Proof Portal

Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-4977GitHub issuePublicReceived

Network widget reports "Ping: Timeout" and "Packet Loss: 100%" on networks that block ICMP — probe uses `ping` instead of a TCP-based check

Reported by rahmatov-abdullaxon · filed Sep 9, 2026Closed upstream on 2026-09-21 by bjarneo via an automated message, as a duplicate of #9068 (R-1232). GitHub close reason: completed.

Received and recorded verbatim. Nothing has been checked yet.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
Not yet mapped to any requirement or component.
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Our staff decide whether the report is valid. Where this project allows it, agents decide whether it duplicates another report or a known issue. No decision has been recorded yet.

Original report

Network widget reports "Ping: Timeout" and "Packet Loss: 100%" on networks that block ICMP — probe uses `ping` instead of a TCP-based checkrevision 1 · captured 2026-10-04 12:10 UTC via poll

System details

21DK (ThinkBook 14 G4 ABA), AMD Ryzen 7 5825U (16) @ 4.55 GHz, Omarchy 4.0.3-1

What's wrong?

What happened

On a WiFi network whose firewall drops ICMP (a standard enterprise setting —
in my case the university network "wiut"), the network widget in the top bar
reports:

Ping        Timeout
Packet Loss 100%

while the network is working completely fine: HTTPS sites load, downloads run
at full speed (~200 Mbps), and a TCP connect to 1.1.1.1:443 completes in
~107 ms. The widget is the only thing claiming there is a problem.

What's actually wrong

The probe behind the widget is /usr/share/omarchy/bin/omarchy-network-status,
which measures the two latency samples with ICMP `ping`:

# omarchy-network-status, lines 56-60
ping_latency_ms() {
  local host=$1
  LC_ALL=C ping -n -c 1 -W 1 "$host" 2>/dev/null | \
    awk -F'time[=<]' '/time[=<]/ { split($2, parts, " "); print parts[1]; exit }'
}

internet_probe=1.1.1.1 (line 8). When ICMP is blocked, ping exits with no
time= line, stdout stays empty, and the value parses to null.

The panel then counts every null sample as a packet loss rather than as
"no data":

// Model.js, pingPacketLossPercent()
var lost = 0
for (var i = 0; i < values.length; i++) {
  if (values[i] === null) lost++
}
return Math.round((lost / values.length) * 100)

So a network that merely filters ICMP (while passing TCP/HTTPS fine) is
rendered as "Timeout" + "100% packet loss" — a guaranteed false alarm on any
ICMP-blocking network.

Steps to reproduce

  1. Connect to any network that blocks ICMP echo (captive-portal / enterprise

university networks are common examples; wiut qualifies).
2. Confirm at the shell that the link is actually healthy:

   curl -s -o /dev/null -w '%{time_connect}\n' --connect-timeout 2 https://1.1.1.1
   ping -c 3 1.1.1.1        # <- times out: 100% packet loss

(TCP works, ICMP is dropped.)
3. Open the network widget in the bar.
4. Observe: Ping → Timeout, Packet Loss → 100%.

Expected behavior

The widget should distinguish "ICMP is filtered by this network" from "the
network is actually lossy" — e.g. by measuring latency over TCP (connect
time), or by dropping samples that never returned instead of counting them as
lost. On the same connection, a TCP-based probe reports ~107 ms and 0% loss,
which matches user-observable behavior.

Environment / System details

  • Omarchy: 4.0.3-1
  • Hyprland: 0.56.2 (built from branch v0.56.2 at commit efb50993780079460b0cbed1363e2166a2de1d9f)
  • Quickshell: 0.3.1-1 (Arch package)
  • Kernel: 7.2.3-arch1-3
  • NetworkManager: nmcli 1.58.1-1
  • Network controller: Realtek RTL8852BE (rtw89_8852be), Lenovo subsystem
  • Affected network: open-SSID enterprise network with ICMP-dropping firewall
  • Networking stack: NetworkManager (no IWD), wpa-supplicant

Provenance of the fix

A working probe is /usr/share/omarchy/bin/omarchy-network-status run with
--verbose; its router_ping_ms/internet_ping_ms values feed the panel.
Replacing the ICMP sample with a TCP connect sample to the same targets
(gateway:80, 1.1.1.1:443) produces identical output shape with correct
numbers. The minimal upstream change would be localized to that one function
(ping_latency_ms) and the panel's null-handling in Model.js.

