shadow1ng/fscan · error

not a reply

Error message

not a reply

What it means

Guard in rpcNullCall: the reply's message-type field is not 1 (REPLY). The peer answered with a CALL or garbage, meaning the endpoint is not a functioning ONC RPC server for this program/version.

Source

Thrown at plugins/services/nfs.go:103

	rpcCall := p.buildRPCCall(xid, program, version, 0, nil)
	rpcFragment := p.wrapRPCFragment(rpcCall)

	if _, err := conn.Write(rpcFragment); err != nil {
		return err
	}

	reply, err := readRPCFragment(conn, 512)
	if err != nil || len(reply) < 24 {
		return fmt.Errorf("short response")
	}

	replyXID := binary.BigEndian.Uint32(reply[0:4])
	if replyXID != xid {
		return fmt.Errorf("xid mismatch")
	}
	msgType := binary.BigEndian.Uint32(reply[4:8])
	if msgType != 1 {
		return fmt.Errorf("not a reply")
	}
	return nil
}

func (p *NFSPlugin) getExports(conn interface {
	Read([]byte) (int, error)
	Write([]byte) (int, error)
}) ([]string, error) {
	// Sun RPC call: program=MOUNT(100005), version=3, procedure=EXPORT(5)
	xid := uint32(0x12345678)
	rpcCall := p.buildRPCCall(xid, 100005, 3, 5, nil)
	rpcFragment := p.wrapRPCFragment(rpcCall)

	if _, err := conn.Write(rpcFragment); err != nil {
		return nil, err
	}

	reply, err := readRPCFragment(conn, 4096)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the target port serves RPC (use rpcinfo -p remotely)
2. Check program number and version in the probe
3. Treat the port as non-RPC and skip further NFS checks

When it happens

Trigger: Thrown at plugins/services/nfs.go:103 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/8476e5da0e39832d. Report an issue: GitHub.