4b0aa1edf2
When the Docker container's DNS can resolve a target IP to a hostname, ping formats the reply line as "from hostname (ip):" instead of the plain "from ip:" format. The proxy-ARP source-IP guard only checked for the plain format, causing those hosts to be incorrectly reported as unreachable despite a valid ICMP response. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>