Network Troubleshooting for Beginners: Part 1 — Addresses, Gateway, ping and traceroute

When “the internet is not working”, it’s convenient to check from the bottom up: first your own computer and local network, then connectivity to external nodes, then DNS, ports and applications. This part covers the first steps: the computer’s network settings, connection to the router, and the basic utilities ping and traceroute.

Computer network settings

The first thing to check is whether the computer received an address and knows the gateway.

Linux:

ip -br addr        # interface addresses (brief)
ip route           # routing table, the 'default' line is the gateway

macOS:

ifconfig
netstat -rn        # routing table

Windows:

ipconfig

In the output, look at three parameters:

• IP address of the computer, for example 192.168.1.10;
• subnet mask (255.255.255.0 or /24) — determines which addresses are in the same local network;
• default gateway (the line default via 192.168.1.1 on Linux, Default Gateway in Windows) — the router through which traffic to external networks goes. Without a gateway, access to the internet is impossible.

Typical signs of a problem:

• an address like 169.254.x.x — the computer did not get an address from the DHCP server and assigned one to itself. The cause is usually the cable, Wi-Fi, or DHCP on the router;
• no default line or no gateway listed — the computer doesn’t know where to send packets outside the local network;
• address from a different subnet — for example, the computer is in 192.168.0.0/24 while the router is in 192.168.1.0/24: there are no neighbors on the network.

Can the computer see the router: ARP

Inside the local network, packets are delivered by MAC addresses. The ARP protocol maps an IP address to a neighbor’s MAC address, and the results are stored in the neighbor table.

Linux:

ip neigh show

Windows and macOS:

arp -a

Example output on Linux:

192.168.1.1 dev eth0 lladdr 00:1a:2b:3c:4d:5e REACHABLE

States of entries:

• REACHABLE — the neighbor answered recently, connectivity exists;
• STALE — the entry is valid but hasn’t been confirmed for a long time; on the next access the kernel will check it again;
• INCOMPLETE — the address has not yet been resolved;
• FAILED — the neighbor did not respond to requests, there is no link-layer connectivity.

If there is no entry with a MAC address for the gateway or it is in the FAILED state, the problem is below IP: the cable, the switch port, Wi-Fi, or the router itself.

ping: is there connectivity to a host

ping sends ICMP echo requests to a host and shows whether replies arrived and how long they took.

ping -c 4 192.168.1.1     # Linux and macOS: 4 requests
ping 192.168.1.1          # Windows: 4 requests by default

A useful order of checks:

1. ping the gateway (192.168.1.1) — does the connection to the router work.
2. ping an external address (8.8.8.8) — is there internet access. Use the numeric address so DNS does not take part in the check.
3. ping a name (ping -c 4 google.com) — is name resolution working. If 8.8.8.8 replies but the name does not, the problem is DNS — which is covered in the next part.

In the output pay attention to packet loss and response time (time=… ms). No reply does not always mean the host is unreachable: many servers and firewalls do not respond to ICMP.

traceroute: where the path breaks

traceroute shows the chain of routers to a host and the response time of each of them.

traceroute 8.8.8.8        # Linux (traceroute package) and macOS
tracepath 8.8.8.8         # Linux, does not require root privileges
tracert 8.8.8.8           # Windows

How to read the result:

• if the path breaks at the first hop — the problem is at the router or at the provider’s ingress;
• asterisks * * * on an intermediate hop while subsequent hops are normal — usually not a problem: the router simply does not respond to such requests;
• a sudden increase in latency at some hop that persists to the end of the route indicates an overloaded segment.

Continuous monitoring of a route with losses on every hop is provided by the mtr utility — it’s discussed in part four.

Summary

Lower-level troubleshooting boils down to three questions:

1. Does the computer have the correct address and gateway (ip -br addr, ip route, ipconfig)?
2. Can the computer see the router (ip neigh, arp -a, ping the gateway)?
3. Do packets get out to the external network (ping 8.8.8.8, traceroute)?

If the answer to all three is “yes” but websites still don’t open, the next step is to check DNS.

Resources

• ip (man7.org)
• ip-neighbour (man7.org)
• ipconfig (Microsoft Learn)
• tracert (Microsoft Learn)