What causes "service_not_identified" in shadow1ng/fscan?

Verify what actually listens on the port (nmap -sV or manual banner grab) before including it as an rsync target.

service_not_identified

Error message

service_not_identified

What it means

identifyService reaches the branch where the banner could not be classified as an rsync service. If the probe response does not match the expected rsync banner patterns, the plugin returns service_not_identified (parameterized with "Rsync"), meaning the port answered but was not confirmed as rsync, so the module refuses to continue.

Source

Thrown at plugins/services/rsync.go:383

	var banner string

	if strings.Contains(responseStr, "@RSYNCD") {
		lines := strings.Split(responseStr, "\n")
		for _, line := range lines {
			if strings.HasPrefix(line, "@RSYNCD:") {
				banner = i18n.Tr("rsync_service_info", strings.TrimSpace(line))
				break
			}
		}
		if banner == "" {
			banner = i18n.GetText("rsync_file_sync_service")
		}
	} else {
		return &ScanResult{
			Success: false,
			Service: "rsync",
			Error:   fmt.Errorf("%s", i18n.Tr("service_not_identified", "Rsync")),
		}
	}

	session.LogSuccess(i18n.Tr("rsync_service", target, banner))

	return &ScanResult{
		Success: true,
		Type:    plugins.ResultTypeService,
		Service: "rsync",
		Banner:  banner,
	}
}

func readRsyncLine(conn interface {
	Read([]byte) (int, error)
}, max int) (string, error) {
	var line strings.Builder
	var b [1]byte

View on GitHub (pinned to 95cc12e753)

Solutions

Verify what actually listens on the port (nmap -sV or manual banner grab) before including it as an rsync target.
If the service is TLS-wrapped rsync, scan it with the appropriate TLS-enabled module or plain port.
Exclude the port from rsync scan targets if it belongs to another service.
Check for middleware/proxies rewriting the @RSYNCD greeting and connect directly to the daemon.

Example fix

// before (port hosts HTTP)
target := "10.0.0.5:8080" // service_not_identified: Rsync
// after
target := "10.0.0.5:873" // banner "@RSYNCD 31.0" identified

Defensive patterns

Strategy: validation

Validate before calling

conn, _ := net.DialTimeout("tcp", host+":873", 5*time.Second)
buf := make([]byte, 64)
conn.SetReadDeadline(time.Now().Add(3 * time.Second))
n, _ := conn.Read(buf)
if !strings.HasPrefix(string(buf[:n]), "@RSYNCD") { /* not rsync: drop target */ }
conn.Close()

Try / catch

if err != nil && strings.Contains(err.Error(), "service_not_identified") {
    // remove target from rsync module queue; route to generic banner grabber
}

Prevention

Grab the banner manually (nmap -sV) before assigning a port to the rsync module.
Do not assume port 873 always runs rsync in shared hosting environments.
Exclude TLS-wrapped endpoints from plain-rsync scanning.

When it happens

Trigger: After connecting in identifyService, the banner/response fails all rsync pattern checks and falls into the else branch at rsync.go:383, raising i18n.Tr("service_not_identified", "Rsync").

Common situations: A different service (FTP, HTTP, custom TCP app) on the scanned port; an rsync daemon behind a wrapper that alters the greeting; SSL/TLS-wrapped rsync presenting a binary handshake; proxy interception mangling the banner.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/1ce707a0c69cc9e8. Report an issue: GitHub.