cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2939
Views
5
Helpful
5
Replies

ICMP reply from network address

jheckart
Level 3
Level 3

I've run into something interesting that I've not seen happen before. When I ping one of my network addresses 172.29.0.0, I get a reply. The source is an IP on another network, say 172.28.0.1.

I expected to see something odd going on with arp, but then got onto the router for the 172.29.0.0 network, and tried to ping the network address from there. The odd thing was that I got responses from many of the hosts on the network.

Something like this:

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.29.0.0, timeout is 2 seconds:

Reply to request 0 from 172.29.50.102, 4 ms

Reply to request 0 from 172.29.4.1, 4 ms

Reply to request 1 from 172.29.50.102, 1 ms

Reply to request 1 from 172.29.4.1, 1 ms

Reply to request 2 from 172.29.50.102, 1 ms

Reply to request 2 from 172.29.4.1, 1 ms

Why is this working the way that it is?

1 Accepted Solution

Accepted Solutions

The subnets are configured with 16-bit mask. So, when you ping 172.29.0.0 or 172.29.255.255, hosts on the 172.29.0.0/16 only should respond. The fact, you are seeing a host with an address of 172.28.0.1 respond to the echo request indicates the host is probably configured with a primary address of 172.28.0.1 and a secondary address of 172.29.x.x something. When that host sends and echo-reply it sources the primary IP of 172.28.0.1 and it's kind of misleading.

HTH,

Sundar

View solution in original post

5 Replies 5

Do you have a router interface configured with 172.28.0.1 as the primary IP and the 172.29.0.x as the secondary IP address?

--Sundar

Harold Ritter
Cisco Employee
Cisco Employee

all zeroes in the host portion of the ip address used to indicate broadcast just the same all ones is considered a broadcast.

A lot of TCP/IP stacks including Cisco IOS still consider this a broadcast and will therefore respond to an ICMP request with such a destination address.

Hope this helps,

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México

Sundar,

No, I do not have a secondary address of 172.29.x.x/16 configured on the router with the interface of 172.28.x.x/16.

hritter,

Does any documentation exist on this subject? It's confusing. I guess I can understand how a broadcast address could respond, but not the network address.

The subnets are configured with 16-bit mask. So, when you ping 172.29.0.0 or 172.29.255.255, hosts on the 172.29.0.0/16 only should respond. The fact, you are seeing a host with an address of 172.28.0.1 respond to the echo request indicates the host is probably configured with a primary address of 172.28.0.1 and a secondary address of 172.29.x.x something. When that host sends and echo-reply it sources the primary IP of 172.28.0.1 and it's kind of misleading.

HTH,

Sundar

This is documented in section 4.2.3.1 of RFC1812:

(2) SHOULD silently discard on receipt (i.e., do not even deliver to applications in the router) any packet addressed to 0.0.0.0 or {, 0 }. If these packets are not silently discarded, they MUST be treated as IP broadcasts (see Section[5.3.5]). There MAY be a configuration option to allow receipt of these packets. This option SHOULD default to discarding them.

http://www.ietf.org/rfc/rfc1812.txt?number=1812

Hope this helps,

Harold Ritter
Sr Technical Leader
CCIE 4168 (R&S, SP)
harold@cisco.com
México móvil: +52 1 55 8312 4915
Cisco México
Paseo de la Reforma 222
Piso 19
Cuauhtémoc, Juárez
Ciudad de México, 06600
México
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: