Ethernet Connected But No Internet? Complete Technical Fix Guide

Ethernet No Internet Symptoms Matrix

The specific error message or status shown by Windows narrows down the fault layer significantly. Use this matrix to identify your exact root cause:

How Ethernet Communication Works: Layer 1 to Layer 7

Ethernet connectivity is established across multiple protocol layers. A failure at any layer blocks all higher-layer communication, but presents differently to the end user. Understanding the OSI model layers relevant to Ethernet helps pinpoint exactly where the fault occurs:

• Layer 1 — Physical: The electrical signal (100BASE-TX, 1000BASE-T, or 2.5GBASE-T) is transmitted over the copper conductors in the Cat5e/Cat6 cable. Link pulse signals confirm the physical connection — this is what the LED link light indicates. A link light confirms only Layer 1 is active.
• Layer 2 — Data Link (Ethernet Frame): Ethernet frames are addressed using 48-bit MAC addresses. Switches use MAC address tables to forward frames to the correct port. ARP (Address Resolution Protocol) operates at this layer to map IP addresses to MAC addresses. VLAN tags (802.1Q) are also applied at Layer 2.
• Layer 3 — Network (IP): IP addresses are assigned via DHCP or configured statically. The routing table determines which gateway to forward packets to. A missing or incorrect default route (0.0.0.0/0) causes all internet traffic to be discarded locally.
• Layer 4 — Transport (TCP/UDP): TCP establishes reliable connections using three-way handshakes. Winsock API corruption at this layer can block all socket connections, even when lower layers are fully functional.
• Layer 7 — Application (DNS): DNS translates domain names (google.com) to IP addresses. A failed DNS server makes all web browsing appear broken even when the network is fully functional at layers 1-4.

IP Assignment Failures: DHCP vs. Static Configuration

When a device connects via Ethernet, the network adapter broadcasts a DHCP Discover packet to request an IP address. The router's DHCP server responds with a DHCP Offer containing an IP address, subnet mask, default gateway, and DNS server addresses. If this exchange fails, the device enters the APIPA fallback state, self-assigning a 169.254.x.x address.

Diagnosing DHCP Failures on Windows

# Step 1: Check current IP configuration
ipconfig /all

# Step 2: Release and renew IP lease
ipconfig /release
ipconfig /renew

# Step 3: If renewal fails, assign a temporary static IP
# (Use the router's subnet, avoid the DHCP pool range)
netsh interface ip set address "Ethernet" static 192.168.1.250 255.255.255.0 192.168.1.1

# Step 4: Restore DHCP after testing
netsh interface ip set address "Ethernet" dhcp

If a temporary static IP provides internet access, the router's DHCP server is the fault point. Log into the router admin panel and verify that: the DHCP server is enabled, the lease pool has available addresses, and the server is actively responding to requests.

DNS Resolution Failures: Why Ping Works But Websites Don't Load

A common and frequently misdiagnosed scenario: the Ethernet adapter has a valid IP address, ping to 8.8.8.8 succeeds, but web browsers cannot load any websites. This is a pure DNS resolution failure — the DNS server configured in your DHCP settings is unreachable or returning errors.

The distinction between DNS failure and network failure is simple to test:

# Test 1: Ping a known IP address (bypasses DNS)
ping 8.8.8.8

# Test 2: Ping a domain name (requires DNS)
ping google.com

# Test 3: Explicit DNS resolution test
nslookup google.com 1.1.1.1

# Test 4: Flush DNS cache and retry
ipconfig /flushdns

If Test 1 succeeds but Test 2 fails, DNS is the fault. Change your DNS server settings immediately. You can set the DNS server directly in the Ethernet adapter's IPv4 properties or in your router's DHCP configuration (to push the DNS change to all connected devices).

Recommended public DNS servers for reliability and speed:

• Cloudflare: Primary 1.1.1.1, Secondary 1.0.0.1
• Google: Primary 8.8.8.8, Secondary 8.8.4.4
• Quad9 (filtered/secure): Primary 9.9.9.9, Secondary 149.112.112.112

Gateway Connectivity Problems: Router WAN Diagnosis

If your device has a valid local IP and can ping the gateway, but cannot reach external IP addresses, the router's WAN interface is the fault point. The router has a healthy LAN but no internet connection itself.

Log into the router admin panel and navigate to the WAN or Internet Status page. Check:

• WAN IP Address: Should show a valid public or ISP-assigned IP. If it shows 0.0.0.0, the router's WAN DHCP negotiation with the ISP has failed.
• WAN Gateway: Should show the ISP's gateway IP. If missing, the router has no route to the ISP's network.
• WAN DNS: Should show the ISP's DNS server or your configured custom DNS.
• Connection Type: Verify the connection type (DHCP, PPPoE, Static) matches your ISP's requirements. Incorrect connection type will prevent WAN authentication.

