What causes "short oracle accept packet" in shadow1ng/fscan?

Verify the target port actually runs an Oracle listener (tnsping / check TNS banner).

short oracle accept packet

Error message

short oracle accept packet

What it means

During the Oracle TNS handshake, when the server replies with a Redirect/Accept packet, the client parses fixed fields from the raw packet bytes. If an Accept packet is shorter than the 40 bytes needed to read version, negotiated options, SDU and TDU sizes, the client returns this error instead of reading out of bounds. It means the server's accept packet is malformed or a non-Oracle service answered.

Source

Thrown at plugins/services/oracle_raw.go:192

	var p *oraclePacket
	for resends := 0; resends < 3; resends++ {
		var err error
		p, err = s.readPacket()
		if err != nil {
			return err
		}
		if p.typ != oraclePacketResend {
			break
		}
		if err := sendConnect(); err != nil {
			return err
		}
	}

	switch p.typ {
	case oraclePacketAccept:
		if len(p.raw) < 40 {
			return errors.New("short oracle accept packet")
		}
		s.version = binary.BigEndian.Uint16(p.raw[8:10])
		s.negotiatedOptions = binary.BigEndian.Uint16(p.raw[10:12])
		s.sessionDataUnit = uint32(binary.BigEndian.Uint16(p.raw[12:14]))
		s.transportDataUnit = uint32(binary.BigEndian.Uint16(p.raw[14:16]))
		if s.version >= 315 {
			s.sessionDataUnit = binary.BigEndian.Uint32(p.raw[32:36])
			s.transportDataUnit = binary.BigEndian.Uint32(p.raw[36:40])
		}
		if s.transportDataUnit < s.sessionDataUnit {
			s.sessionDataUnit = s.transportDataUnit
		}
		s.acfl0 = p.raw[22]
		s.acfl1 = p.raw[23]
		if s.version >= 315 {
			s.handshakeComplete = true
		}
		return nil

View on GitHub (pinned to 95cc12e753)

Solutions

Verify the target port actually runs an Oracle listener (tnsping / check TNS banner).
Check for proxies, port forwarding, or WAF devices in the path that may truncate or rewrite TNS packets.
Capture the raw packet and compare its length against the expected TNS Accept layout to identify the responder.
If you control the client, log len(p.raw) and a hex dump before failing to aid diagnosis.

Example fix

// before
if len(p.raw) < 40 {
    return errors.New("short oracle accept packet")
}
// after
if len(p.raw) < 40 {
    return fmt.Errorf("short oracle accept packet: got %d bytes, need 40 (non-Oracle service or truncated response?)", len(p.raw))
}

Defensive patterns

Strategy: type-guard

Validate before calling

// verify the port speaks TNS before full handshake
banner, err := readBannerWithTimeout(conn, 5*time.Second)
if err != nil || !looksLikeTNS(banner) {
    return errors.New("target does not look like an Oracle TNS listener")
}

Type guard

func isShortAccept(p oraclePacket) bool {
    return p.typ == oraclePacketAccept && len(p.raw) < 40
}

Try / catch

if err := s.connect(p); err != nil {
    if strings.Contains(err.Error(), "short oracle accept packet") {
        return fmt.Errorf("non-Oracle service or truncating middlebox on %s:%d", host, port)
    }
    return err
}

Prevention

Fingerprint the port before running the raw Oracle client
Bypass or account for proxies/load balancers that rewrite TNS traffic
Set read timeouts so truncated responses fail fast and loudly

When it happens

Trigger: connect() receives a packet with typ == oraclePacketAccept whose raw payload length is < 40, immediately after sending the connect data for oracleRawAuth.

Common situations: A proxy/load balancer or honeypot answering the port instead of a real Oracle listener; truncated TCP payload due to a middlebox; wrong port pointing at a non-Oracle service; TNS server version with a shorter packet layout.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/42b136fecf60521f. Report an issue: GitHub.