slackhq/nebula · warning

ErrUnknownIPVersion

ErrUnknownIPVersion

Error message

packet is an unknown ip version

What it means

newPacket inspects the IP version nibble of each received packet so the firewall can parse IPv4 or IPv6 headers. Any version other than 4 or 6 is rejected with ErrUnknownIPVersion because nebula cannot compute firewall rules for unknown protocols.

Source

Thrown at outside.go:312

				)
			}
			return
		}

		hostinfo.logger(f.l).Info("Host roamed to new udp ip/port.",
			"udpAddr", curRemote,
			"newAddr", via.UdpAddr,
		)
		hostinfo.lastRoam = time.Now()
		hostinfo.lastRoamRemote = curRemote
		hostinfo.SetRemote(via.UdpAddr)
	}

}

var (
	ErrPacketTooShort          = errors.New("packet is too short")
	ErrUnknownIPVersion        = errors.New("packet is an unknown ip version")
	ErrIPv4InvalidHeaderLength = errors.New("invalid ipv4 header length")
	ErrIPv4PacketTooShort      = errors.New("ipv4 packet is too short")
	ErrIPv6PacketTooShort      = errors.New("ipv6 packet is too short")
)

// newPacket validates and parses the interesting bits for the firewall out of the ip and sub protocol headers
func newPacket(data []byte, incoming bool, fp *firewall.ParsedPacket) error {
	// fp is reused across packets; reset the parse byproducts so an early-error return cannot
	// leak the previous packet's offsets.
	fp.IPHdrLen = 0
	fp.FragAny = false
	if len(data) < 1 {
		return ErrPacketTooShort
	}

	version := int((data[0] >> 4) & 0x0f)
	switch version {
	case ipv4.Version:

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Verify only IPv4/IPv6 traffic is routed into the nebula interface.
2. Check overlay/underlay routing for misrouted non-IP frames.
3. Capture the packet and inspect the first byte's version nibble.

Example fix

// before: raw frame sent into tunnel
iface.Write(ethernetFrame)
// after
if ipPacket := extractIP(frame); ipPacket != nil { iface.Write(ipPacket) }

if len(data) > 0 && data[0]>>4 != 4 && data[0]>>4 != 6 {
    return errors.New("not an IPv4/IPv6 packet")
}

if errors.Is(err, outside.ErrUnknownIPVersion) {
    // drop packet and log the raw first byte for diagnosis
}

When it happens

Trigger: newPacket is called with data whose first nibble is neither 0x4 nor 0x6 (outside.go:335 return path); Test_newPacket feeds a zero-filled packet to trigger it.

Common situations: Non-IP traffic or corrupted packets reaching the tunnel interface, misconfigured overlay networks injecting raw frames, bit-flips or truncation corrupting the IP header.

Related errors

• ErrIPv6CouldNotFindPayload
• ErrBadDetailsVpnAddr
• ErrPacketTooShort
• ErrIPv6PacketTooShort
• errPacketTooShort

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/ec498785873f1fe5. Report an issue: GitHub.