The local network
IP gets a packet to the right building. Something else has to get it through the door — and that something has two failure modes that look haunted.
- You can describe what happens between typing
ping 192.168.1.1and the first ICMP reply, including ARP. - You can explain why a duplicate IP address produces "sometimes it works", and why an unmanaged switch can take down a floor.
You unplug a colleague's machine and plug yours in. Same cable, same socket, new laptop — and you get an address conflict warning. The network did not change. What changed is which hardware address answers for a familiar IP.
This module is the first hop: frames, hardware addresses, and the protocol that ties them to IP.
4.1Frames and hardware addresses
Ethernet delivers frames inside one network. A frame has a destination MAC, a source MAC, a type field, the payload, and a checksum. Switches learn which MAC lives on which port by reading source addresses, then forward unicast frames only out of the right port. Broadcast frames (destination ff:ff:ff:ff:ff:ff) go out of every port in the same VLAN, by design.
No TTL exists at this layer, which has a consequence worth stating plainly: a loop is not slow, it is fatal. A broadcast frame that reaches a loop is copied forever, and the switches spend all their capacity copying it.
4.2ARP: the bridge from IP to MAC
To send a packet to 192.168.1.1, your machine needs that device's MAC address. It asks the whole network: "who has 192.168.1.1?" The reply is unicast, and the answer is cached for a few minutes.
The host compares 192.168.1.1 with its own prefix. It is local, so the packet goes directly, not to the gateway. Now it needs a MAC address for it.
The neighbour table has no entry, so the frame cannot be built. This is where many "no route to host" errors come from: the route exists, the neighbour does not.
An ARP request goes out to every port in the VLAN: who has 192.168.1.1, tell 192.168.1.42. Every device receives it; one answers.
The owner replies directly with its MAC. Devices that are not the owner quietly ignore the question — but they may cache the sender's address anyway, which is what makes ARP spoofing possible.
The cached MAC lets the frame be built and the ping goes out. The entry now shows as REACHABLE for a few minutes, then goes STALE, then is re-checked on next use.
ip neigh # the ARP cache, with state
arping -I eth0 192.168.1.1 # ask directly, bypass the cache
ip neigh flush dev eth0 # force a cold startRead the state column rather than just the presence of an entry. REACHABLE means recently confirmed. STALE is normal and means "probably fine, re-verify when used". FAILED is a precise diagnosis: the link is up, the address is configured, and nobody answered. That points at a wrong subnet, a VLAN mismatch, a host firewall, or a duplicate address.
4.3VLANs: several networks on one switch
A VLAN is a broadcast domain inside a switch. Ports assigned to VLAN 10 cannot hear broadcasts from VLAN 20, even though they share the same hardware. To carry several VLANs between switches you need a trunk: each frame is tagged with its VLAN number (IEEE 802.1Q, four bytes), and the receiving switch reads the tag and forwards accordingly.
An access port belongs to exactly one VLAN and sends untagged frames to the device plugged into it. A trunk port carries many and tags them. Both switches must agree on which VLANs a trunk carries, and — the detail that causes most outages — on the native VLAN, the one that travels untagged.
4.4The two failures that look haunted
Two devices claim 192.168.1.50. Whichever answers an ARP request first wins the cache entry, so half the traffic goes to the wrong machine and the other half works. The symptom is "it works, then it doesn't, then it works", which sends people looking at cables and drivers. arping to the address from the gateway finds it in one command: two replies with different MACs.
Someone needs one more port and plugs a $20 unmanaged switch into a wall socket. Now there are two paths between two switches, and nothing is running spanning tree to block one. The first broadcast frame circulates forever, MAC tables flap, and the floor loses connectivity within seconds. The structural fix is a feature, not a policy: every access port should have PortFast to skip the listening delay, and BPDU Guard to shut the port the moment a switch announces itself.
Why does a duplicate IP address produce intermittent connectivity instead of a clean failure?
60-second recap
- ARP turns an IP into a MAC.
FAILEDin the neighbour table is a precise diagnosis, not a vague one. - VLANs are broadcast domains. Trunks tag frames; the native VLAN must match at both ends.
- Loops are fatal, not slow. Because Ethernet has no TTL, a loop consumes the network instead of delaying it.