What causes "invalid ipv4 header length" in slackhq/nebula?

Drop-and-log is the correct behavior; investigate the traffic source if it recurs.

ErrIPv4InvalidHeaderLength

ErrIPv4InvalidHeaderLength

Error message

invalid ipv4 header length

What it means

parseV4 validates that the IPv4 header's IHL field yields a header length of at least ipv4.HeaderLen (20 bytes) and that the packet actually contains that many bytes. A header claiming less than the minimum, or a packet too short to contain it, is rejected with this error.

Source

Thrown at outside.go:313

			}
			return
		}

		hostinfo.logger(f.l).Info("Host roamed to new udp ip/port.",
			"udpAddr", curRemote,
			"newAddr", via.UdpAddr,
		)
		hostinfo.lastRoam = time.Now()
		hostinfo.lastRoamRemote = curRemote
		hostinfo.SetRemote(via.UdpAddr)
	}

}

var (
	ErrPacketTooShort          = errors.New("packet is too short")
	ErrUnknownIPVersion        = errors.New("packet is an unknown ip version")
	ErrIPv4InvalidHeaderLength = errors.New("invalid ipv4 header length")
	ErrIPv4PacketTooShort      = errors.New("ipv4 packet is too short")
	ErrIPv6PacketTooShort      = errors.New("ipv6 packet is too short")
)

// newPacket validates and parses the interesting bits for the firewall out of the ip and sub protocol headers
func newPacket(data []byte, incoming bool, fp *firewall.ParsedPacket) error {
	// fp is reused across packets; reset the parse byproducts so an early-error return cannot
	// leak the previous packet's offsets.
	fp.IPHdrLen = 0
	fp.FragAny = false
	if len(data) < 1 {
		return ErrPacketTooShort
	}

	version := int((data[0] >> 4) & 0x0f)
	switch version {
	case ipv4.Version:
		return parseV4(data, incoming, fp)

View on GitHub (pinned to dd8f660c0a)

Solutions

Drop-and-log is the correct behavior; investigate the traffic source if it recurs.
Check underlay MTU so packets are not truncated in transit.
Inspect captured packets for corruption between sender and receiver.

Defensive patterns

Strategy: validation

Validate before calling

if len(data) < 20 {
    return errors.New("ipv4 packet below header length")
}
ihl := int(data[0]&0x0f) * 4
if ihl < 20 || len(data) < ihl {
    return errors.New("invalid ipv4 IHL")
}

Try / catch

if errors.Is(err, outside.ErrIPv4InvalidHeaderLength) {
    // drop malformed packet; log source
}

Prevention

Check underlay MTU to prevent truncation.
Monitor for repeated malformed-packet sources.
Verify sending stacks produce IHL >= 5.

When it happens

Trigger: An IPv4 packet (version nibble 4) whose IHL < 20 bytes (outside.go:420) or whose total length is less than the declared/minimum header length (outside.go:445), triggered from newPacket.

Common situations: Corrupted packets from lossy links, packets truncated by MTU/fragmentation mishandling, malformed packets from scanners or buggy tunnel software.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/27449f6555e673fe. Report an issue: GitHub.