shadow1ng/fscan · error

short response

Error message

short response

What it means

Guard in rpcNullCall: the RPC NULL procedure reply fragment was either unreadable or under the 24-byte minimum length of an ONC RPC reply header. The fragment is too short to contain XID, message type, and status, so the probe cannot validate the RPC program.

Source

Thrown at plugins/services/nfs.go:94

		Banner:  "NFS service detected",
	}
}

func (p *NFSPlugin) rpcNullCall(conn interface {
	Read([]byte) (int, error)
	Write([]byte) (int, error)
}, program, version uint32) error {
	xid := uint32(0x12340000 + program)
	rpcCall := p.buildRPCCall(xid, program, version, 0, nil)
	rpcFragment := p.wrapRPCFragment(rpcCall)

	if _, err := conn.Write(rpcFragment); err != nil {
		return err
	}

	reply, err := readRPCFragment(conn, 512)
	if err != nil || len(reply) < 24 {
		return fmt.Errorf("short response")
	}

	replyXID := binary.BigEndian.Uint32(reply[0:4])
	if replyXID != xid {
		return fmt.Errorf("xid mismatch")
	}
	msgType := binary.BigEndian.Uint32(reply[4:8])
	if msgType != 1 {
		return fmt.Errorf("not a reply")
	}
	return nil
}

func (p *NFSPlugin) getExports(conn interface {
	Read([]byte) (int, error)
	Write([]byte) (int, error)
}) ([]string, error) {
	// Sun RPC call: program=MOUNT(100005), version=3, procedure=EXPORT(5)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the port actually runs an ONC RPC service (rpcbind/NFS)
2. Increase the timeout and retry; fragmented reads can be cut short
3. Check for middleboxes truncating TCP streams

When it happens

Trigger: Thrown at plugins/services/nfs.go:94 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/7cd0d62bb5c07438. Report an issue: GitHub.