slackhq/nebula · warning

ErrPacketTooShort

ErrPacketTooShort

Error message

packet is too short

What it means

ErrPacketTooShort (declared in handshake/errors.go as "packet too short" and in outside.go as "packet is too short") is returned when a received packet is shorter than the minimal header length required to parse it — either the handshake header (machine.go) or the minimum firewall packet length.

Source

Thrown at outside.go:311

					"newAddr", via.UdpAddr,
				)
			}
			return
		}

		hostinfo.logger(f.l).Info("Host roamed to new udp ip/port.",
			"udpAddr", curRemote,
			"newAddr", via.UdpAddr,
		)
		hostinfo.lastRoam = time.Now()
		hostinfo.lastRoamRemote = curRemote
		hostinfo.SetRemote(via.UdpAddr)
	}

}

var (
	ErrPacketTooShort          = errors.New("packet is too short")
	ErrUnknownIPVersion        = errors.New("packet is an unknown ip version")
	ErrIPv4InvalidHeaderLength = errors.New("invalid ipv4 header length")
	ErrIPv4PacketTooShort      = errors.New("ipv4 packet is too short")
	ErrIPv6PacketTooShort      = errors.New("ipv6 packet is too short")
)

// newPacket validates and parses the interesting bits for the firewall out of the ip and sub protocol headers
func newPacket(data []byte, incoming bool, fp *firewall.ParsedPacket) error {
	// fp is reused across packets; reset the parse byproducts so an early-error return cannot
	// leak the previous packet's offsets.
	fp.IPHdrLen = 0
	fp.FragAny = false
	if len(data) < 1 {
		return ErrPacketTooShort
	}

	version := int((data[0] >> 4) & 0x0f)
	switch version {

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Capture the traffic hitting the port and identify the source of malformed packets.
2. Check for NAT/firewall middleboxes truncating UDP payloads.
3. Confirm both peers run compatible nebula versions with the same header layout.

if len(packet) < handshake.HeaderLen {
    // reject before calling ProcessPacket
    return errors.New("packet below minimum handshake header size")
}

p, h, err := m.ProcessPacket(packet)
if errors.Is(err, handshake.ErrPacketTooShort) {
    // log source addr and drop
}

When it happens

Trigger: ProcessPacket/newPacket receives a packet shorter than header.Len (handshake/machine.go:208) or the minimal packet length (outside.go:311).

Common situations: UDP payloads truncated by MTU issues or middleboxes, garbage/scanner traffic hitting the nebula port, version mismatch causing header length misinterpretation.

Related errors

• ErrPacketTooShort
• ErrIPv6CouldNotFindPayload
• ErrBadDetailsVpnAddr
• ErrUnknownIPVersion
• ErrIPv4InvalidHeaderLength

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/5356c54dfbc259a0. Report an issue: GitHub.