Captures

<img width="604" height="720" alt="Image" src="https://github.com/user-attachments/assets/ad6dff98-17e8-4f55-a071-f89bc418ae44" />

View raw text
### System details

21DK (ThinkBook 14 G4 ABA), AMD Ryzen 7 5825U (16) @ 4.55 GHz, Omarchy 4.0.3-1

### What's wrong?

## What happened

On a WiFi network whose firewall drops ICMP (a standard enterprise setting —
in my case the university network "wiut"), the network widget in the top bar
reports:

```
Ping        Timeout
Packet Loss 100%
```

while the network is working completely fine: HTTPS sites load, downloads run
at full speed (~200 Mbps), and a TCP connect to 1.1.1.1:443 completes in
~107 ms. The widget is the only thing claiming there is a problem.

## What's actually wrong

The probe behind the widget is `/usr/share/omarchy/bin/omarchy-network-status`,
which measures the two latency samples with **ICMP `ping`**:

```bash
# omarchy-network-status, lines 56-60
ping_latency_ms() {
  local host=$1
  LC_ALL=C ping -n -c 1 -W 1 "$host" 2>/dev/null | \
    awk -F'time[=<]' '/time[=<]/ { split($2, parts, " "); print parts[1]; exit }'
}
```

`internet_probe=1.1.1.1` (line 8). When ICMP is blocked, `ping` exits with no
`time=` line, stdout stays empty, and the value parses to `null`.

The panel then counts **every null sample as a packet loss** rather than as
"no data":

```js
// Model.js, pingPacketLossPercent()
var lost = 0
for (var i = 0; i < values.length; i++) {
  if (values[i] === null) lost++
}
return Math.round((lost / values.length) * 100)
```

So a network that merely *filters ICMP* (while passing TCP/HTTPS fine) is
rendered as "Timeout" + "100% packet loss" — a guaranteed false alarm on any
ICMP-blocking network.

## Steps to reproduce

1. Connect to any network that blocks ICMP echo (captive-portal / enterprise
   university networks are common examples; **wiut** qualifies).
2. Confirm at the shell that the link is actually healthy:
   ```bash
   curl -s -o /dev/null -w '%{time_connect}\n' --connect-timeout 2 https://1.1.1.1
   ping -c 3 1.1.1.1        # <- times out: 100% packet loss
   ```
   (TCP works, ICMP is dropped.)
3. Open the network widget in the bar.
4. Observe: **Ping → Timeout**, **Packet Loss → 100%**.

## Expected behavior

The widget should distinguish "ICMP is filtered by this network" from "the
network is actually lossy" — e.g. by measuring latency over TCP (connect
time), or by dropping samples that never returned instead of counting them as
lost. On the same connection, a TCP-based probe reports ~107 ms and 0% loss,
which matches user-observable behavior.

## Environment / System details

- **Omarchy:** 4.0.3-1
- **Hyprland:** 0.56.2 (built from branch v0.56.2 at commit efb50993780079460b0cbed1363e2166a2de1d9f)
- **Quickshell:** 0.3.1-1 (Arch package)
- **Kernel:** 7.2.3-arch1-3
- **NetworkManager:** nmcli 1.58.1-1
- **Network controller:** Realtek RTL8852BE (rtw89_8852be), Lenovo subsystem
- **Affected network:** open-SSID enterprise network with ICMP-dropping firewall
- **Networking stack:** NetworkManager (no IWD), wpa-supplicant

## Provenance of the fix

A working probe is `/usr/share/omarchy/bin/omarchy-network-status` run with
`--verbose`; its `router_ping_ms`/`internet_ping_ms` values feed the panel.
Replacing the ICMP sample with a TCP connect sample to the same targets
(gateway:80, 1.1.1.1:443) produces identical output shape with correct
numbers. The minimal upstream change would be localized to that one function
(`ping_latency_ms`) and the panel's null-handling in `Model.js`.

## Captures

<img width="604" height="720" alt="Image" src="https://github.com/user-attachments/assets/ad6dff98-17e8-4f55-a071-f89bc418ae44" />
  • ad6dff98-17e8-4f55-a071-f89bc418ae44

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

Not linked to any known issue, other report or change yet.

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

No decision has been recorded yet.