When even the gateway is unreachable, drop to Layer 2. The ARP table and MAC address tables reveal cabling, VLAN, and duplicate-IP problems ping can’t see.
Why: if you cannot even reach the default gateway on your own subnet, the problem is almost always Layer 2 — a bad cable, a wrong VLAN, a down switch port — not routing or DNS. When: local-only failures (can’t reach the gateway or a same-subnet host) send you to Layer 2. Where: the ARP table is the bridge between the IP you tried and the MAC it needs.
arp -a # Windows / macOS: IP -> MAC mappings
ip neighbor # Linux
# An entry stuck as "incomplete" (no MAC) means ARP got no reply:
# the target is off, on a different VLAN, or the link is broken.
# No gateway entry at all -> Layer 1/2 problem to the gateway.Why: two hosts with the same IP cause intermittent, maddening connectivity because ARP replies fight over the mapping — and on switches, a MAC "flapping" between ports signals a loop or a moved device. When: suspect a duplicate IP when connectivity works intermittently for two hosts. Where: the switch’s MAC address table shows which port a MAC is learned on — a flapping MAC is a red flag.
! On a Cisco switch — where is a MAC, and is it stable?
SW1# show mac address-table ! MAC -> port mappings
SW1# show mac address-table address 00:1a:2b:3c:4d:5e
! Log messages like "%SW_MATM: Host ... is flapping between port X and Y"
! mean a loop or a duplicate — investigate STP and cabling.Why: the lowest layer is often the culprit — a port that is administratively down, has errors, or negotiated the wrong speed/duplex causes slowness or total failure that higher-layer tools cannot see. When: check interface status and error counters when a link is flaky or dead. Where: rising CRC/input errors point to a bad cable or duplex mismatch.
! On a Cisco switch/router:
SW1# show interfaces status ! up/down, speed, duplex, VLAN
SW1# show interfaces Gig0/1 ! detailed counters
! Watch for:
! "administratively down" -> someone shut the port (no shutdown to fix)
! rising CRC / input errors -> bad cable or duplex mismatch
! speed/duplex mismatch -> slow, error-prone link