- Replace raw ICMP socket implementation with system ping command
- Add regex-lite dependency for parsing ping output
- Add tokio process feature for async command execution
- Support macOS and Linux ping output formats
- Add iputils to Dockerfile for setuid-root ping
- Remove socket2 dependency (no longer needed)
This eliminates the need for CAP_NET_RAW capability in containers.
When using SOCK_DGRAM for ICMP on Linux, the kernel manages the
identifier field and may overwrite the value we set. This causes
validation failures when we receive replies with kernel-assigned
identifiers.
The fix is to only validate:
- Type (0 = ECHO REPLY)
- Code (0)
- Sequence number (matches our random value)
The sequence number is sufficient for uniqueness given our polling
intervals (300+ seconds per device). This is the standard approach
for DGRAM ICMP sockets.
The diagnostic error message was reading ICMP fields from the wrong
offset when an IP header was present. It was showing bytes from the
IP header instead of the actual ICMP identifier and sequence fields.
Now properly detects and skips IP header before extracting ICMP
fields for diagnostic output. Also added total packet length to help
distinguish between raw ICMP and IP-wrapped packets.
Example before:
Invalid ICMP reply packet (expected id=24079, seq=12918):
type=0 code=0 id=29 seq=12918 len=21
(id=29 was reading from IP header, not ICMP)
Example after:
Invalid ICMP reply packet (expected id=24079, seq=12918):
type=0 code=0 id=24079 seq=12918 len=21 (total=41)
(now correctly shows ICMP identifier)
