What causes "ipv4 packet is too short" in slackhq/nebula?

Confirm the underlay MTU is at least the nebula overhead + minimum IP header size.

ErrIPv4PacketTooShort

ErrIPv4PacketTooShort

Error message

ipv4 packet is too short

What it means

parseV4 requires at least a full IPv4 header (ipv4.HeaderLen = 20 bytes) worth of data before parsing. Packets smaller than that cannot possibly contain a valid IPv4 header, so they are rejected early with ErrIPv4PacketTooShort.

Source

Thrown at outside.go:314

			return
		}

		hostinfo.logger(f.l).Info("Host roamed to new udp ip/port.",
			"udpAddr", curRemote,
			"newAddr", via.UdpAddr,
		)
		hostinfo.lastRoam = time.Now()
		hostinfo.lastRoamRemote = curRemote
		hostinfo.SetRemote(via.UdpAddr)
	}

}

var (
	ErrPacketTooShort          = errors.New("packet is too short")
	ErrUnknownIPVersion        = errors.New("packet is an unknown ip version")
	ErrIPv4InvalidHeaderLength = errors.New("invalid ipv4 header length")
	ErrIPv4PacketTooShort      = errors.New("ipv4 packet is too short")
	ErrIPv6PacketTooShort      = errors.New("ipv6 packet is too short")
)

// newPacket validates and parses the interesting bits for the firewall out of the ip and sub protocol headers
func newPacket(data []byte, incoming bool, fp *firewall.ParsedPacket) error {
	// fp is reused across packets; reset the parse byproducts so an early-error return cannot
	// leak the previous packet's offsets.
	fp.IPHdrLen = 0
	fp.FragAny = false
	if len(data) < 1 {
		return ErrPacketTooShort
	}

	version := int((data[0] >> 4) & 0x0f)
	switch version {
	case ipv4.Version:
		return parseV4(data, incoming, fp)
	case ipv6.Version:

View on GitHub (pinned to dd8f660c0a)

Solutions

Confirm the underlay MTU is at least the nebula overhead + minimum IP header size.
Identify and block sources of runt/garbage packets hitting the port.
Enable packet logging to capture offending packets for diagnosis.

Defensive patterns

Strategy: validation

Validate before calling

if len(data) < 20 {
    return errors.New("too short for an ipv4 header")
}

Try / catch

if errors.Is(err, outside.ErrIPv4PacketTooShort) {
    // drop runt packet; investigate source if persistent
}

Prevention

Enforce correct MTU on the underlay path.
Block known scanner sources on the nebula port.
Track runt-packet rates as an underlay quality metric.

When it happens

Trigger: newPacket receives data of length < 20 bytes with version nibble 4 (outside.go:412); Test_newPacket feeds a single byte 0x40 to trigger it.

Common situations: Runt packets from MTU misconfiguration, truncation by proxies/NATs, scanner noise on the nebula UDP port, corrupted datagrams from the underlay.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/ae88ad39d8de8a27. Report an issue: GitHub.