Confirm the target supports the legacy NTLMSSP session-setup flow (modern hosts often need SMB2/3 on port 445 instead).
3. Check firewalls/IPS logs for RST injection after SMB negotiate.
4. Distinguish timeout vs reset in the wrapped error with errors.As(net.Error) and log host + cause.

Example fix

// before
_, err = conn.Write(smbSessionSetup)
if err != nil {
    return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_session_send_failed"), err)
}

// after
_, err = conn.Write(smbSessionSetup)
if err != nil {
    var nerr net.Error
    if errors.As(err, &nerr) && nerr.Timeout() {
        return nil, fmt.Errorf("smb session setup send timed out for %s", host)
    }
    return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_session_send_failed"), err)
}

// confirm negotiate round-trip succeeded before sending session setup
if len(response1) == 0 {
    return fmt.Errorf("empty negotiate response; aborting session setup for %s", host)
}
if time.Until(deadline) < time.Second {
    return fmt.Errorf("less than 1s left on deadline before session setup")
}

func isBrokenPipe(err error) bool {
    return errors.Is(err, syscall.EPIPE) || errors.Is(err, syscall.ECONNRESET) || errors.Is(err, io.ErrClosedPipe)
}

_, err = conn.Write(smbSessionSetup)
if err != nil {
    if isBrokenPipe(err) {
        return nil, fmt.Errorf("host %s dropped connection before session setup", host)
    }
    var nerr net.Error
    if errors.As(err, &nerr) && nerr.Timeout() {
        return nil, fmt.Errorf("session setup send timed out for %s", host)
    }
    return nil, fmt.Errorf("%s: %w", i18n.GetText("netbios_smb_session_send_failed"), err)
}

When it happens

Trigger: Scan -> queryNetBIOSSession completes the first negotiate read, then conn.Write(smbSessionSetup) errors: the peer reset or closed the connection after the negotiate reply, or the SetDeadline(ModuleTimeout) expired before the write completed.

Common situations: Servers that accept the negotiate but reject the session (some Samba configs close after negotiate); IPS dropping the larger session-setup packet; scanning Windows hosts that require SMB2+ and abort legacy NTLM setup; tight ModuleTimeout on loaded networks.

Related errors

• netbios_smb_negotiate_send_failed: %w
• netbios_smb_negotiate_read_failed: %w
• netbios_smb_session_read_failed: %w
• ms17010_connection_error: %w
• ms17010_send_session_error: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/177bf5df493daacb. Report an issue: GitHub.