shadow1ng/fscan · error

xid mismatch

Error message

xid mismatch

What it means

Guard in rpcNullCall: the reply fragment's XID field does not match the xid sent in the NULL call. The response belongs to a different RPC exchange (desynchronized stream or wrong service), so it cannot be trusted as the answer to this probe.

Solutions

1. Ensure no other RPC traffic shares the connection
2. Confirm the target is an ONC RPC endpoint and not a look-alike protocol
3. Retry the probe on a fresh connection

When it happens

Trigger: Thrown at plugins/services/nfs.go:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/0a5a2aca1f6e0609. Report an issue: GitHub.

Appendix: source

Thrown at plugins/services/nfs.go:99

	Read([]byte) (int, error)
	Write([]byte) (int, error)
}, program, version uint32) error {
	xid := uint32(0x12340000 + program)
	rpcCall := p.buildRPCCall(xid, program, version, 0, nil)
	rpcFragment := p.wrapRPCFragment(rpcCall)

	if _, err := conn.Write(rpcFragment); err != nil {
		return err
	}

	reply, err := readRPCFragment(conn, 512)
	if err != nil || len(reply) < 24 {
		return fmt.Errorf("short response")
	}

	replyXID := binary.BigEndian.Uint32(reply[0:4])
	if replyXID != xid {
		return fmt.Errorf("xid mismatch")
	}
	msgType := binary.BigEndian.Uint32(reply[4:8])
	if msgType != 1 {
		return fmt.Errorf("not a reply")
	}
	return nil
}

func (p *NFSPlugin) getExports(conn interface {
	Read([]byte) (int, error)
	Write([]byte) (int, error)
}) ([]string, error) {
	// Sun RPC call: program=MOUNT(100005), version=3, procedure=EXPORT(5)
	xid := uint32(0x12345678)
	rpcCall := p.buildRPCCall(xid, 100005, 3, 5, nil)
	rpcFragment := p.wrapRPCFragment(rpcCall)

	if _, err := conn.Write(rpcFragment); err != nil {

View on GitHub (pinned to 95cc12e753)