shadow1ng/fscan · info

service_not_identified

Error message

service_not_identified

What it means

identifyService runs when brute force is disabled (config.DisableBrute): it connects to the port and tries to read a MySQL handshake banner. If the banner cannot be read or does not look like a MySQL greeting, it returns a failed ScanResult with the localized 'service_not_identified' message (parameterized with 'MySQL').

Source

Thrown at plugins/services/mysql.go:192

			Error:   err,
		}
	}
	defer func() { _ = conn.Close() }()

	if banner := p.readMySQLBanner(conn, session.Config); banner != "" {
		session.LogSuccess(i18n.Tr("mysql_service", target, banner))
		return &ScanResult{
			Type:    plugins.ResultTypeService,
			Success: true,
			Service: "mysql",
			Banner:  banner,
		}
	}

	return &ScanResult{
		Success: false,
		Service: "mysql",
		Error:   fmt.Errorf("%s", i18n.Tr("service_not_identified", "MySQL")),
	}
}

func (p *MySQLPlugin) readMySQLBanner(conn net.Conn, config *common.Config) string {
	_ = conn.SetReadDeadline(time.Now().Add(config.ModuleTimeout()))

	header := make([]byte, 5)
	if _, err := io.ReadFull(conn, header); err != nil {
		return ""
	}

	if header[4] != 10 {
		return ""
	}

	version := make([]byte, 0, 64)
	var b [1]byte
	for len(version) < 250 {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the target is really MySQL on that port (nmap/service probe).
2. Increase the module/read timeout if the server's greeting is slow under load.
3. Connect without a proxy/middlebox that may swallow the initial greeting packet.
4. Check server-side blocks (host blocked due to too many connection errors) and allowlist the scanner IP.
5. If brute force is acceptable, disable DisableBrute so full authentication testing runs instead.

Example fix

// before
config.DisableBrute = true // only banner identification
// after
config.DisableBrute = false // full credential testing + identification

res := plugin.identifyService(ctx, info, session)
if res.Error != nil && strings.Contains(res.Error.Error(), "service_not_identified") {
    // retry with a longer read deadline before marking the service unknown
}

When it happens

Trigger: TCP connect succeeds but readMySQLBanner returns an empty string — the server closes immediately, times out before sending the greeting, or sends bytes that fail the MySQL protocol header/version checks.

Common situations: The port hosts a different service (e.g. MariaDB fork with altered greeting handling, or a proxy accept-and-drop); a firewall allows the handshake but drops data; server-side max_connection_errors blocking; TLS-required MySQL configured to not send a plaintext greeting (rare, but with custom wrappers).

Related errors

• i18n.Tr("service_not_identified", "Memcached")
• service_no_credentials
• STOMP request send failed: %w
• %s
• ms17010_pipe_response_incomplete

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/eb697ecbf0d0a0ad. Report an issue: GitHub.