shadow1ng/fscan · warning

smb_port_only

Error message

smb_port_only

What it means

The SMB module only supports Windows SMB ports. Scan validates info.Port immediately and, unless the port is 445 (SMB over TCP) or 139 (SMB over NetBIOS), returns a failed ScanResult with smb_port_only. This is an input guard, not a network failure: the module refuses to run protocol probing on unsupported ports.

Source

Thrown at plugins/services/smb.go:37

}

func NewSmbPlugin() *SmbPlugin {
	return &SmbPlugin{
		BasePlugin: plugins.NewBasePlugin("smb"),
	}
}

func (p *SmbPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
	config := session.Config
	state := session.State
	target := info.Target()

	// 检查端口
	if info.Port != 445 && info.Port != 139 {
		return &ScanResult{
			Success: false,
			Service: "smb",
			Error:   fmt.Errorf("%s", i18n.GetText("smb_port_only")),
		}
	}

	// 1. 协议探测和信息收集
	smbTarget, err := probeTarget(ctx, info.Host, info.Port, config.ModuleTimeout(), session)
	if err != nil {
		return &ScanResult{
			Success: false,
			Service: "smb",
			Error:   fmt.Errorf("%s: %w", i18n.GetText("smb_probe_failed"), err),
		}
	}

	// 输出信息收集结果
	p.logSMBInfo(target, smbTarget, session)

	// 2. 漏洞检测 (仅SMBv2+且端口445)
	if smbTarget.Protocol == SMBProtocol2 && info.Port == 445 {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Restrict SMB targets to ports 445 or 139 in the scan configuration.
2. If SMB is published on a nonstandard port, add a port mapping or test from a position where 445 is reachable.
3. Route other ports to the correct service modules instead of the SMB plugin.

Example fix

// before
targets := ["10.0.0.5:443"] // smb_port_only
// after
targets := ["10.0.0.5:445", "10.0.0.5:139"]

if port != 445 && port != 139 {
    return errors.New("SMB module requires port 445 or 139; got " + strconv.Itoa(port))
}

if err != nil && strings.Contains(err.Error(), "smb_port_only") {
    // drop target from SMB queue; log config mistake
}

When it happens

Trigger: Scan is called with an info whose Port is anything other than 445 or 139 — e.g. the target list includes SMB-over-QUIC 443, or a generic port sweep hands every open port to the SMB module.

Common situations: Misconfigured scan target lists including arbitrary ports; expecting SMB over 443 (SMB over QUIC, unsupported here); port-forwarding setups that expose SMB behind a nonstandard external port without mapping it back.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• local_pe_not_specified
• local_pe_not_found
• local_pe_not_specified
• local_pe_not_found
• local_pe_not_specified

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/5c3510c7b848b143. Report an issue: GitHub.