ARP finds an IPv4 neighbour
On an Ethernet IPv4 LAN, a sender needs the MAC address of its next hop. If it has no usable cached mapping, it broadcasts an ARP request asking who owns that local IP address. The owner normally replies with its MAC address, and the sender can cache the mapping for subsequent frames.
For a remote IP destination, the next hop is usually a router. The host asks for the router’s MAC address, not the remote server’s. ARP is local to the link and does not provide an end-to-end internet directory. Cached entries also explain why a capture may show IP traffic without a preceding ARP exchange.
DHCP supplies configuration
An initial DHCPv4 exchange commonly follows Discover, Offer, Request, Acknowledge. A client seeks configuration, a server offers a lease, the client requests an offer, and the server acknowledges it. DHCP can supply an IP address, subnet mask, router, DNS servers, and lease timing. DHCPv4 uses UDP server port 67 and client port 68.
A lease lasts for a limited period and can be renewed. A capture that starts after initial configuration may show only a renewal or no DHCP at all. Some hosts use static settings. A DHCP failure can prevent normal connectivity, but seeing no DHCP packets does not prove that failure.
If a host self-assigns a 169.254.x.x link-local address when the LAN expects DHCP, investigate the lease process, VLAN, and link. This is a clue, not proof that the DHCP server is down. IPv4 link-local autoconfiguration selects from 169.254.1.0–169.254.254.255; the first and last /24 within 169.254/16 are reserved. A successful lease should include the expected prefix and gateway, not merely an address.
ICMP reports reachability and errors
ICMP carries IP control and error information. Ping normally sends echo requests and looks for echo replies. An echo reply supports reachability for that exchange, while an ICMP destination-unreachable message supplies a more specific clue about failed delivery. Inspect the sender, type, code, and quoted original packet.
A successful ping does not prove that a web service is listening. No echo reply is also inconclusive: filtering, loss, an unavailable destination, or capture limitations can all explain it. Traceroute uses hop limits and responses to probe a path, but unanswered probes and different return paths limit what the result establishes.