Troubleshooting playbook

Start from what you see, not from what you suspect. Each section names a symptom as it appears in ipconfig, ifconfig or ip, explains what is actually going on, and gives the commands to confirm and fix it on each platform.

The 60-second triage

Run these in order. The first one that fails tells you which layer is broken.

1. Is there a link? Windows: ipconfig, look for Media disconnected. Linux: ip -br link, look for UP vs DOWN/NO-CARRIER. macOS: ifconfig en0 | grep status. No link means nothing else matters yet. →
2. Is there a real address? An address starting 169.254 or no IPv4 address at all means DHCP failed. →
3. Is there a default gateway? Blank on Windows, no default via on Linux, no gateway from route -n get default on macOS. →
4. Can you reach the gateway? ping 192.168.1.1 (whatever yours is). If not, it is a local problem: switch, Wi-Fi, cable, VLAN, duplicate IP. →
5. Can you reach the internet by IP? ping 1.1.1.1. If the gateway answers but this does not, the router's upstream is down or blocking you.
6. Can you resolve names? nslookup example.com or dig example.com. If IP works but names do not, it is DNS. →
7. Can you load a page? curl -I https://example.com. If everything above works but this fails, look at proxies, firewall, captive portals and MTU. →

"Media disconnected", NO-CARRIER, status: inactive

What it means: the adapter is enabled but has no physical link. For Ethernet, no electrical signal from the far end. For Wi-Fi, not associated with an access point.

Check:

ipconfig
netsh interface show interface
netsh wlan show interfaces              # Wi-Fi: State should be "connected"
Get-NetAdapter | ft Name, Status, LinkSpeed   # PowerShell

ip -br link
sudo ethtool enp3s0 | grep -E 'Speed|Duplex|Link detected'
cat /sys/class/net/enp3s0/carrier        # 1 = link
rfkill list                             # Wi-Fi hardware/software block?
nmcli device status
dmesg | grep -iE 'link (is )?(up|down)' | tail

ifconfig en0 | grep -E 'status|media'
networksetup -getairportpower en0
sudo wdutil info | grep -E 'Power|SSID|RSSI'

Fix, in order of likelihood:

• Reseat both ends of the cable. Try a different cable and a different switch port. Cat5e cables with one broken pair negotiate to 100 Mb/s half-duplex or not at all.
• Check the link light on the NIC and the switch. No light on either end means cable or port. Light on one end only usually means a cable fault.
• Wi-Fi: is the radio on (hardware switch, Fn key, rfkill, aeroplane mode)? Is the saved password right? Forget the network and rejoin.
• Disable and re-enable the adapter: netsh interface set interface "Ethernet" admin=disable then admin=enable; ip link set enp3s0 down; ip link set enp3s0 up; ifconfig en0 down; ifconfig en0 up.
• Windows: Device Manager › adapter › Properties › Advanced › Speed & Duplex; set to Auto Negotiation. Also disable "Energy-Efficient Ethernet" and "Allow the computer to turn off this device to save power" if the link drops intermittently.
• Linux: sudo ethtool -s enp3s0 autoneg on; if the driver is missing, lspci -k | grep -A3 -i ethernet shows whether a kernel module is loaded.
• The switch port may be administratively down or in a VLAN with no DHCP; ask whoever runs it.

Address starts 169.254 (APIPA / self-assigned)

What it means: the interface has a link but DHCP produced no lease, so the OS picked a random address in 169.254.0.0/16 (RFC 3927). It can talk to other 169.254 devices on the same segment and nothing else. Windows labels it Autoconfiguration IPv4 Address; macOS says self-assigned IP in System Settings; Linux with NetworkManager shows it if ipv4.method falls back to link-local, otherwise you simply get no IPv4 address at all.

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . :
   Autoconfiguration IPv4 Address. . : 169.254.117.203
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :

Why DHCP fails:

• The router or DHCP server is off, rebooting, or has run out of addresses (pool exhausted).
• You are on a VLAN or guest network with no DHCP, or the switch port is in the wrong VLAN.
• A firewall or security product on the client is blocking UDP 67/68.
• The DHCP Client service is stopped (Windows) or the DHCP client is not running (Linux with no manager).
• 802.1X port authentication has not completed, so the switch drops everything except EAP.
• Wi-Fi is "connected" but the access point's backhaul is down: the AP answers association but nothing behind it works.
• A Windows Hyper-V/VirtualBox host-only adapter is expected to be 169.254 or an internal range; that one is fine.