If the WAN status shows all correct values but internet is still inaccessible, perform the gateway diagnostic using traceroute:

tracert 8.8.8.8

If the traceroute shows responses from your router (hop 1) but asterisks (*) at hop 2 (the ISP's first node), the ISP line between your router and the ISP's equipment is dropping packets. Contact your ISP's technical support and provide the traceroute output.

Driver Corruption Issues: Diagnosing Ethernet Adapter Software Faults

Ethernet adapter drivers translate between the Windows network stack and the physical NIC hardware. Driver corruption, incompatible versions installed by Windows Update, or conflicts with virtualization software (VMware, Hyper-V, VirtualBox) can cause the adapter to report as connected while failing to correctly process network packets.

Symptoms of Driver Corruption

• Ethernet adapter shows in Device Manager with a yellow exclamation mark (Code 43 or Code 10)
• Adapter intermittently disappears from Device Manager and reappears
• Link speed negotiation fails (adapter connects at 10 Mbps instead of 1 Gbps)
• Packet loss on Ethernet but not on a second computer using the same cable and port
• Network stack resets (netsh winsock reset) provide temporary relief but the issue returns

Driver Reinstallation Procedure

# In Device Manager (devmgmt.msc):
# 1. Expand "Network Adapters"
# 2. Right-click your Ethernet adapter
# 3. Select "Uninstall device"
# 4. Check "Delete the driver software for this device"
# 5. Click Uninstall
# 6. Action menu → Scan for hardware changes
# Windows will reinstall the default driver

# For Intel NIC driver update via PowerShell:
# Download from intel.com/download-center and run:
.Install.bat

Windows Network Stack Repair: Complete Command Reference

The Windows TCP/IP network stack consists of multiple components that can become corrupted independently. This is the complete sequence to fully reset the Windows network stack:

1. Flush DNS Resolver Cache

ipconfig /flushdns

Clears the local DNS resolver cache. Forces the OS to perform new DNS lookups instead of using cached (potentially stale or incorrect) entries.

2. Release and Renew IP Address

ipconfig /release
ipconfig /renew

Releases the current DHCP lease and broadcasts a new DHCP Discover packet to obtain a fresh IP configuration from the DHCP server.

3. Reset Winsock API Catalog

netsh winsock reset

Removes all third-party Layered Service Provider (LSP) entries installed by VPNs, firewalls, and network optimization tools. Restores the Winsock catalog to its Windows default state. Requires a system restart.

4. Reset TCP/IP Stack

netsh int ip reset

Rewrites the TCP/IP protocol stack configuration in the Windows registry to factory defaults. This clears custom IP routes, incorrect static configurations, and registry corruption affecting the IP stack. Requires a system restart.

5. Disable Large Send Offload (LSO) — Advanced Fix

# In Device Manager → Ethernet Adapter → Properties → Advanced tab:
# Find "Large Send Offload v2 (IPv4)" → Set to Disabled
# Find "Large Send Offload v2 (IPv6)" → Set to Disabled

# Or via PowerShell (replace "Ethernet" with your adapter name):
Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "Large Send Offload v2 (IPv4)" -DisplayValue "Disabled"
Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "Large Send Offload v2 (IPv6)" -DisplayValue "Disabled"

LSO offloads TCP segmentation from the CPU to the NIC hardware. Driver bugs in LSO implementation can corrupt TCP segments, causing connections to stall or fail intermittently. Disabling LSO forces the CPU to handle segmentation, bypassing the buggy NIC firmware code.

MAC Address Conflicts: Detection and Resolution

Each network device has a factory-assigned 48-bit MAC address (Media Access Control address) that uniquely identifies it at the Ethernet frame level. Network switches maintain MAC address tables that map each MAC address to a specific switch port. When two devices share the same MAC address, the switch's MAC table flaps between the two ports, causing frames to be delivered to the wrong device intermittently.

# View ARP cache to detect duplicate MAC mappings:
arp -a

# View your adapter's MAC address:
ipconfig /all | findstr "Physical"

# On Linux — check for duplicate MACs on LAN:
ip neigh show | sort -k5

If you identify a MAC address conflict, check the router's DHCP client list for duplicate MAC entries. Also verify that your OS is not configured to randomize the MAC address on wired Ethernet connections (this is normally only used for Wi-Fi privacy but can be accidentally enabled on Ethernet adapters).

VLAN Misconfiguration in Managed Switches: Invisible Isolation

Virtual Local Area Networks (VLANs) allow a single physical switch to logically segment traffic into separate broadcast domains. In office or advanced home networks, VLANs isolate traffic between different device categories (e.g., VLAN 10 for corporate devices, VLAN 20 for guest devices, VLAN 30 for IoT devices).

A VLAN misconfiguration is particularly difficult to diagnose because:

• The physical Ethernet link is fully active (green LED on both ends)
• The device receives no DHCP response (placed on a VLAN without a DHCP server)
• The device may receive an IP from a DHCP server on the wrong VLAN (e.g., guest VLAN with internet blocked)
• Trunk Port vs. Access Port: If the switch port is configured as a trunk port (carrying 802.1Q VLAN tags) instead of an access port (untagged), the connected Windows PC will not recognize the 802.1Q tags and cannot process the VLAN-tagged frames.

Resolution: Log into the managed switch's web interface. Navigate to VLAN settings, find the port connected to the affected device, and verify it is configured as an untagged member of the correct VLAN that has access to the router's DHCP server and internet gateway.

Managed Switch Troubleshooting: Port Security and 802.1X Authentication

Enterprise-grade managed switches often implement port security features that can silently block new devices:

• MAC-Based Port Security: The switch is configured to allow only a specific number of MAC addresses per port (often just one). Connecting a new device or replacing a network adapter triggers a security violation, placing the port in err-disabled state. The link LED may remain green but the port discards all traffic.
• 802.1X Network Access Control: The switch requires all devices to authenticate via a RADIUS server before permitting traffic. Devices without a valid 802.1X supplicant or certificate will be placed on a restricted VLAN with no internet access.
• DHCP Snooping: Managed switches with DHCP snooping enabled will block DHCP Offer packets from untrusted ports. If a device is connected to a port not configured as a DHCP trusted port, it may not receive DHCP responses.

ISP-Side Causes: When the Problem Is Beyond Your Network

If all local diagnostics confirm that the Ethernet hardware, adapter, driver, and router LAN configuration are correct, the fault may lie with the ISP's equipment or the line between the modem and the ISP's central office:

• ISP DHCP Server Failure: The ISP's DHCP server fails to respond to the router's WAN DHCP Discover requests. The router's WAN interface shows 0.0.0.0 as its IP address. This is an ISP-side issue requiring their NOC intervention.
• PPPoE Authentication Rejection: The ISP's BRAS (Broadband Remote Access Server) rejects the router's PPPoE authentication credentials. Check the router's WAN log for authentication failure messages and verify the ISP username/password is correct.
• MAC Address Binding: Some ISPs bind their provisioned service to a specific modem or router MAC address. Replacing either device without notifying the ISP will cause the WAN connection to fail. Contact your ISP to update the registered MAC address.
• Physical Line Fault: Damage to the coaxial cable, fiber splice, or copper pair between your home and the ISP's node will cause intermittent or complete connectivity failure. Request an ISP line test or technician visit.

Advanced Packet Testing: Using Ping and Traceroute Correctly

Systematic use of ping and traceroute allows you to pinpoint at which network layer and at which physical hop packet loss is occurring:

# Test 1: Local loopback (confirms TCP/IP stack is functional)
ping 127.0.0.1

# Test 2: Local gateway (confirms LAN and router reachability)
ping 192.168.1.1

# Test 3: ISP's first hop (confirms WAN connectivity to ISP node)
# (Find your WAN gateway IP from the router's WAN status page)
ping <WAN_GATEWAY_IP>

# Test 4: External IP (confirms ISP routing is working)
ping 8.8.8.8

# Test 5: External domain (confirms DNS is working)
ping google.com

# Full traceroute to external (maps all hops to destination)
tracert -d 8.8.8.8

Work through these five tests in order. The first test that fails identifies the exact fault layer. If Test 1 fails, the Windows TCP/IP stack itself is corrupt (run netsh winsock reset). If Test 1-2 succeed but Test 3 fails, the WAN connection to the ISP is down. If tests 1-4 succeed but Test 5 fails, DNS is the only fault.

Linux Ethernet Diagnostics: Command Reference

# View all interfaces and IP addresses
ip addr show

# View routing table (check for default route)
ip route show

# Check if link is up and speed/duplex
ip link show eth0
ethtool eth0

# Release and renew DHCP (if using dhclient)
sudo dhclient -r eth0
sudo dhclient eth0

# Check DNS resolution
nslookup google.com 1.1.1.1

# Check ARP table for MAC conflicts
ip neigh show

# Restart NetworkManager if all else fails
sudo systemctl restart NetworkManager