cloudflare/cloudflared · error

did not find group range in %s

Error message

did not find group range in %s

What it means

checkInPingGroup reads /proc/sys/net/ipv4/ping_group_range and expects contents matching a '<min> <max>' pattern. If the regex finds no group range in the file, cloudflared cannot determine whether the process group may open ping sockets and returns this error instead of proceeding.

Source

Thrown at ingress/icmp_linux.go:96

	}
	groupID := uint64(os.Getegid())
	// Example content: 999	   59999
	found := findGroupIDRegex.FindAll(file, 2)
	if len(found) == 2 {
		groupMin, err := strconv.ParseUint(string(found[0]), 10, 32)
		if err != nil {
			return errors.Wrapf(err, "failed to determine minimum ping group ID")
		}
		groupMax, err := strconv.ParseUint(string(found[1]), 10, 32)
		if err != nil {
			return errors.Wrapf(err, "failed to determine maximum ping group ID")
		}
		if groupID < groupMin || groupID > groupMax {
			return fmt.Errorf("Group ID %d is not between ping group %d to %d", groupID, groupMin, groupMax)
		}
		return nil
	}
	return fmt.Errorf("did not find group range in %s", pingGroupPath)
}

func (ip *icmpProxy) Request(ctx context.Context, pk *packet.ICMP, responder ICMPResponder) error {
	ctx, span := responder.RequestSpan(ctx, pk)
	defer responder.ExportSpan()

	originalEcho, err := getICMPEcho(pk.Message)
	if err != nil {
		tracing.EndWithErrorStatus(span, err)
		return err
	}
	observeICMPRequest(ip.logger, span, pk.Src.String(), pk.Dst.String(), originalEcho.ID, originalEcho.Seq)

	shouldReplaceFunnelFunc := createShouldReplaceFunnelFunc(ip.logger, responder, pk, originalEcho.ID)
	newFunnelFunc := func() (packet.Funnel, error) {
		conn, err := newICMPConn(ip.listenIP)
		if err != nil {
			tracing.EndWithErrorStatus(span, err)

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Check that `cat /proc/sys/net/ipv4/ping_group_range` prints two numbers like '0 2147483647'; if missing, the kernel lacks unprivileged ping support.
2. Run in a full Linux environment where /proc/sys/net/ipv4/ping_group_range is exposed (reconfigure the container to mount /proc read-write for sysctls, e.g. docker run --sysctl net.ipv4.ping_group_range='0 2147483647').
3. Set the sysctl explicitly: `sudo sysctl -w net.ipv4.ping_group_range="0 2147483647"` then retry cloudflared.
4. If the environment cannot expose ping_group_range, run cloudflared as root or grant CAP_NET_RAW so the unprivileged ping path is not needed.

function pingGroupRangeReadable(): boolean {
  try {
    const v = fs.readFileSync('/proc/sys/net/ipv4/ping_group_range', 'utf8').trim();
    return /^\d+\s+\d+$/.test(v);
  } catch { return false; }
}

func pingGroupRangeValid() bool {
    data, err := os.ReadFile("/proc/sys/net/ipv4/ping_group_range")
    if err != nil { return false }
    re := regexp.MustCompile(`^\s*(\d+)\s+(\d+)\s*$`)
    return re.Match(data)
}

When it happens

Trigger: testPermission -> checkInPingGroup when /proc/sys/net/ipv4/ping_group_range is unreadable, empty, or has unexpected content that doesn't match the expected `uint uint` format (found regex fails).

Common situations: Unusual or minimal kernels/containers that omit ping_group_range from procfs; mounted /proc with restricted visibility (e.g. hardened containers hiding the sysctl); malformed proc values.

Understand the failure class

Background: "failed to read file", EACCES, ENOENT and "could not read <path>" errors: when a program can't read a file from disk — this error's family across 49 libraries.

Related errors

• Group ID %d is not between ping group %d to %d
• error determining executable path: %v
• could not write token to configuration directory: %w
• ICMP proxy is not implemented on %s %s
• cannot send ICMPv6 using ICMPv4 proxy

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/73d6df3c14f0ddef. Report an issue: GitHub.