What causes "funnel not found" in cloudflare/cloudflared?

Retransmit the original ICMP echo/ping to re-establish the funnel, then expect the reply

funnel not found

Error message

funnel not found

What it means

ErrFunnelNotFound (public) is returned by the packet funnel registry when a lookup by funnel ID fails — no active funnel exists for that key. In ICMP proxying it means the ICMP echo came from a source with no tracked funnel (e.g. an unsolicited or expired reply path).

Source

Thrown at packet/funnel.go:14

package packet

import (
	"context"
	"errors"
	"fmt"
	"net/netip"
	"sync"
	"sync/atomic"
	"time"
)

var (
	ErrFunnelNotFound = errors.New("funnel not found")
)

// Funnel is an abstraction to pipe from 1 src to 1 or more destinations
type Funnel interface {
	// Updates the last time traffic went through this funnel
	UpdateLastActive()
	// LastActive returns the last time there is traffic through this funnel
	LastActive() time.Time
	// Close closes the funnel. Further call to SendToDst or ReturnToSrc should return an error
	Close() error
	// Equal compares if 2 funnels are equivalent
	Equal(other Funnel) bool
}

// FunnelUniPipe is a unidirectional pipe for sending raw packets
type FunnelUniPipe interface {
	// SendPacket sends a packet to/from the funnel. It must not modify the packet,
	// and after return it must not read the packet

View on GitHub (pinned to 2253eeeb25)

Solutions

Retransmit the original ICMP echo/ping to re-establish the funnel, then expect the reply
Check that the client session that created the funnel is still alive
Ignore the error for unsolicited ICMP replies — it is expected for expired funnels
Increase keepalive/idle settings so long-lived pings do not let the funnel expire

Defensive patterns

Strategy: try-catch

Try / catch

funnel, ok := tracker.Get(funnelID)
if !ok {
    // expected for expired funnels; drop the packet instead of treating as fatal
    return packet.ErrFunnelNotFound
}

Prevention

Treat ErrFunnelNotFound as non-fatal for unsolicited ICMP replies
Keep client sessions alive while pings are in flight
Re-ping to recreate the funnel instead of relying on stale reply paths

When it happens

Trigger: sendReply-related flow: ip.srcFunnelTracker.Get(funnelID) returns ok=false in ingress/icmp_darwin.go, typically when an ICMP response arrives after the funnel was closed or never registered.

Common situations: Stale ICMP echo replies arriving after the originating connection's funnel expired; ICMP traffic from a source that never opened a funnel through the tunnel.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/c91a323d73c1f7e8. Report an issue: GitHub.