The ticket says "intermittent," which is the worst word a ticket can say. Two desks over from each other, same switch, same VLAN, same physical run of cable back to the same closet. Workstation A can ping the printer, the file share, the domain controller, everything. Workstation A cannot reliably reach Workstation B, four feet away. Sometimes a ping gets through. A file transfer stalls. Nobody touched a cable. Nobody touched a firewall, because there isn't one between two machines on the same VLAN.
You pull the IP config on both. Workstation A: 192.168.1.10, mask 255.255.255.0. Workstation B: 192.168.1.130, mask 255.255.255.128. Both plug into the same 192.168.1.0 address space. Both look, at a glance, fine.
They are not on the same subnet. That's the whole bug, and it's easy to miss because a subnet mask never travels in the packet. It's not metadata attached to an IP address the way a VLAN tag is attached to a frame. It's a purely local, purely private number each device keeps to itself and uses for exactly one decision: when I want to send to this destination, do I ARP for it directly on this wire, or do I hand it to my default gateway instead?
Workstation A ANDs its own mask against the destination. 192.168.1.130 AND 255.255.255.0 lands in 192.168.1.0/24, the same network A thinks it's on. So A treats B as local. It ARPs for 192.168.1.130 right there on the segment, gets a MAC address back (ARP doesn't care about anyone's subnet math, it's a broadcast on the wire), and sends the frame straight there. That direction works.
Workstation B does the same math with its own mask. 192.168.1.10 AND 255.255.255.128 does not land inside 192.168.1.128/25, the network B believes it's on. As far as B is concerned, A is off-subnet. So B doesn't ARP for A directly. It sends the packet to its configured default gateway instead, the same way it would for a request bound for the internet.
Now the outcome depends entirely on what that gateway does with a packet addressed to a host sitting on the exact same wire it just arrived from. A lot of routers will happily route it right back out the interface it came in on, and per RFC 792 they're supposed to tell the sender it took an unnecessary hop with an ICMP redirect, "you didn't need me for this, talk to this host directly next time." Modern client OSes, for good security reasons, frequently ignore ICMP redirects by default. So B never learns to talk to A directly. Every packet from B takes the long way through the gateway, some fraction of it gets dropped, delayed, or filtered somewhere along that unnecessary detour, and you get exactly the symptom that started the ticket: not down, not blocked, just inconsistent, and only in one direction.
Nothing here is exotic. It's the single most basic fact about how IP addressing works, that the mask is locally interpreted and never verified against the device on the other end, applied in a spot where two machines quietly ended up with different ones. Fixing it is one line, set B back to /24 to match the segment it's actually wired into. Finding it means checking both masks before you check anything else, because "same VLAN" and "same subnet" are two different claims and only one of them was actually true here.
This is exactly the layer the Network Engineer L1 Book is built to make automatic instead of a thing you re-derive under pressure: subnetting, VLSM, and the local-vs-remote decision every device on your network is silently making, before routing, before switching, before any of the more advanced material stacks on top of it: https://resources.codelivly.com/product/network-engineer-l1/
The free Routing & Switching Fundamentals and Network Services Administration learning paths cover this same beginner ground on codelivly.com if you want to drill it hands-on first: https://codelivly.com/learning-paths/routing-switching-fundamentals and https://codelivly.com/learning-paths/network-services-administration