Fix:

ipconfig /release
ipconfig /renew
sc query dhcp                     # STATE should be RUNNING
net start dhcp                    # if not
netsh interface ipv4 show config  # is it set to DHCP? if static, set correctly or switch to dhcp
netsh interface ipv4 set address "Ethernet" dhcp

sudo dhclient -v enp3s0          # watch for DHCPOFFER; if none, the server isn't answering
sudo nmcli device reapply enp3s0
sudo networkctl renew enp3s0
sudo tcpdump -i enp3s0 -n port 67 or port 68    # see DISCOVER go out, look for OFFER coming back

sudo ipconfig set en0 DHCP
ipconfig getpacket en0            # empty means no ACK was received
networksetup -setdhcp "Wi-Fi"

If a renew fails everywhere and the router looks fine, give yourself a temporary static address in the LAN's range (for example 192.168.1.250/24, gateway 192.168.1.1, DNS 1.1.1.1) and see whether the network works. If it does, the problem is purely DHCP: reboot the router, check its DHCP pool size and lease list, and look for a second device handing out leases (rogue DHCP). If static does not work either, the problem is layer 2: VLAN, port security, bad switch.

No default gateway

What it means: you have an address but no route off the local network. Local devices are reachable, the internet is not.

ipconfig                          # Default Gateway line blank
route print -4                    # no 0.0.0.0 0.0.0.0 line
# fix for a static adapter:
netsh interface ipv4 set address "Ethernet" static 192.168.1.50 255.255.255.0 192.168.1.1
# fix for DHCP: the server didn't send option 3, or a VPN removed the route; renew or reconnect
ipconfig /renew
route add 0.0.0.0 mask 0.0.0.0 192.168.1.1     # temporary manual route

ip route                          # no 'default via'
sudo ip route add default via 192.168.1.1 dev enp3s0
# persistent with NetworkManager:
sudo nmcli con mod "Wired connection 1" ipv4.gateway 192.168.1.1 && sudo nmcli con up "Wired connection 1"
# if the route exists but on the wrong interface, check metrics:
ip route show default

route -n get default              # 'route: writing to routing socket: not in table' = none
sudo route add default 192.168.1.1
sudo networksetup -setmanual "Wi-Fi" 192.168.1.50 255.255.255.0 192.168.1.1

Common causes: a static configuration typed without the gateway; a DHCP server misconfigured with no router option; a VPN client that replaced the default route and did not restore it on disconnect (reconnect and disconnect cleanly, or reboot); Windows setting the connection to "Public" with a policy that blocks; on Linux, ipv4.never-default yes on the profile; a DHCP lease that expired and was not renewed (the address remains, the route is dropped on some clients).

ipconfig /renew fails

Can ping an IP but not a name

What it means: the network is fine; name resolution is not. ping 1.1.1.1 works, ping example.com says could not find host, Temporary failure in name resolution, or cannot resolve.

ipconfig /all | findstr /c:"DNS Servers"
nslookup example.com              # uses the configured server
nslookup example.com 1.1.1.1      # bypasses it: if this works, your DNS server is the problem
ipconfig /flushdns
netsh interface ipv4 set dnsservers "Ethernet" static 1.1.1.1 primary
netsh interface ipv4 add dnsservers "Ethernet" 1.0.0.1 index=2
Get-DnsClientDohServerAddress     # PowerShell: is DoH configured and failing?

resolvectl status                 # which servers, per link
cat /etc/resolv.conf
dig example.com                   # configured resolver
dig @1.1.1.1 example.com          # direct
resolvectl query example.com
sudo resolvectl flush-caches
sudo resolvectl dns enp3s0 1.1.1.1 1.0.0.1    # temporary override
getent hosts example.com          # what applications actually get (nsswitch)
cat /etc/nsswitch.conf | grep hosts

scutil --dns | head -20
dig example.com
dig @1.1.1.1 example.com
dscacheutil -q host -a name example.com
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
sudo networksetup -setdnsservers "Wi-Fi" 1.1.1.1 1.0.0.1

Causes, roughly in order: the router's DNS forwarder has hung (reboot the router, or point clients at a public resolver); a VPN or security product installed its own resolver and left it behind; DNS-over-HTTPS configured for a provider that is unreachable; a captive portal intercepting DNS; a corporate resolver that only answers on the VPN; a stale negative cache entry (flush); /etc/resolv.conf pointing at 127.0.0.53 while systemd-resolved is stopped (systemctl start systemd-resolved); split-DNS search domains causing example.com to be tried as example.com.corp.local first and timing out.

