shadow1ng/fscan · error

xid mismatch

Error message

xid mismatch

What it means

Guard in rpcNullCall: the reply fragment's XID field does not match the xid sent in the NULL call. The response belongs to a different RPC exchange (desynchronized stream or wrong service), so it cannot be trusted as the answer to this probe.

Source

Thrown at plugins/services/nfs.go:99

	Read([]byte) (int, error)
	Write([]byte) (int, error)
}, program, version uint32) error {
	xid := uint32(0x12340000 + program)
	rpcCall := p.buildRPCCall(xid, program, version, 0, nil)
	rpcFragment := p.wrapRPCFragment(rpcCall)

	if _, err := conn.Write(rpcFragment); err != nil {
		return err
	}

	reply, err := readRPCFragment(conn, 512)
	if err != nil || len(reply) < 24 {
		return fmt.Errorf("short response")
	}

	replyXID := binary.BigEndian.Uint32(reply[0:4])
	if replyXID != xid {
		return fmt.Errorf("xid mismatch")
	}
	msgType := binary.BigEndian.Uint32(reply[4:8])
	if msgType != 1 {
		return fmt.Errorf("not a reply")
	}
	return nil
}

func (p *NFSPlugin) getExports(conn interface {
	Read([]byte) (int, error)
	Write([]byte) (int, error)
}) ([]string, error) {
	// Sun RPC call: program=MOUNT(100005), version=3, procedure=EXPORT(5)
	xid := uint32(0x12345678)
	rpcCall := p.buildRPCCall(xid, 100005, 3, 5, nil)
	rpcFragment := p.wrapRPCFragment(rpcCall)

	if _, err := conn.Write(rpcFragment); err != nil {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Ensure no other RPC traffic shares the connection
2. Confirm the target is an ONC RPC endpoint and not a look-alike protocol
3. Retry the probe on a fresh connection

When it happens

Trigger: Thrown at plugins/services/nfs.go:99 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/0a5a2aca1f6e0609. Report an issue: GitHub.