{"id":2221,"date":"2025-09-02T11:55:45","date_gmt":"2025-09-02T11:55:45","guid":{"rendered":"https:\/\/remote-support.space\/wordpress\/?p=2221"},"modified":"2025-09-02T11:55:45","modified_gmt":"2025-09-02T11:55:45","slug":"error-cannot-ping-from-normal-user","status":"publish","type":"post","link":"http:\/\/remote-support.space\/wordpress\/2025\/09\/02\/error-cannot-ping-from-normal-user\/","title":{"rendered":"Error cannot ping from normal user"},"content":{"rendered":"

 <\/p>\n

File \/etc\/hosts saved
\nkhawar@mx:~
\n$ ping isv.remote-support.space
\nping: socktype: SOCK_RAW
\nping: socket: Operation not permitted
\nping: => missing cap_net_raw+p capability or setuid?
\nkhawar@mx:~
\n$ sudo setcap cap_net_raw+ep \/bin\/ping
\n[sudo] password for khawar:
\nkhawar@mx:~
\n$ ping isv.remote-support.space
\nPING isv.remote-support.space (10.8.0.102) 56(84) bytes of data.
\n^C
\n— isv.remote-support.space ping statistics —
\n1 packets transmitted, 0 received, 100% packet loss, time 0ms<\/p>\n

\n

 <\/p>\n

The error you’re seeing:<\/p>\n

\n
\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
ping isv.remote-support.space<\/div>\n
ping: socktype: SOCK_RAW<\/div>\n
ping: socket: Operation not permitted<\/div>\n
ping: => missing cap_net_raw+p capability or setuid?<\/div>\n<\/div>\n
<\/div>\n
indicates that the ping<\/code> command cannot create a raw socket, which it needs to send ICMP echo requests. This is typically due to missing privileges.<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n

\ud83d\udd0d Why this happens<\/h3>\n

The ping<\/code> utility requires the ability to send and receive ICMP packets<\/strong>, which involves using raw sockets<\/strong> (SOCK_RAW<\/code>). On modern Linux systems, this capability is controlled by capabilities<\/strong>, specifically CAP_NET_RAW<\/code>.<\/p>\n

<\/div>\n

There are two common reasons for this error:<\/p>\n

<\/div>\n
    \n
  1. The ping<\/code> binary lacks the CAP_NET_RAW<\/code> capability.<\/strong><\/li>\n
  2. The ping<\/code> binary is not setuid root<\/strong> (and your user doesn’t have sufficient privileges).<\/li>\n<\/ol>\n
    <\/div>\n
    \n
    \n<\/div>\n
    <\/div>\n

    \u2705 How to fix it<\/h3>\n

    \u2714\ufe0f Option 1: Add the CAP_NET_RAW<\/code> capability to ping<\/code><\/h4>\n

    Run this command as root or with sudo<\/code>:<\/p>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n
    \n
    sudo setcap cap_net_raw+ep \/bin\/ping<\/div>\n<\/div>\n
    <\/div>\n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
    <\/div>\n<\/div>\n<\/div>\n
    <\/div>\n

    This grants the ping<\/code> binary the capability to create raw sockets without requiring full root privileges.<\/p><\/blockquote>\n

    <\/div>\n

    After running this, try ping<\/code> again:<\/p>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n
    \n
    ping isv.remote-support.space<\/div>\n<\/div>\n
    <\/div>\n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
    <\/div>\n<\/div>\n<\/div>\n
    <\/div>\n

    \u2714\ufe0f Option 2: Use sudo<\/code> when pinging<\/h4>\n

    If you don’t want to modify capabilities, run ping<\/code> with elevated privileges:<\/p>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n
    \n
    sudo ping isv.remote-support.space<\/div>\n<\/div>\n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

    This works because sudo<\/code> gives you the necessary privileges to create raw sockets.<\/p>\n

    <\/div>\n
    \n
    \n<\/div>\n
    <\/div>\n

    \u274c Why not setuid?<\/h3>\n

    In older systems, \/bin\/ping<\/code> was often setuid root<\/strong> (owned by root with the setuid bit set). Modern systems prefer capabilities<\/strong> instead for better security.<\/p>\n

    <\/div>\n

    You can check if ping<\/code> currently has capabilities:<\/p>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n
    \n
    getcap \/bin\/ping<\/div>\n<\/div>\n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

    Expected output (if fixed):<\/p>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n
    \n
    \/bin\/ping = cap_net_raw+ep<\/div>\n<\/div>\n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

    If there’s no output, the capability is missing.<\/p>\n

    <\/div>\n
    \n
    \n<\/div>\n
    <\/div>\n

    \u26a0\ufe0f Security Note<\/h3>\n

    Giving CAP_NET_RAW<\/code> to ping<\/code> is safe and standard on most Linux distributions. Avoid setting unnecessary privileges on other binaries.<\/p>\n

    <\/div>\n
    \n
    \n<\/div>\n
    <\/div>\n

    \ud83d\udee0 Check if ping<\/code> is working properly<\/h3>\n

    After applying the fix:<\/p>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n<\/div>\n
    \n
    ping -c 4<\/span> google.com<\/div>\n<\/div>\n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

    If it works, your issue is resolved.<\/p>\n

    <\/div>\n
    \n
    \n<\/div>\n
    <\/div>\n

    Summary<\/h3>\n

    Run:<\/p>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    sudo setcap cap_net_raw+ep \/bin\/ping<\/div>\n<\/div>\n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

    Then test:<\/p>\n

    \n
    \n
    \n
    \n
    \n
    \n
    \n
    <\/div>\n<\/div>\n
    \n
    ping isv.remote-support.space<\/div>\n<\/div>\n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

    \u2705 This should resolve the “Operation not permitted” error.<\/p>\n

    \n

    \n","protected":false},"excerpt":{"rendered":"

      File \/etc\/hosts saved khawar@mx:~ $ ping isv.remote-support.space ping: socktype: SOCK_RAW ping: socket: Operation not permitted ping: => missing cap_net_raw+p capability or setuid? khawar@mx:~ $ sudo setcap cap_net_raw+ep \/bin\/ping [sudo] password for khawar: khawar@mx:~ $ ping isv.remote-support.space PING isv.remote-support.space (10.8.0.102) 56(84) bytes of data. ^C — isv.remote-support.space ping statistics — 1 packets transmitted, 0 received, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2221","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/posts\/2221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/comments?post=2221"}],"version-history":[{"count":1,"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/posts\/2221\/revisions"}],"predecessor-version":[{"id":2222,"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/posts\/2221\/revisions\/2222"}],"wp:attachment":[{"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/media?parent=2221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/categories?post=2221"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/remote-support.space\/wordpress\/wp-json\/wp\/v2\/tags?post=2221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}