diff --git a/package/kit-busrouter/files/usr/lib/busrouter/telemetry-synology.sh b/package/kit-busrouter/files/usr/lib/busrouter/telemetry-synology.sh
index 4fee7d5..93abafd 100755
--- a/package/kit-busrouter/files/usr/lib/busrouter/telemetry-synology.sh
+++ b/package/kit-busrouter/files/usr/lib/busrouter/telemetry-synology.sh
@@ -199,11 +199,18 @@ _eyeride_signal() {
 # Ping an interface to get latency and loss.
 # On Synology SRM: ping requires root. When running from cron (as root), it works.
 # When run manually as non-root, gracefully returns null.
+# NOTE: ping returns exit 0 on success, 1 on any packet loss, 2 on error.
+# We use sudo first; if sudo ping exits 2 (real error), fall back to direct ping.
+# Exit 1 (packet loss) is a valid result — do NOT fall back on it.
 # Usage: _ping_iface <iface> → "lat_ms loss_pct"
 _ping_iface() {
 	_iface="$1"
-	# Try sudo ping (for Synology where ping needs root), fall back to direct ping
-	_out=$(sudo ping -I "$_iface" -c 3 -W 3 "$PING_TARGET" 2>/dev/null || ping -I "$_iface" -c 3 -W 3 "$PING_TARGET" 2>/dev/null)
+	# Try sudo ping first. Only fall back to direct ping if sudo fails (exit 2+).
+	_out=$(sudo ping -I "$_iface" -c 3 -W 3 "$PING_TARGET" 2>/dev/null)
+	_rc=$?
+	if [ $_rc -ge 2 ]; then
+		_out=$(ping -I "$_iface" -c 3 -W 3 "$PING_TARGET" 2>/dev/null)
+	fi
 	if [ -z "$_out" ]; then
 		echo "null null"
 		return