# ERROR runtime/panic.go:44 ParseMemcache(UDP) exception. Recovering, but please report this

**URL:** https://discuss.elastic.co/t/error-runtime-panic-go-44-parsememcache-udp-exception-recovering-but-please-report-this/198978
**Category:** Beats
**Tags:** packetbeat
**Created:** [September 10, 2019, 9:47pm UTC](https://discuss.elastic.co/t/error-runtime-panic-go-44-parsememcache-udp-exception-recovering-but-please-report-this/198978 "2019-09-10T21:47:30Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![sstover](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@sstover](https://discuss.elastic.co/u/sstover)
#### Post date: [September 10, 2019, 9:47pm UTC](https://discuss.elastic.co/t/error-runtime-panic-go-44-parsememcache-udp-exception-recovering-but-please-report-this/198978/1 "2019-09-10T21:47:30Z")

</div>

Version 7.2.0 Packetbeat on an Ubuntu 14.0.4 host monitoring traffic on a dedicated SPAN port. Crashed on this error:

2019-08-29T18:37:54.446Z ERROR runtime/panic.go:44 ParseMemcache(UDP) exception. Recovering, but please report this. {"panic": "runtime error: index out of range", "stack": "[github.com/elastic/beats/libbeat/logp.Recover\n\t/go/src/github.com/elastic/beats/libbeat/logp/global.go:105\nruntime.gopanic\n\t/usr/local/go/src/runtime/panic.go:522\nruntime.panicindex\n\t/usr/local/go/src/runtime/panic.go:44\ngithub.com/elastic/beats/packetbeat/protos/memcache.(\*udpMessage).addDatagram\n\t/go/src/github.com/elastic/beats/packetbeat/protos/memcache/plugin\_udp.go:316\ngithub.com/elastic/beats/packetbeat/protos/memcache.(\*memcache).ParseUDP\n\t/go/src/github.com/elastic/beats/packetbeat/protos/memcache/plugin\_udp.go:127\ngithub.com/elastic/beats/packetbeat/protos/udp.(\*UDP).Process\n\t/go/src/github.com/elastic/beats/packetbeat/protos/udp/udp.go:76\ngithub.com/elastic/beats/packetbeat/decoder.(\*Decoder).onUDP\n\t/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:335\ngithub.com/elastic/beats/packetbeat/decoder.(\*Decoder).process\n\t/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:283\ngithub.com/elastic/beats/packetbeat/decoder.(\*Decoder).OnPacket\n\t/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:194\ngithub.com/elastic/beats/packetbeat/sniffer.(\*Sniffer).Run\n\t/go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:210\ngithub.com/elastic/beats/packetbeat/beater.(\*packetbeat).Run.func2\n\t/go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:227](http://github.com/elastic/beats/libbeat/logp.Recover/n/t/go/src/github.com/elastic/beats/libbeat/logp/global.go:105/nruntime.gopanic/n/t/usr/local/go/src/runtime/panic.go:522/nruntime.panicindex/n/t/usr/local/go/src/runtime/panic.go:44/ngithub.com/elastic/beats/packetbeat/protos/memcache.(*udpMessage).addDatagram/n/t/go/src/github.com/elastic/beats/packetbeat/protos/memcache/plugin_udp.go:316/ngithub.com/elastic/beats/packetbeat/protos/memcache.(*memcache).ParseUDP/n/t/go/src/github.com/elastic/beats/packetbeat/protos/memcache/plugin_udp.go:127/ngithub.com/elastic/beats/packetbeat/protos/udp.(*UDP).Process/n/t/go/src/github.com/elastic/beats/packetbeat/protos/udp/udp.go:76/ngithub.com/elastic/beats/packetbeat/decoder.(*Decoder).onUDP/n/t/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:335/ngithub.com/elastic/beats/packetbeat/decoder.(*Decoder).process/n/t/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:283/ngithub.com/elastic/beats/packetbeat/decoder.(*Decoder).OnPacket/n/t/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:194/ngithub.com/elastic/beats/packetbeat/sniffer.(*Sniffer).Run/n/t/go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:210/ngithub.com/elastic/beats/packetbeat/beater.(*packetbeat).Run.func2/n/t/go/src/github.com/elastic/beats/packetbeat/beater/packetbeat.go:227)"}

I have not been able to reproduce, but have tcpdump running in case it does.

---

<div class="post-metadata">

### Author: ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)
#### Post date: [September 24, 2019, 3:15pm UTC](https://discuss.elastic.co/t/error-runtime-panic-go-44-parsememcache-udp-exception-recovering-but-please-report-this/198978/2 "2019-09-24T15:15:38Z")

</div>

Hello, thanks for reaching out about this packetbeat issue. Have you experienced this crash again?

Thanks.

---

<div class="post-metadata">

### Author: ![sstover](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@sstover](https://discuss.elastic.co/u/sstover)
#### Post date: [September 24, 2019, 3:28pm UTC](https://discuss.elastic.co/t/error-runtime-panic-go-44-parsememcache-udp-exception-recovering-but-please-report-this/198978/3 "2019-09-24T15:28:45Z")

</div>

Hi Michael - thanks for the response.

Have not reproduced yet, but we are working on a test case in our lab that we are hoping will repeatably reproduce.

Cheers.

---

<div class="post-metadata">

### Author: ![sstover](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@sstover](https://discuss.elastic.co/u/sstover)
#### Post date: [October 1, 2019, 2:58pm UTC](https://discuss.elastic.co/t/error-runtime-panic-go-44-parsememcache-udp-exception-recovering-but-please-report-this/198978/4 "2019-10-01T14:58:11Z")

</div>

We have reproduced the issue and determined the cause. Our vulnerability scanner sends a significant amount of memcached traffic to all IPs in our (small office subnet). The crash occurs reliably during the spike. I do have individual pcaps of the traffic (will upload a moloch screen capture), but aggregating all of them would take some time...

I believe we can close this issue, we'll simply set up a bpf filter for the vuln scanner IP, but if you need/want pcaps we can provide. I believe packetbeat _should_ be able to handle this, but do understand if it can't.

Cheers.

---

<div class="post-metadata">

### Author: ![sstover](https://avatars.discourse-cdn.com/v4/letter/s/f9ae1b/32.png) [@sstover](https://discuss.elastic.co/u/sstover)
#### Post date: [October 1, 2019, 2:59pm UTC](https://discuss.elastic.co/t/error-runtime-panic-go-44-parsememcache-udp-exception-recovering-but-please-report-this/198978/5 "2019-10-01T14:59:24Z")

</div>

![50%20AM](https://us1.discourse-cdn.com/elastic/original/3X/1/0/10c1f26853c8677d75fdeba1f92b6e290f00df98.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 29, 2019, 2:59pm UTC](https://discuss.elastic.co/t/error-runtime-panic-go-44-parsememcache-udp-exception-recovering-but-please-report-this/198978/6 "2019-10-29T14:59:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
