slackhq/nebula · error

INetworkListManager.GetNetworkConnections: %s

Error message

INetworkListManager.GetNetworkConnections: %s

What it means

This error wraps a failed HRESULT from the COM method INetworkListManager::GetNetworkConnections, used by Nebula on Windows to enumerate network connections when classifying the network category. A failed HRESULT here means the COM call into the Windows Network List Manager (NLM) service did not succeed (e.g. service unavailable, COM not initialized, or access denied). The hresult is formatted into the message.

Source

Thrown at overlay/network_category_windows.go:128

	GetNetworkConnection  uintptr
	IsConnectedToInternet uintptr
	IsConnected           uintptr
	GetConnectivity       uintptr
}

type iNetworkListManager struct{ Vtbl *iNetworkListManagerVtbl }

func (n *iNetworkListManager) Release() {
	syscall.SyscallN(n.Vtbl.Release, uintptr(unsafe.Pointer(n)))
}

func (n *iNetworkListManager) GetNetworkConnections() (*iEnumNetworkConnections, error) {
	var enum *iEnumNetworkConnections
	r1, _, _ := syscall.SyscallN(n.Vtbl.GetNetworkConnections,
		uintptr(unsafe.Pointer(n)), uintptr(unsafe.Pointer(&enum)),
	)
	if hr := hresult(r1); hr.failed() {
		return nil, fmt.Errorf("INetworkListManager.GetNetworkConnections: %s", hr)
	}
	return enum, nil
}

type iEnumNetworkConnectionsVtbl struct {
	iDispatchVtbl
	NewEnum uintptr
	Next    uintptr
	Skip    uintptr
	Reset   uintptr
	Clone   uintptr
}

type iEnumNetworkConnections struct{ Vtbl *iEnumNetworkConnectionsVtbl }

func (e *iEnumNetworkConnections) Release() {
	syscall.SyscallN(e.Vtbl.Release, uintptr(unsafe.Pointer(e)))
}

View on GitHub (pinned to dd8f660c0a)

Solutions

  1. Ensure the 'Network List Service' (netprofm) and related services are running: sc query netprofm / net start netprofm
  2. Verify COM was initialized on the calling thread (coInit succeeded, correct apartment model) before the call
  3. Run the process under an account with rights to query network state; test outside a heavily restricted service context
  4. Decode the hresult (e.g. 0x80004005 vs RPC_E_*) to identify the precise COM failure and address it
  5. If classification is optional, treat the failure as non-fatal and fall back to leaving the category unset

Example fix

// before
conns, err := nlm.GetNetworkConnections()
if err != nil { return err }
// after: degrade gracefully
conns, err := nlm.GetNetworkConnections()
if err != nil {
    l.WithError(err).Warn("unable to enumerate network connections; skipping category detection")
    return nil
}
Defensive patterns

Strategy: try-catch

Validate before calling

// preflight: ensure the Network List Service is reachable before classification
func nlmAvailable() error {
    s, err := svcQuery("netprofm")
    if err != nil { return err }
    if s != "RUNNING" { return fmt.Errorf("netprofm is %s", s) }
    return nil
}

Type guard

func isHresultError(err error) bool {
    return err != nil && strings.HasPrefix(err.Error(), "INetworkListManager.")
}

Try / catch

conns, err := nlm.GetNetworkConnections()
if err != nil {
    log.Warnf("NLM unavailable, skipping category detection: %v", err)
    return nil // degrade gracefully
}

Prevention

When it happens

Trigger: Calling GetNetworkConnections() during tun setup (via newTun → network category detection) when the NLM COM object's vtbl call returns a failing HRESULT, such as when the NlaSvc/network service is stopped or COM initialization failed on the thread.

Common situations: Windows Network List Manager service (netprofm/NlaSvc) disabled or crashed; running in a service/session context where COM apartment initialization differs; restricted service accounts lacking permission; heavily locked-down or stripped Windows images.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/b9df73c3a9eb7c9f. Report an issue: GitHub.