ICMP reply from network address

Answered Question

I've run into something interesting that I've not seen happen before. When I ping one of my network addresses 172.29.0.0, I get a reply. The source is an IP on another network, say 172.28.0.1.


I expected to see something odd going on with arp, but then got onto the router for the 172.29.0.0 network, and tried to ping the network address from there. The odd thing was that I got responses from many of the hosts on the network.


Something like this:

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.29.0.0, timeout is 2 seconds:


Reply to request 0 from 172.29.50.102, 4 ms

Reply to request 0 from 172.29.4.1, 4 ms

Reply to request 1 from 172.29.50.102, 1 ms

Reply to request 1 from 172.29.4.1, 1 ms

Reply to request 2 from 172.29.50.102, 1 ms

Reply to request 2 from 172.29.4.1, 1 ms


Why is this working the way that it is?

Correct Answer by sundar.palaniappan about 11 years 4 months ago

The subnets are configured with 16-bit mask. So, when you ping 172.29.0.0 or 172.29.255.255, hosts on the 172.29.0.0/16 only should respond. The fact, you are seeing a host with an address of 172.28.0.1 respond to the echo request indicates the host is probably configured with a primary address of 172.28.0.1 and a secondary address of 172.29.x.x something. When that host sends and echo-reply it sources the primary IP of 172.28.0.1 and it's kind of misleading.


HTH,

Sundar

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
sundar.palaniappan Tue, 04/04/2006 - 11:14
User Badges:
  • Green, 3000 points or more

Do you have a router interface configured with 172.28.0.1 as the primary IP and the 172.29.0.x as the secondary IP address?


--Sundar

Harold Ritter Tue, 04/04/2006 - 11:22
User Badges:
  • Cisco Employee,

all zeroes in the host portion of the ip address used to indicate broadcast just the same all ones is considered a broadcast.


A lot of TCP/IP stacks including Cisco IOS still consider this a broadcast and will therefore respond to an ICMP request with such a destination address.


Hope this helps,

Correct Answer
sundar.palaniappan Tue, 04/04/2006 - 11:45
User Badges:
  • Green, 3000 points or more

The subnets are configured with 16-bit mask. So, when you ping 172.29.0.0 or 172.29.255.255, hosts on the 172.29.0.0/16 only should respond. The fact, you are seeing a host with an address of 172.28.0.1 respond to the echo request indicates the host is probably configured with a primary address of 172.28.0.1 and a secondary address of 172.29.x.x something. When that host sends and echo-reply it sources the primary IP of 172.28.0.1 and it's kind of misleading.


HTH,

Sundar

Harold Ritter Tue, 04/04/2006 - 13:04
User Badges:
  • Cisco Employee,

This is documented in section 4.2.3.1 of RFC1812:


(2) SHOULD silently discard on receipt (i.e., do not even deliver to applications in the router) any packet addressed to 0.0.0.0 or {, 0 }. If these packets are not silently discarded, they MUST be treated as IP broadcasts (see Section[5.3.5]). There MAY be a configuration option to allow receipt of these packets. This option SHOULD default to discarding them.



http://www.ietf.org/rfc/rfc1812.txt?number=1812


Hope this helps,

Actions

This Discussion