Dear Maintainer,

check_icmp does not work on Trixie for non-root users, as special capabilties are required to send ICMP packages.
Please consider adding the required capabilities, e.g. setcap cap_net_raw+ep /usr/lib/nagios/plugins/check_icmp

Control: tags -1 unreproducible

It works as expected on my trixie systems:

  # sudo -u nagios /usr/lib/nagios/plugins/check_icmp -H 10.0.0.150 -v
  ttl set to 64
  Setting alarm timeout to 10 seconds
  packets: 5, targets: 1
  target_interval: 0.000, pkt_interval 80.000
  crit.rta: 500.000
  max_completion_time: 3400.000
  crit = {500000, 80%}, warn = {200000, 40%}
  pkt_interval: 80000  target_interval: 0  retry_interval: 0
  icmp_pkt_size: 76  timeout: 10
  0.181 ms rtt from 10.0.0.150, outgoing ttl: 64, incoming ttl: 64, max: 0.181, min: 0.181
  0.057 ms rtt from 10.0.0.150, outgoing ttl: 64, incoming ttl: 64, max: 0.181, min: 0.057
  0.043 ms rtt from 10.0.0.150, outgoing ttl: 64, incoming ttl: 64, max: 0.181, min: 0.043
  0.045 ms rtt from 10.0.0.150, outgoing ttl: 64, incoming ttl: 64, max: 0.181, min: 0.043
  0.045 ms rtt from 10.0.0.150, outgoing ttl: 64, incoming ttl: 64, max: 0.181, min: 0.043
  icmp_sent: 5  icmp_recv: 5  icmp_lost: 0
  targets: 1  targets_alive: 1
  OK -
  10.0.0.150 rta 0.074ms lost 0%|
  rta=0.074ms;200.000;500.000;0; rtmax=0.181ms;;;; rtmin=0.043ms;;;; pl=0%;40;80;0;100
  targets: 1, targets_alive: 1, hosts_ok: 1, hosts_warn: 0, min_hosts_alive: -1

The linux-sysctl-defaults package does this, see:

https://www.debian.org/releases/trixie/release-notes/issues.en.html#ping-no-longer-runs-with-elevated-privileges

Setting in question:

  # grep -B6 ping_group_range /usr/lib/sysctl.d/50-default.conf
  # ping(8) without CAP_NET_ADMIN and CAP_NET_RAW
  # The upper limit is set to 2^31-1. Values greater than that get rejected by
  # the kernel because of this definition in linux/include/net/ping.h:
  #   #define GID_T_MAX (((gid_t)~0U) >> 1)
  # That's not so bad because values between 2^31 and 2^32-1 are reserved on
  # systemd-based systems anyway: https://systemd.io/UIDS-GIDS#summary
  -net.ipv4.ping_group_range = 0 2147483647

Kind Regards,

Bas

Am 18.08.25 um 08:55 schrieb Sebastiaan Couwenberg:

 >> Please consider adding the required capabilities, e.g. setcap cap_net_raw+ep /usr/lib/nagios/plugins/check_icmp
 >
 > The linux-sysctl-defaults package does this, see:
 >
 >   https://www.debian.org/releases/trixie/release-notes/issues.en.html#ping-no-longer-runs-with-elevated-privileges

True, the package is much nicer than setcap.
I believe it would make sense that the monitoring-plugins-basic package would recommend linux-sysctl-defaults, just like iputils-ping does.