Why was my ping answered by a different IP address than the one pinged?

Solution 1:

This isn't totally unheard of, a machine may have had an alias assigned to a network card previously which the network admin doesn't know about, etc.

The obvious thing to do is find the MAC address of the responding server, that should be easy to do.

Run "arp -a" from a command prompt on the SQL server, and look for both the and addresses.

You'll see a MAC address for both, which might or might not be the same, they'll look like "00-22-6b-3b-30-90". Your network admin should be able to identify the network card with the MAC addresses listed, but it's probably worth checking that it's not one of the SQL server network cards before you tell him, just in case it's not a minor configuration mistake you've made yourself somewhere along the line.

To check a windows system MAC address run "ipconfig /all" from the command prompt, and you'll see a MAC address for each network card.

Solution 2:

Several possibilities:

  1. Broadcast address. If your "let's say" examples weren't precise, you could have been pinging the broadcast address on the subnet. Let's say the network was (AKA mask of and you pinged - it may look like just a random host, but it's really the broadcast address, and anyone on that subnet could respond with their own address (FYI the broadcast address is the last address of the subnet).

  2. VIP. If you have load-balancers or a server cluster, you may have pinged the shared/virtual address and gotten a reply from the real server.

  3. Secondary addresses. If the router/server has a primary address of .69 with a secondary of .205 (common practice for people trying to reserve extra addresses seen by ping scans just like yours) it might reply to a ping for .205 but source the reply from .69.

  4. Your own address. An example from a Unix laptop: ping responded with From icmp_seq=1 Destination Host Unreachable where was the laptop's IP address.