AdguardTeam/AdGuardHome · error

unexpected family %s for ipset %q

Error message

unexpected family %s for ipset %q

What it means

addIPs selects the v4 or v6 netfilter connection based on set.family; hitting the default branch means family is neither ProtoIPv4 nor ProtoIPv6 — corrupted or stale set properties.

Source

Thrown at internal/ipset/ipset_linux.go:469

		}

		entries = append(entries, ipset.NewEntry(ipset.EntryIP(ip)))
		newAddedEntries = append(newAddedEntries, e)
	}

	n = len(entries)
	if n == 0 {
		return 0, nil
	}

	var conn ipsetConn
	switch set.family {
	case netfilter.ProtoIPv4:
		conn = m.ipv4Conn
	case netfilter.ProtoIPv6:
		conn = m.ipv6Conn
	default:
		return 0, fmt.Errorf("unexpected family %s for ipset %q", set.family, set.name)
	}

	err = conn.Add(set.name, entries...)
	if err != nil {
		return 0, fmt.Errorf("adding %q%s to %q %q: %w", host, ips, set.name, set.typeName, err)
	}

	// Only add these to the cache once we're sure that all of them were
	// actually sent to the ipset.
	for _, e := range newAddedEntries {
		s := m.nameToIpset[e.ipsetName]
		if s.isPersistent {
			m.addedIPs.Add(e)
		}
	}

	return n, nil
}

View on GitHub (pinned to b41aefbe51)

Solutions

  1. Restart the service so sets are re-enumerated
  2. Recreate the ipset with an explicit family
  3. Report as a bug if reproducible with stock kernel
Defensive patterns

Strategy: fallback

Type guard

func validFamily(f netfilter.ProtoFamily) bool {
	return f == netfilter.ProtoIPv4 || f == netfilter.ProtoIPv6
}

Prevention

When it happens

Trigger: A props struct in the cache was built with an invalid family (e.g. from a malformed header response) and is then used when adding entries.

Common situations: Internal invariant break after kernel/ipset version changes or concurrent set recreation with a different family; very unlikely in normal operation.

Related errors


AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/0a4d2de9f12fb5c9. Report an issue: GitHub.