I've run into something interesting that I've not seen happen before. When I ping one of my network addresses 172.29.0.0, I get a reply. The source is an IP on another network, say 172.28.0.1.
I expected to see something odd going on with arp, but then got onto the router for the 172.29.0.0 network, and tried to ping the network address from there. The odd thing was that I got responses from many of the hosts on the network.
Something like this:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.29.0.0, timeout is 2 seconds:
Reply to request 0 from 172.29.50.102, 4 ms
Reply to request 0 from 172.29.4.1, 4 ms
Reply to request 1 from 172.29.50.102, 1 ms
Reply to request 1 from 172.29.4.1, 1 ms
Reply to request 2 from 172.29.50.102, 1 ms
Reply to request 2 from 172.29.4.1, 1 ms
Why is this working the way that it is?
The subnets are configured with 16-bit mask. So, when you ping 172.29.0.0 or 172.29.255.255, hosts on the 172.29.0.0/16 only should respond. The fact, you are seeing a host with an address of 172.28.0.1 respond to the echo request indicates the host is probably configured with a primary address of 172.28.0.1 and a secondary address of 172.29.x.x something. When that host sends and echo-reply it sources the primary IP of 172.28.0.1 and it's kind of misleading.