AdguardTeam/AdGuardHome · error

unexpected ipset family %q

Error message

unexpected ipset family %q

What it means

When querying an ipset's header, the kernel returned a family value that is neither inet (IPv4) nor inet6 (IPv6). This is a defensive check on netfilter protocol family data.

Source

Thrown at internal/ipset/ipset_linux.go:320

// TODO(s.chzhen):  Use *props.
func (m *manager) ipsetProps(name string) (p props, err error) {
	// The family doesn't seem to matter when we use a header query, so
	// query only the IPv4 one.
	//
	// TODO(a.garipov): Find out if this is a bug or a feature.
	var res *ipset.HeaderPolicy
	res, err = m.ipv4Conn.Header(name)
	if err != nil {
		return props{}, err
	}

	if res == nil || res.Family == nil {
		return props{}, errors.Error("empty response or no family data")
	}

	family := netfilter.ProtoFamily(res.Family.Value)
	if family != netfilter.ProtoIPv4 && family != netfilter.ProtoIPv6 {
		return props{}, fmt.Errorf("unexpected ipset family %q", family)
	}

	typeName := res.TypeName.Get()

	return props{
		name:         name,
		typeName:     typeName,
		family:       family,
		isPersistent: false,
	}, nil
}

// ipsets returns ipset properties of currently known ipsets.  It also makes an
// additional ipset header data query if needed.
func (m *manager) ipsets(
	ctx context.Context,
	names []string,
	currentlyKnown map[string]props,

View on GitHub (pinned to b41aefbe51)

Solutions

1. Verify with 'ipset list <name>' that the set reports family inet or inet6
2. Recreate the set with an explicit family
3. Upgrade/downgrade to a matching kernel+ipset pairing

Example fix

ipset destroy myset
ipset create myset hash:net family inet6

out, err := exec.Command("ipset", "list", name, "-t").Output()
if err != nil || !strings.Contains(string(out), "family inet") {
	return fmt.Errorf("set %s has unsupported family", name)
}

When it happens

Trigger: m.ipsetProps reads res.Family from a netlink header query and the numeric family is outside {2 (inet), 10 (inet6)} — malformed response or exotic set family.

Common situations: Kernel/ipset version mismatch (very new ipset types), corrupted netlink response, or a mock/test stub returning an invalid family.

Related errors

• invalid value %q: expected one slash
• invalid value %q: empty ipset name
• %q %q making header query: %w
• adding %q%s to %q %q: %w
• json time is nil

AI-assisted analysis of AdguardTeam/AdGuardHome@b41aefbe51 (2026-08-27). Data as JSON: /api/errors/2dafba61746751e0. Report an issue: GitHub.