Windows CMD: Read ARP and the Routing Table
The host can reach its subnet but not remote networks. Correlate the gateway's ARP entry with the default route. Work through it yourself in the live host terminal below.
Symptom
The host can reach its subnet but not remote networks. Correlate the gateway's ARP entry with the default route.
Your mission
Inspect, recover, then verify
Format
Windows Command Prompt
Investigate before you configure.
Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.
Observe the symptom and link state.
Diagnose by comparing the protocol evidence.
Verify the expected device state and confirm the original symptom is resolved.
Console access: Command Prompt
This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.
Need a hint?
Reveal the root cause when you're ready.
Try the investigation first, then use this as your escape hatch, not a dead end.
Lab debrief
Turn the session into a repeatable troubleshooting pattern.
Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.
The problem
Local server 10.20.30.25 responds, but every off-subnet destination fails after a VPN client installed a preferred default route through 10.99.0.1.
What you'll practice
- Display the ARP cache with arp -a
- Read active IPv4 routes with route print -4
- Distinguish neighbor resolution from route selection
- Delete one bad route rather than flushing the table
The topology
A Windows laptop has Ethernet gateway 10.20.30.1 and a disconnected VPN adapter. A stale VPN default route has a lower metric than the valid Ethernet route.
Commands to run yourself
The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.
arp -aroute print -4Topology diagram
Fact-checked references
The commands and behaviour in this lab were checked against these primary references.
Frequently asked
Why not use route /f?
That clears nearly all nonessential routes and is far broader than this fault. A targeted delete preserves valid routes.
Does a gateway ARP entry prove remote routing works?
No. It proves the host resolved a same-link neighbor. The routing table still decides which gateway receives off-subnet traffic.
Ready to run this lab yourself?
No setup, no image sourcing. Book a session or ask for a live demo.