Some names resolve and others do not: usually the hosts file. Check C:\Windows\System32\drivers\etc\hosts or /etc/hosts for entries left by a game, a blocker or malware. Only one site fails: that site's DNS, or a block list on your resolver; test with dig @1.1.1.1.

Duplicate IP address conflict

What it means: two devices claim the same IPv4 address. Windows shows a balloon Windows has detected an IP address conflict and logs event 4199; the affected adapter may show the address as (Duplicate) in ipconfig /all. Linux logs IPv4 address conflict from NetworkManager or arping. Symptoms are intermittent: it works for a while, then packets go to the other device.

Find the other device:

ipconfig /release
arp -d *
ping 192.168.1.42                 # your old address; if it answers, someone else has it
arp -a | findstr 192.168.1.42     # its MAC address; look up the OUI to identify the vendor
ipconfig /renew

sudo arping -D -I enp3s0 -c 3 192.168.1.42      # duplicate address detection: any reply = conflict
sudo arping -I enp3s0 192.168.1.42               # replies show the MAC(s) answering
ip neigh | grep 192.168.1.42
sudo nmap -sn 192.168.1.0/24                     # find everything on the LAN with vendor names

ping -c 3 192.168.1.42
arp -an | grep 192.168.1.42
sudo ipconfig set en0 DHCP

Usual causes: a device with a static address inside the DHCP pool (printers, NAS boxes, cameras, a Raspberry Pi someone configured by hand); a DHCP server whose lease database was reset (router rebooted after a factory reset) so it re-issues addresses still in use; two DHCP servers with overlapping pools; a VM cloned with the same static address. Fix: move static devices outside the pool, or reserve their addresses in the DHCP server; reduce the pool if it overlaps. Renewing on the client just papers over it until next time.

Wrong DHCP server, wrong subnet, wrong gateway

If ipconfig /all shows a DHCP Server that is not your router, or your address is in an unexpected range (192.168.0.x when the LAN is 192.168.1.x), a second DHCP server is on the network: a consumer router plugged in LAN-to-LAN, a phone sharing its connection, a badly configured NAS, a Windows machine with Internet Connection Sharing on, or a virtualisation host. Find it by MAC: the DHCP server address is in the ARP table (arp -a), and the OUI identifies the vendor. On Linux, sudo nmap --script broadcast-dhcp-discover lists every server that answers. Unplug it or turn off its DHCP service.

Wi-Fi connected but no internet

Association succeeded (you have a link and an SSID) but nothing beyond. In order:

1. Check for a 169.254 address (above). Public and guest networks often have exhausted DHCP pools.
2. Open a browser to http://neverssl.com or http://captive.apple.com. If a login page appears, it is a captive portal; complete it. Devices sometimes fail to notice the portal.
3. Check the band: some routers with the same SSID on 2.4 and 5 GHz have one band misconfigured. netsh wlan show interfaces, iw dev wlan0 link or wdutil info show the band and channel.
4. Check signal. Below about 30% (RSSI worse than −75 dBm) DHCP and DNS time out while the association survives.
5. Forget the network and rejoin, then reboot the router. Mesh systems in particular can associate you to a node whose backhaul has failed.
6. Windows: run the built-in diagnostics (msdt.exe /id NetworkDiagnosticsNetworkAdapter), then Network reset. Check for a VPN or "web protection" filter driver: netsh winsock show catalog lists layered service providers.

Traffic uses the wrong interface

Laptop on Ethernet and Wi-Fi at once, or a VPN that should (or should not) carry everything. Determine which route wins, then adjust metrics.

route print -4 | findstr 0.0.0.0       # two default routes; lowest metric wins
Get-NetIPInterface -AddressFamily IPv4 | sort InterfaceMetric | ft InterfaceAlias, InterfaceMetric, ConnectionState
Set-NetIPInterface -InterfaceAlias Ethernet -InterfaceMetric 10   # prefer Ethernet
Find-NetRoute -RemoteIPAddress 1.1.1.1  # which one is actually used

ip route show default
ip route get 1.1.1.1
sudo nmcli con mod "Wired connection 1" ipv4.route-metric 50
sudo nmcli con mod "MySSID" ipv4.route-metric 600
ip rule                                 # VPN policy routing rules (WireGuard uses fwmark + table 51820)

route -n get default
netstat -rn | grep default
networksetup -listnetworkserviceorder    # the first active service wins
sudo networksetup -ordernetworkservices "Ethernet" "Wi-Fi"

macOS does not use metrics; it uses the service order. Windows recalculates automatic metrics on link speed changes, so a 100 Mb/s Ethernet link can lose to fast Wi-Fi. VPN clients that "hijack" everything add a default route with metric 0 or two /1 routes (0.0.0.0/1 and 128.0.0.0/1) that are more specific than the default; route print makes that visible.

