tailscale/tailscale · error

got data packet from unexpected source, %v

Error message

got data packet from unexpected source, %v

What it means

The receiving DERP client got a derp.ReceivedPacket whose v.Source key differs from the sending client's public key. A derper only forwards packets addressed to this client's key, so traffic from any other source key means some other sender targeted the receiver's key - typically key reuse across prober instances or stale packets still in flight after a reconnect.

Source

Thrown at prober/derp.go:500

		}
	})

	// Receive the packets.
	recvFinishedC := make(chan error, 1)
	wg.Go(func() {
		defer close(recvFinishedC) // to break out of 'select' below.
		fromDERPPubKey := fromc.SelfPublicKey()
		for {
			m, err := toc.Recv()
			if err != nil {
				recvFinishedC <- err
				return
			}
			switch v := m.(type) {
			case derp.ReceivedPacket:
				now := time.Now()
				if v.Source != fromDERPPubKey {
					recvFinishedC <- fmt.Errorf("got data packet from unexpected source, %v", v.Source)
					return
				}
				seq := binary.BigEndian.Uint64(v.Data)
				txRecordsMu.Lock()
			findTxRecord:
				for i, record := range txRecords {
					switch {
					case record.seq == seq:
						rtt := now.Sub(record.at)
						qdh.add(rtt.Seconds())
						txRecords = slices.Delete(txRecords, i, i+1)
						break findTxRecord
					case record.seq > seq:
						// No sent time found, probably a late arrival already
						// recorded as drop by sender when deleted.
						break findTxRecord
					case record.seq < seq:
						continue

View on GitHub (pinned to 5201273aec)

Solutions

1. Confirm only one prober instance is using this receiver key pair
2. Regenerate the prober client keys so no other sender can address them
3. Capture the offending v.Source key printed in the error and search derper logs for its connection
4. Re-run once - a single occurrence right after restart is likely a stale in-flight packet

switch v := m.(type) {
case derp.ReceivedPacket:
	if v.Source != wantKey {
		// Option A (prober semantics): fail loudly, as the code does.
		// Option A is recommended: an unexpected source on a fresh per-run key
		// almost certainly means key reuse or misforwarding - investigate.
		return fmt.Errorf("got data packet from unexpected source, %v", v.Source)
	}
}

When it happens

Trigger: Running two prober instances that reuse the same client key pair; a late packet from a previous connection arriving after the client reconnected with a new key; a derper misforwarding traffic between clients.

Common situations: Duplicated prober deployments sharing generated keys or state directories; old and new prober running concurrently during a rollout; rarely, a derper forwarding bug.

Related errors

• %s -> %s: %w
• sending packet %w
• timeout: %w
• error sending via %q: %w
• error receiving from %q: %w

AI-assisted analysis of tailscale/tailscale@5201273aec (2026-08-18). Data as JSON: /api/errors/161772b6e2abd069. Report an issue: GitHub.