Neighbours and ARP
Routing decides the next hop's IP address. To actually send an Ethernet frame, the host needs that next hop's MAC address. On IPv4 it finds it with the Address Resolution Protocol (ARP): a broadcast asking "who has 192.0.2.1?", answered by the owner. IPv6 does the same job with Neighbour Discovery.
Results are cached in the neighbour table, shown by ip neigh:
| State | Meaning |
|---|---|
REACHABLE | Recently confirmed. Frames go straight out. |
STALE | Cached but not recently confirmed. Still used, and re-checked on the next send. |
INCOMPLETE | ARP request sent, no answer yet. |
FAILED | No answer. Nothing at that address on this LAN, or it's filtered. |
Two classic findings:
Destination Host Unreachablefrom your own address for a destination on your subnet means ARP failed: the host is down, unplugged, or not actually on that LAN.- A
FAILEDentry for your gateway means nothing can leave the subnet. Check the gateway address, the VLAN, and whether the gateway is up.
ip neigh flush dev eth0 clears the cache, which is handy after replacing a device whose IP stayed the same but MAC changed.
Interactive: ARP before ping Before the first ping can be sent, the client needs a MAC address. Compare the gateway, which answers, with an address where nobody is home. (needs JavaScript)
root@client:~# ip neigh
root@client:~# ping -c 1 192.0.2.1
PING 192.0.2.1 (192.0.2.1) 56(84) bytes of data.
64 bytes from 192.0.2.1: icmp_seq=1 ttl=64 time=0.050 ms
--- 192.0.2.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.050/0.050/0.050/0.000 ms
root@client:~# ip neigh
192.0.2.1 dev eth0 lladdr f2:29:6d:12:cc:2c REACHABLE
root@client:~# ping -c 2 192.0.2.99
PING 192.0.2.99 (192.0.2.99) 56(84) bytes of data.
From 192.0.2.10 icmp_seq=1 Destination Host Unreachable
From 192.0.2.10 icmp_seq=2 Destination Host Unreachable
--- 192.0.2.99 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1047ms
pipe 2
root@client:~# ip neigh
192.0.2.1 dev eth0 lladdr f2:29:6d:12:cc:2c REACHABLE
192.0.2.99 dev eth0 FAILED - Line 1: Empty cache: the client hasn't talked to anyone yet.
- Lines 9–10: Pinging the gateway triggered ARP. Its MAC is now cached as REACHABLE.
- Lines 11–14: Nobody has 192.0.2.99. The error comes from our own address: the client couldn't resolve the MAC, so it never sent the ping.
- Lines 19–21: FAILED: ARP got no answer. The definitive sign that nothing at that address is on this LAN.
Check your understanding
A host can ping other machines on its subnet but nothing beyond it. ip neigh shows the gateway as FAILED. What do you check?
- DNS settings
- That the gateway address is right and the gateway is up and on the same LAN/VLAN
- The remote server's firewall
- Raise the ARP cache timeout