[Bug] Ping is failing during internet check starting from v1.13.0

[BizkitCake]

Pre-work

• I have read the docs.
• I have searched open and closed issues.
• I agree to follow this project's Code of Conduct.

Description

Ping is failing in versions after v1.13.0 including the latest.
Last version where everything worked - v1.12.4

If i change version to 1.12.4 - it is working fine.
I noticed it, because my internet speed monitoring stopped working for month without me doing any changes. Research led me to #2560 but I've tried this version and it persists.

Error shown in Results dashboard per failed test: Failed to connected to hostname "icanhazip.com". Error received "unknownError".

If i switch image to 1.12.4 - it works perfectly fine without any other changes.

Results Dashboard with versions tested.

Expected Behavior

Ping command not failing, so the whole test is running successfully.

Steps to Reproduce

1. Deploy version after 1.12.4
2. Run test on unprivileged docker container

Deployment Environment

Docker Compose

Application Information

services:
  speedtest:
    image: lscr.io/linuxserver/speedtest-tracker:1.13.4
    restart: unless-stopped
    container_name: speedtest-tracker
    security_opt:
      - no-new-privileges:true
    networks:
      - t3_proxy
    environment:
      - PUID=1000
      - PGID=1000
      - APP_KEY=****
      - DB_CONNECTION=sqlite
      - SPEEDTEST_SCHEDULE="15 */4 * * *"
      - DISPLAY_TIMEZONE=****
    volumes:
      - $APPDATA/speedtest:/config
    labels:
      - "traefik.enable=true"
      # HTTP Router
      - "traefik.http.routers.speedtest.entrypoints=websecure-internal"
      - "traefik.http.routers.speedtest.rule=Host(`speed.$DOMAINNAME_3`)"
      # Middlewares
      - "traefik.http.routers.speedtest.middlewares=chain-no-auth@file"
      # HTTP Services
      - "traefik.http.routers.speedtest.service=speedtest"
      - "traefik.http.services.speedtest.loadbalancer.server.port=80"

What browser(s) are you seeing the problem on?

Chrome

Logs

[2025-12-28 13:21:06] production.INFO: Pinged hostname {"host":"icanhazip.com","data":
  {"success":false,"error":"unknownError","host":"icanhazip.com","packet_loss_percentage":100,"packets_transmitted":null,"packets_received":null,"options":
  {"timeout_in_seconds":5,"interval":1.0,"packet_size_in_bytes":56,"ttl":64},"timings":
  {"minimum_time_in_ms":null,"maximum_time_in_ms":null,"average_time_in_ms":null,"standard_deviation_time_in_ms":null},"raw_output":"
  ping: socktype: SOCK_RAW
  ping: socket: Operation not permitted
  ping: => missing cap_net_raw+p capability or setuid?
  ","lines":[]}}

[alexjustesen]

Try adding cap_add to your Docker compose file:

services:
  speedtest:
    cap_add:
      - NET_RAW

[myozone]

Same issue, my firewall pfSense is blocking it. But I did find this https://community.cloudflare.com/t/icanhazip-being-considered-as-phishing-malware/480643

[tavi747]

Just use:

SPEEDTEST_EXTERNAL_IP_URL=https://ifconfig.me

This fixed the issue for me.

[BizkitCake]

@myozone

Same issue, my firewall pfSense is blocking it. But I did find this https://community.cloudflare.com/t/icanhazip-being-considered-as-phishing-malware/480643

Not my issue, because host can successfully resolve this domain name.

@tavi747

SPEEDTEST_EXTERNAL_IP_URL=https://ifconfig.me

Will check it soon, but not really sure. I guess it's only a ping tool issue inside a container, not the speedtest tracker itself.

[BizkitCake]

@alexjustesen

Try adding cap_add to your Docker compose file:

services:
  speedtest:
    cap_add:
      - NET_RAW

That alone is not enough on 1.13.4
I also have to comment/remove security section to make it work.

security_opt:
      - no-new-privileges:true

Just dropping this section without adding NET_RAW capabilities does not help.

And again, in case that was missed, 1.12.4 works just fine with enabled no-new-privileges and no NET_RAW. I just change an image tag, nothing more.

[myozone]

@myozone

Same issue, my firewall pfSense is blocking it. But I did find this https://community.cloudflare.com/t/icanhazip-being-considered-as-phishing-malware/480643

Not my issue, because host can successfully resolve this domain name.

I entirely agree, but that domain may have issues, My post was just an observation rather than a criticism.

[homelab-alpha]

Hi @BizkitCake,

Do you use hypervisors? If so, which ones: level 1 (bare-metal), level 2 (hosted), or nested virtualization?

If you don't use hypervisors, which operating systems do you use? Not every operating system has iputils installed by default.

[alexjustesen]

In https://github.com/alexjustesen/speedtest-tracker/releases/tag/v1.13.0 I changed how Speedtest Tracker, we no longer test your internet using a HTTP GET request, it's now done by pinging a hostname. A ping doesn't sent traffic over UDP/TCP and instead uses ICMP to send raw packets while looking for an echo back from the hostname.

This release also added SPEEDTEST_INTERNET_CHECK_HOSTNAME as an environment variable that you can set to any hostname to verify your WAN connection.

Most Docker setups can send ICMP requests without needed elevated privileges on the host or in the container. That being said if your Docker user doesn't run with elevated permissions or doesn't belong to the Docker group you can get a failure on this step. To allow the user to send ICMP requests you need to add the permission to the container.

⚠️ IMPORTANT NOTE: SPEEDTEST_EXTERNAL_IP_URL is used to get your external IP address which is a separate process and only run when you're excluding WAN IPs from tests.

[bubtheengineer]

I moved to Proxmox a few weeks ago and I'm seeing the same error. I'm on 1.13.4 and I'm getting this constantly:
Failed to connected to hostname "icanhazip.com". Error received "unknownError".

I can resolve and ping icanhazip.com from the LXC container.

I rolled back to 1.12 and everything is working now. Happy to troubleshoot if anyone can provide a bit of guidance, I'm not familiar with php.

UPDATE:
After checking the www-data user capabilities I figured out it didn't have ping permissions. This fixed it:
setcap cap_net_raw+p /usr/bin/ping

I created a matching issue to fix this for the Proxmox community scripts: community-scripts/ProxmoxVE#10415

[alexjustesen]

I created a matching issue to fix this for the Proxmox community scripts: community-scripts/ProxmoxVE#10415

@bubtheengineer Thank you!

I'm closing this issue since there is a documented fix for the Proxmox setup.

[BizkitCake]

In my case, that's a Docker container in Proxmox LXC container, not a VM with Speedtest-Tracker.
Removing this block helped in 1.13.4:

    security_opt:
      - no-new-privileges:true

I see that previously it worked only with NET_RAW, so i'm confused here a bit. Anyway.