{"record":{"id":"00fc57d3f84208dd","repo":"cloudflare/cloudflared","slug":"received-ip-status-s","errorCode":null,"errorMessage":"received ip status: %s","messagePattern":"received ip status: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/icmp_windows.go","lineNumber":391,"sourceCode":"\tnoIPHeaderOption := nullParameter\n\tinAddr, err := inAddrV4(dst)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\treplyCount, _, err := IcmpSendEcho_proc.Call(\n\t\tip.handle,\n\t\tuintptr(inAddr),\n\t\tuintptr(unsafe.Pointer(&echo.Data[0])),\n\t\tuintptr(dataSize),\n\t\tnoIPHeaderOption,\n\t\tuintptr(unsafe.Pointer(&replyBuf[0])),\n\t\treplySize,\n\t\ticmpRequestTimeoutMs,\n\t)\n\tif replyCount == 0 {\n\t\t// status is returned in 5th to 8th byte of reply buffer\n\t\tif status, parseErr := unmarshalIPStatus(replyBuf[4:8]); parseErr == nil && status != success {\n\t\t\treturn nil, errors.Wrapf(err, \"received ip status: %s\", status)\n\t\t}\n\t\treturn nil, errors.Wrap(err, \"did not receive ICMP echo reply\")\n\t} else if replyCount > 1 {\n\t\tip.logger.Warn().Msgf(\"Received %d ICMP echo replies, only sending 1 back\", replyCount)\n\t}\n\treturn newEchoV4Resp(replyBuf)\n}\n\n// Third definition of https://docs.microsoft.com/en-us/windows/win32/api/inaddr/ns-inaddr-in_addr#syntax is address in uint32\nfunc inAddrV4(ip netip.Addr) (uint32, error) {\n\tif !ip.Is4() {\n\t\treturn 0, fmt.Errorf(\"%s is not IPv4\", ip)\n\t}\n\tv4 := ip.As4()\n\treturn endian.Uint32(v4[:]), nil\n}\n\ntype echoResp interface {","sourceCodeStart":373,"sourceCodeEnd":409,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/icmp_windows.go#L373-L409","documentation":"In icmpSendEcho, when IcmpSendEcho returns a replyCount of 0, cloudflared attempts to read the IP_STATUS code from bytes 4-8 of the reply buffer. If the status parses and is not the success code, it wraps the error as 'received ip status: <status>'. This means the echo explicitly failed with a Win32 IP status (e.g. IP_DEST_HOST_UNREACHABLE, IP_REQ_TIMED_OUT).","triggerScenarios":"IcmpSendEcho returns 0 replies and the reply buffer carries a failure status: destination host/network unreachable, TTL expired in transit, request timed out, or destination port/protocol unreachable.","commonSituations":"Pinging a host that is down or behind a firewall dropping ICMP, routing loops causing TTL expiry, or transient network outages during connectivity checks through the tunnel.","solutions":["Decode the status: IP_REQ_TIMED_OUT means drops/timeouts; IP_DEST_HOST_UNREACHABLE means no route/host down — fix routing or the target.","Verify the destination is up and answers ICMP using the OS ping tool.","Check intermediate firewalls that drop ICMP and increase timeout expectations.","Retry the probe if the status indicates a transient condition (timeout)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Go: decode the wrapped IP status and branch on it\nresp, err := proxy.Request(ctx, dst, echo)\nif err != nil {\n\tif strings.Contains(err.Error(), \"received ip status: IP_REQ_TIMED_OUT\") {\n\t\t// treat as transient timeout: retry or mark degraded\n\t} else {\n\t\t// unreachable/permission style failure: stop probing this target\n\t}\n}","preventionTips":["Decode the specific IP_STATUS to distinguish timeouts from unreachable hosts.","Keep probe targets verified with OS ping before adding them to health checks.","Rate-limit probes so firewalls do not start dropping them."],"tags":["icmp","windows","ip-status","network"],"backgroundTag":"network-request-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}