In local area network operations, a very common issue occurs:
When you ping two IP addresses on the same subnet from a router, one responds normally while the other times out or shows “Destination host unreachable.”
This “one works, one doesn’t” phenomenon is not random. It is caused by differences in device status, network configuration, physical links, or security policies between the two targets.
This article provides a complete breakdown from theory to hands‑on troubleshooting – no brand‑specific advice, just pure technical content.
2. Core Characteristics & Prerequisites
✅ Only after excluding a global router failure can we focus on the “differences” between the two targets.
3. Root Causes (Sorted by Frequency)
3.1 Target device status (most common)
Device powered off, in sleep mode, or has a hardware failure → no network response
NIC disabled, driver faulty, or port damaged → network interface not active
Device overloaded (CPU/RAM at 100%) → cannot process ICMP requests
3.2 IP address & Layer‑3 configuration errors
IP address conflict – the “bad” IP is used by multiple devices; ARP table becomes confused
Subnet mask mismatch – different masks cause devices to believe they are not on the same subnet, blocking Layer‑2 communication
Static IP misconfiguration – wrong network segment or default gateway prevents replies
3.3 Physical layer & link failures
Broken Ethernet cable, loose connector, or intermittent contact → only that device’s link is affected
Faulty switch port or PoE power issue → port down
Optical link problems (low Rx/Tx) or weak wireless signal → affects only a single device
3.4 Firewall & security policy blocking
Local firewall on the target device (Windows Firewall, iptables, etc.) disables ICMP echo replies
ACL rules on the switch or router specifically block pings to that one IP
Endpoint security software or EDR policy blocks internal ICMP probes
3.5 Layer‑2 isolation & VLAN misconfiguration
Port isolation enabled on the switch – devices in the same VLAN cannot communicate
One device placed in the wrong VLAN – logically separated from the subnet
Trunk link missing the corresponding VLAN tag → packets dropped
3.6 ARP protocol anomalies
4. Standard Troubleshooting Procedure (10‑minute diagnosis)
Step 1: Basic checks (1 minute)
Confirm the problematic device is powered on; link/activity LEDs are normal
Verify IP address, subnet mask, and default gateway on both target devices; they must match
Restart the problematic device to rule out temporary OS issues
Step 2: Physical link verification (2 minutes)
Swap the Ethernet cable, reseat connectors, or test with a different switch port
Check switch port status – no errors, not administratively down
For wireless devices, check signal strength – eliminate interference or association failure
Step 3: Configuration & conflict checks (3 minutes)
Run arp -a to examine the ARP table – does the problematic IP map to a single, consistent MAC?
Re‑assign a static IP or renew DHCP lease to avoid address conflicts
Ensure subnet masks are consistent across all devices; use 255.255.255.0 as the standard where possible
Step 4: Security policy checks (2 minutes)
Temporarily disable the firewall and any security software on the problematic device, then retest pings
Check switch port isolation and VLAN assignment – verify that no isolation rule blocks communication
Review router ACLs – ensure there is no “deny” rule targeting that specific IP or ICMP in general
Step 5: Advanced diagnostics (2 minutes)
Clear the ARP cache for that IP: arp -d <IP address>, then retry ping
Use tracert (Windows) or traceroute (Linux) to locate the dropping point
Capture packets to verify whether the ICMP request reaches the target and whether a reply is sent back
5. Quick Mnemonic (for daily ops)
One‑side ping fail? First check if the device is awake.
Swap the cable and port, verify IP and mask.
Turn off the firewall, clear ARP for goodness’ sake.
VLAN and isolation – a quick look is all it takes.
6. Summary
When a router pings two IPs on the same subnet and only one works, the root cause is a difference in the state of the two target devices – not a router or global network failure.
Follow this order, and over 95% of such issues can be resolved quickly:
Device status → Physical link → IP configuration → Security policy → Layer‑2 isolation → ARP
Preventive tips for daily operations
Use a consistent IP addressing plan to avoid conflicts
Standardise VLAN and port configurations; use port isolation cautiously
Disable unnecessary ICMP blocking, or explicitly allow ping when needed
Master this approach, and you will no longer be puzzled by “one works, one doesn’t.”
