diff --git a/backend/routers/discovery.py b/backend/routers/discovery.py
index d5f7e3c..7356603 100644
--- a/backend/routers/discovery.py
+++ b/backend/routers/discovery.py
@@ -54,7 +54,12 @@ def _ping(ip: str) -> bool:
             capture_output=True,
             timeout=3,
         )
-        return r.returncode == 0
+        if r.returncode != 0:
+            return False
+        # Guard against proxy-ARP / gateway false positives: verify the ICMP
+        # reply actually came from the target IP and not an intermediate node.
+        stdout = r.stdout.decode(errors="ignore")
+        return f"from {ip}:" in stdout or f"from {ip} " in stdout
     except Exception:
         return False