The internet disappeared from the whole apartment. Not slow, not flaky — gone. And within about ninety seconds of looking, I was fairly sure it wasn't my fault. Twenty minutes after that, I could prove it — using, of all things, the one escape hatch that didn't work.
The shape of the problem
Every device in the house still talked to every other device. The router was up, the switch was up, WiFi was solid, and DNS happily resolved anything on the LAN. The one thing missing was the way out. My laptop was already limping along on a phone hotspot, which is the only reason I could look at any of this at all.
When the LAN is perfectly healthy and only the exit is dead, the honest first question is simple: is this me, or is it upstream? The answer lives on exactly one interface — the WAN — so that's where I went. To reach the router without depending on the dead internet, I ran a plain ethernet cable from my laptop straight into a spare LAN port and pinned it LAN-only, so the phone hotspot kept carrying my actual internet while the cable carried my SSH. Two different paths, no crossing.
The router was doing everything right
The WAN link was up — carrier present, the line to the ISP electrically fine. And the router's DHCP client was out on that wire doing exactly what it's supposed to: broadcasting "hello, can I have an address?" every few seconds, forever. What it wasn't getting was an answer. No lease. No default route. No way out.
The router was shouting the right question into the wire and hearing nothing back.
That already smells like upstream — my gear is behaving — but "smells like" isn't "is." A full power-cycle of the fibre box did nothing. A clean reboot of the router came back healthy and still leaseless. So I stopped guessing and put a packet capture on the WAN.
What the wire actually said
Thirty seconds of capture, and three facts fell out. The third is the one that mattered.
One: my router was sending valid DHCP requests, over and over, from its own MAC. My side works. Two: nothing answered them — not a single offer, across every retry. Three, and this is the good one: sitting right there on the same wire was my ISP's own gateway, wide awake and chatting, ARPing for other customers' addresses. The node feeding my building wasn't dead at all. And next to it, a neighbour's router was doing the exact same desperate "please, an address" dance — and getting the exact same silence.
my router → DHCP DISCOVER → (broadcast) [ me, asking, repeatedly ]
← ......nothing...... [ no OFFER, ever ]
ISP gateway → ARP who-has 203.0.113.x [ alive, serving others ]
neighbour → (also asking, also getting silence) [ not just me ]Then the last piece, from the human network rather than the wire: a friend in a different building, same ISP, had full internet.
Put those together and the picture snaps into focus. The ISP's core was up — my friend proved it. The gateway feeding my building was alive — it was on my wire. But the thing that hands out addresses on my segment had stopped answering, for me and for at least one neighbour. A small, local outage, one layer below the gateway.
The escape hatch that proved the point
Here's the part I actually enjoyed. If the gateway is alive and I still know my old address — why not just take it? Statically configure the router's WAN with the last lease I held and route through the gateway directly, skipping the broken DHCP entirely. It's a classic move when an ISP's DHCP is down but the gateway is up.
I tried it. Same address, same gateway, same MAC. And the gateway — the one I'd just watched happily ARPing for other people — would not so much as answer an ARP from me. A hundred percent loss to a device that was demonstrably, provably right there.
The workaround failing wasn't a dead end. It was the confirmation.
Because that's how the last mile works. The operator's access network between you and the ISP doesn't just forward whatever shows up — it runs DHCP snooping and IP source guard. The access switch only carries traffic for an IP/MAC pair it learned from a successful DHCP lease. No lease, no authorization, and your frames get dropped before they ever reach the gateway. There is no static-IP path around it, by design. It was DHCP the whole way down, and DHCP is the one thing that segment refuses to let you skip. The moment my clever bypass got silently dropped, I had my answer.
How it ended
It came back on its own. The segment's DHCP started answering again, my router's client — which had never once stopped asking — grabbed a fresh lease within seconds, the same address as before, and the whole apartment was back. Nothing I did fixed it, because there was nothing on my side to fix. (The internet returning right as I was elbow-deep in the wire made it feel like I'd done it. I hadn't. A fresh lease from the ISP's own DHCP server is a very different thing from my failed static hack, and it's worth being honest with yourself about which one actually happened.)
But the twenty minutes weren't wasted. I built two small things so the next one is a ten-second verdict instead of a scramble. A one-shot wan-doctor that runs the whole diagnosis — link, lease, the DISCOVER-out / OFFER-in capture, the is-the-gateway-alive check — and prints an upstream-or-us verdict at the bottom. And a watchdog that checks the exit every minute and fires a notification the instant the WAN drops — delivered over the LAN to a local server, so it still reaches my phone when the internet itself is gone.
The lesson
Two of them. The diagnostic one: when the LAN is healthy, the config hasn't changed, and only the exit is dead, it is almost always upstream — but don't argue it, prove it on the wire. A thirty-second capture that shows your requests leaving and nothing coming back, with the ISP's own gateway alive right beside them and a neighbour failing too, is worth more than an hour of power-cycling things and hoping.
The second is stranger and more satisfying: sometimes the failure of a workaround is the cleanest evidence you'll ever get. I couldn't static-IP my way out — and the precise reason I couldn't (the access network gates every port on a valid DHCP lease) was the diagnosis, in one line. The house wasn't dark because anything of mine was broken. It was dark because a live gateway was sitting behind a locked gate, and the gate only opens for a lease that nobody, that evening, was handing out.
Comments