MTU problems: some sites load, some hang

Symptoms: ping and DNS work, small pages load, large pages or file downloads stall, SSH sessions connect and then freeze when output is large, VPN works for some things only. This is path MTU black-holing: packets larger than some link on the path are dropped, and the ICMP "fragmentation needed" message that would tell you is filtered.

ping -f -l 1472 1.1.1.1              # 1472 + 28 = 1500. If "Packet needs to be fragmented but DF set", go lower
ping -f -l 1464 1.1.1.1              # 1492 (PPPoE)
ping -f -l 1372 1.1.1.1              # 1400
netsh interface ipv4 show subinterfaces
netsh interface ipv4 set subinterface "Ethernet" mtu=1400 store=persistent

ping -M do -s 1472 -c 3 1.1.1.1
tracepath 1.1.1.1                     # reports the path MTU
ip link show enp3s0 | grep mtu
sudo ip link set enp3s0 mtu 1400
sudo nmcli con mod "Wired connection 1" ethernet.mtu 1400

ping -D -s 1472 -c 3 1.1.1.1
sudo networksetup -setMTU en0 1400
networksetup -getMTU en0

Find the largest payload that gets through, add 28, and set that as the MTU. Common results: 1492 (PPPoE), 1480 (some 4G), 1420 (WireGuard), 1400 (a safe generic value), 1280 (the IPv6 minimum, always works). The right long-term fix is usually on the router or VPN server (MSS clamping), not the client.

Slow network, errors in the counters

Look at the error and drop counters in ifconfig, ip -s link, netstat -e or Get-NetAdapterStatistics. Non-zero and rising errors, frame or CRC counts mean a bad cable, port or duplex mismatch: check ethtool or the adapter properties for 100 Mb/s half-duplex on a gigabit link. Rising dropped with zero errors means the host cannot keep up (ring buffer too small: ethtool -G; CPU pegged by interrupts; a virtual NIC starved by the hypervisor). Collisions above zero on a switched network mean a half-duplex link. Wi-Fi retries and low bitrates show in iw dev wlan0 station dump and netsh wlan show interfaces (Receive/Transmit rate).

IPv6 breaks things

If a site is reachable over IPv4 but hangs or fails over IPv6 (a router advertising a prefix whose upstream is broken, or an ISP with a faulty IPv6 path), browsers should fall back via Happy Eyeballs, but tools like curl, apt, pip and git wait for a long timeout first. Confirm with curl -6 -I https://example.com vs curl -4 -I https://example.com, and ip -6 route / ipconfig showing a global IPv6 address and gateway. Temporary workaround: disable IPv6 on the adapter (cheat sheet) or, better, prefer IPv4 without disabling: on Linux add precedence ::ffff:0:0/96 100 to /etc/gai.conf; on Windows set the DisabledComponents registry value to 0x20. Then fix the router.

Everything looks right but nothing works

• Firewall. Windows: netsh advfirewall show allprofiles; try netsh advfirewall set allprofiles state off briefly. Linux: sudo nft list ruleset, sudo ufw status, sudo firewall-cmd --list-all. macOS: System Settings › Network › Firewall, and sudo pfctl -s rules.
• Proxy. Windows: netsh winhttp show proxy and Settings › Proxy. Linux: env | grep -i proxy. macOS: scutil --proxy.
• Leftover VPN or filter drivers. Windows: netsh winsock show catalog, uninstall the product properly, then netsh winsock reset. Linux: ip link for tun0/wg0 and ip rule for stray policy rules.
• Time. A clock that is years off breaks TLS everywhere while ping works. w32tm /resync, timedatectl, sntp -sS time.apple.com.
• Hosts file. See above.
• Half-applied change. A static address on the adapter while the router expects DHCP with reservations, or vice versa. Compare ipconfig /all against the router's client list.

Full reset procedures

netsh winsock reset
netsh int ip reset
netsh int ipv6 reset
netsh advfirewall reset
ipconfig /release
ipconfig /renew
ipconfig /flushdns
shutdown /r /t 0

sudo systemctl restart NetworkManager        # or systemd-networkd
sudo nmcli networking off && sudo nmcli networking on
sudo ip addr flush dev enp3s0 && sudo nmcli device reapply enp3s0
sudo resolvectl flush-caches
sudo ip neigh flush all
sudo ip route flush cache
# and the heavy option:
sudo reboot

Related pages

• ipconfig error messages
• ifconfig error messages
• Flush DNS on every platform
• Reading the output