Why does a router ping failure respond using a different IP?

Question

From Windows CMD, when trying to ping another computer on our internal LAN, the IP obviously fails to respond. However the reply of "Destination host unreachable." comes from yet a different IP, and not that of the router.

In my network, the gateway is 10.0.0.252, but I'm getting a reply from 10.0.20.188; which is an dynamic DHCP allocated IP to general devices.

C:\Users\drodecker>ping pbx

Pinging pbx.office.relevantads.com [10.1.1.211] with 32 bytes of data:
Reply from 10.0.20.188: Destination host unreachable.
Reply from 10.0.20.188: Destination host unreachable.
Reply from 10.0.20.188: Destination host unreachable.
Reply from 10.0.20.188: Destination host unreachable.

Ping statistics for 10.1.1.211:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Is `10.0.20.188` the ip address of the client you're pinging FROM? Also, what subnet mask is in use? — joeqwerty, Feb 12 '15 at 18:38
This is probably the default route for the network you are trying to reach. Paste the result of `route PRINT` — Eric Hubert, Feb 12 '15 at 18:30
Okay... I see it in the route print. DOH!.. of course (idiot check). — drodecker, Feb 12 '15 at 18:35
Apparently that's MY ip. So is this a windows default way to timeout a packet or a facet of ping in Windows CMD? — drodecker, Feb 12 '15 at 18:38

score 1 · Answer 1 · answered Feb 12 '15 at 20:58

SIMPLE ANSWER: Your PC is trying to resolve the Ethernet MAC address of the next-hop interface, but it can not find none (eg: the target PC is powered off). So it reports a "Destination host unreachable" ICMP message originating from its own interface.

LONG ANSWER An IP-over-Ethernet network has two complementary network addresses: a non-routable, link-layer physical addressing (the MAC address) and a routable, network-layer logical addressing (the IP address).

When trying to ping another hosts, your PC must:

decide, by virtue of the routing table, the outgoing interface
determine the MAC address of the next-hop Ethernet interface (using the ARP protocol)
send a packed with the next-hop interface as the destination MAC address and with the target IP address as the final destination

Point n.2 is were behavior can diverge:

if the remote host is on the local network, the next-hop Ethernet interface is the final destination you are trying to reach (eg: if my PC has IP 10.0.0.1 /24 and I am trying to ping PC with IP address 10.0.0.2, the next-hop interface is that of the target computer);
if the remote host is on a remote network, the next-hop Ethernet interface is that of the gateway interface (eg: if my PC has IP 10.0.0.1 /24 and I am trying to ping PC with IP address 10.10.10.1 /24 and that remote network can be reached using local router 10.0.0.254 /24, the next-hop interface is that of the router).

So, if your ping failed with a reply from your own PC interface, we have two possibility:

you are trying to ping a local address: this address is not replying to your PC ARP requests and, after a timeout, your PC inform you that the target Ethernet address can not be found.
you are trying to ping a remote address: your configured gateway for that address (eg: your default gateway) is not responding to your PC ARP requests. After a timeout, your PC inform you that the target Ethernet address can not be found.

Why does a router ping failure respond using a different IP?

1 Answers1