cloudflare/cloudflared · error

received ip status: %s

Error message

received ip status: %s

What it means

In icmpSendEcho, when IcmpSendEcho returns a replyCount of 0, cloudflared attempts to read the IP_STATUS code from bytes 4-8 of the reply buffer. If the status parses and is not the success code, it wraps the error as 'received ip status: <status>'. This means the echo explicitly failed with a Win32 IP status (e.g. IP_DEST_HOST_UNREACHABLE, IP_REQ_TIMED_OUT).

Source

Thrown at ingress/icmp_windows.go:391

	noIPHeaderOption := nullParameter
	inAddr, err := inAddrV4(dst)
	if err != nil {
		return nil, err
	}
	replyCount, _, err := IcmpSendEcho_proc.Call(
		ip.handle,
		uintptr(inAddr),
		uintptr(unsafe.Pointer(&echo.Data[0])),
		uintptr(dataSize),
		noIPHeaderOption,
		uintptr(unsafe.Pointer(&replyBuf[0])),
		replySize,
		icmpRequestTimeoutMs,
	)
	if replyCount == 0 {
		// status is returned in 5th to 8th byte of reply buffer
		if status, parseErr := unmarshalIPStatus(replyBuf[4:8]); parseErr == nil && status != success {
			return nil, errors.Wrapf(err, "received ip status: %s", status)
		}
		return nil, errors.Wrap(err, "did not receive ICMP echo reply")
	} else if replyCount > 1 {
		ip.logger.Warn().Msgf("Received %d ICMP echo replies, only sending 1 back", replyCount)
	}
	return newEchoV4Resp(replyBuf)
}

// Third definition of https://docs.microsoft.com/en-us/windows/win32/api/inaddr/ns-inaddr-in_addr#syntax is address in uint32
func inAddrV4(ip netip.Addr) (uint32, error) {
	if !ip.Is4() {
		return 0, fmt.Errorf("%s is not IPv4", ip)
	}
	v4 := ip.As4()
	return endian.Uint32(v4[:]), nil
}

type echoResp interface {

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Decode the status: IP_REQ_TIMED_OUT means drops/timeouts; IP_DEST_HOST_UNREACHABLE means no route/host down — fix routing or the target.
2. Verify the destination is up and answers ICMP using the OS ping tool.
3. Check intermediate firewalls that drop ICMP and increase timeout expectations.
4. Retry the probe if the status indicates a transient condition (timeout).

// Go: decode the wrapped IP status and branch on it
resp, err := proxy.Request(ctx, dst, echo)
if err != nil {
	if strings.Contains(err.Error(), "received ip status: IP_REQ_TIMED_OUT") {
		// treat as transient timeout: retry or mark degraded
	} else {
		// unreachable/permission style failure: stop probing this target
	}
}

When it happens

Trigger: IcmpSendEcho returns 0 replies and the reply buffer carries a failure status: destination host/network unreachable, TTL expired in transit, request timed out, or destination port/protocol unreachable.

Common situations: Pinging a host that is down or behind a firewall dropping ICMP, routing loops causing TTL expiry, or transient network outages during connectivity checks through the tunnel.

Related errors

• failed to send/receive ICMPv6 echo
• failed to send/receive ICMPv4 echo
• did not receive ICMP echo reply
• funnel not found
• expect IPv4, but %s is IPv6

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/00fc57d3f84208dd. Report an issue: GitHub.