ICMP reply from network address

Question

I've run into something interesting that I've not seen happen before. When I ping one of my network addresses 172.29.0.0, I get a reply. The source is an IP on another network, say 172.28.0.1.
I expected to see something odd going on with arp, but then got onto the router for the 172.29.0.0 network, and tried to ping the network address from there. The odd thing was that I got responses from many of the hosts on the network.
Something like this:
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.29.0.0, timeout is 2 seconds:
Reply to request 0 from 172.29.50.102, 4 ms
Reply to request 0 from 172.29.4.1, 4 ms
Reply to request 1 from 172.29.50.102, 1 ms
Reply to request 1 from 172.29.4.1, 1 ms
Reply to request 2 from 172.29.50.102, 1 ms
Reply to request 2 from 172.29.4.1, 1 ms
Why is this working the way that it is?

Answer 1

This is documented in section 4.2.3.1 of RFC1812:
(2) SHOULD silently discard on receipt (i.e., do not even deliver to applications in the router) any packet addressed to 0.0.0.0 or {, 0 }. If these packets are not silently discarded, they MUST be treated as IP broadcasts (see Section[5.3.5]). There MAY be a configuration option to allow receipt of these packets. This option SHOULD default to discarding them.
http://www.ietf.org/rfc/rfc1812.txt?number=1812
Hope this helps,