{"record":{"id":"73d6df3c14f0ddef","repo":"cloudflare/cloudflared","slug":"did-not-find-group-range-in-s","errorCode":null,"errorMessage":"did not find group range in %s","messagePattern":"did not find group range in (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/icmp_linux.go","lineNumber":96,"sourceCode":"\t}\n\tgroupID := uint64(os.Getegid())\n\t// Example content: 999\t   59999\n\tfound := findGroupIDRegex.FindAll(file, 2)\n\tif len(found) == 2 {\n\t\tgroupMin, err := strconv.ParseUint(string(found[0]), 10, 32)\n\t\tif err != nil {\n\t\t\treturn errors.Wrapf(err, \"failed to determine minimum ping group ID\")\n\t\t}\n\t\tgroupMax, err := strconv.ParseUint(string(found[1]), 10, 32)\n\t\tif err != nil {\n\t\t\treturn errors.Wrapf(err, \"failed to determine maximum ping group ID\")\n\t\t}\n\t\tif groupID < groupMin || groupID > groupMax {\n\t\t\treturn fmt.Errorf(\"Group ID %d is not between ping group %d to %d\", groupID, groupMin, groupMax)\n\t\t}\n\t\treturn nil\n\t}\n\treturn fmt.Errorf(\"did not find group range in %s\", pingGroupPath)\n}\n\nfunc (ip *icmpProxy) Request(ctx context.Context, pk *packet.ICMP, responder ICMPResponder) error {\n\tctx, span := responder.RequestSpan(ctx, pk)\n\tdefer responder.ExportSpan()\n\n\toriginalEcho, err := getICMPEcho(pk.Message)\n\tif err != nil {\n\t\ttracing.EndWithErrorStatus(span, err)\n\t\treturn err\n\t}\n\tobserveICMPRequest(ip.logger, span, pk.Src.String(), pk.Dst.String(), originalEcho.ID, originalEcho.Seq)\n\n\tshouldReplaceFunnelFunc := createShouldReplaceFunnelFunc(ip.logger, responder, pk, originalEcho.ID)\n\tnewFunnelFunc := func() (packet.Funnel, error) {\n\t\tconn, err := newICMPConn(ip.listenIP)\n\t\tif err != nil {\n\t\t\ttracing.EndWithErrorStatus(span, err)","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/icmp_linux.go#L78-L114","documentation":"checkInPingGroup reads /proc/sys/net/ipv4/ping_group_range and expects contents matching a '<min> <max>' pattern. If the regex finds no group range in the file, cloudflared cannot determine whether the process group may open ping sockets and returns this error instead of proceeding.","triggerScenarios":"testPermission -> checkInPingGroup when /proc/sys/net/ipv4/ping_group_range is unreadable, empty, or has unexpected content that doesn't match the expected `uint uint` format (found regex fails).","commonSituations":"Unusual or minimal kernels/containers that omit ping_group_range from procfs; mounted /proc with restricted visibility (e.g. hardened containers hiding the sysctl); malformed proc values.","solutions":["Check that `cat /proc/sys/net/ipv4/ping_group_range` prints two numbers like '0 2147483647'; if missing, the kernel lacks unprivileged ping support.","Run in a full Linux environment where /proc/sys/net/ipv4/ping_group_range is exposed (reconfigure the container to mount /proc read-write for sysctls, e.g. docker run --sysctl net.ipv4.ping_group_range='0 2147483647').","Set the sysctl explicitly: `sudo sysctl -w net.ipv4.ping_group_range=\"0 2147483647\"` then retry cloudflared.","If the environment cannot expose ping_group_range, run cloudflared as root or grant CAP_NET_RAW so the unprivileged ping path is not needed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function pingGroupRangeReadable(): boolean {\n  try {\n    const v = fs.readFileSync('/proc/sys/net/ipv4/ping_group_range', 'utf8').trim();\n    return /^\\d+\\s+\\d+$/.test(v);\n  } catch { return false; }\n}","typeGuard":"func pingGroupRangeValid() bool {\n    data, err := os.ReadFile(\"/proc/sys/net/ipv4/ping_group_range\")\n    if err != nil { return false }\n    re := regexp.MustCompile(`^\\s*(\\d+)\\s+(\\d+)\\s*$`)\n    return re.Match(data)\n}","tryCatchPattern":null,"preventionTips":["Confirm the kernel exposes /proc/sys/net/ipv4/ping_group_range (standard since Linux 2.6.39).","Mount /proc fully in containers; avoid hardened setups that hide this sysctl.","Set the sysctl explicitly before starting cloudflared.","Fall back to running as root/CAP_NET_RAW on minimal kernels lacking the sysctl."],"tags":["icmp","linux","procfs","ping-group-range","cloudflared"],"backgroundTag":"file-read-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}