How to check gateway reachability in Linux

Gateway reachability separates a local first-hop failure from a wider upstream outage on a Linux host. A gateway that does not answer or resolve at the neighbor layer can make DNS, package mirrors, public APIs, and remote subnets appear down even when the interface still has an address.

The kernel chooses the first hop through the routing table and policy rules. ip route get shows the gateway, interface, and source address selected for one destination, while ping checks whether the gateway replies to ICMP echo requests. ip neigh then shows whether ARP for IPv4 or NDP for IPv6 resolved that gateway to a link-layer neighbor entry.

Routers can rate-limit or block ICMP echo replies, and VPNs or multiple uplinks can choose a different gateway for one destination than a simple default-route listing suggests. A failed or incomplete neighbor entry is stronger evidence of a local first-hop problem than one lost echo reply, because the host could not resolve the gateway on the local link.

Steps to check gateway reachability with ip and ping in Linux:

Display the default gateway and interface.
```
$ ip route show default
default via 192.168.1.1 dev enp0s3 proto dhcp src 192.168.1.50 metric 100
```
The address after via is the IPv4 gateway, and dev is the interface used to reach it. Check IPv6 separately with ip -6 route show default when the affected traffic is IPv6.

Related: How to check the default route in Linux
Ask the kernel which first hop it would use for a numeric external destination.
```
$ ip route get 1.1.1.1
1.1.1.1 via 192.168.1.1 dev enp0s3 src 192.168.1.50 uid 1000
    cache
```
Use a numeric destination so DNS does not affect the route lookup. The via, dev, and src fields show the selected gateway, outgoing interface, and source address for that destination.

Send a short numeric ping to the selected gateway.

$ ping -n -c 3 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.56 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.48 ms
64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.52 ms

--- 192.168.1.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2048ms
rtt min/avg/max/mdev = 0.48/0.52/0.56/0.03 ms

Use ping -6 -n -c 3 2001:db8:1::1 for an IPv6 gateway. If the gateway does not reply, inspect the neighbor entry before treating the first hop as unreachable.

Inspect the neighbor entry for the gateway.
```
$ ip neigh show to 192.168.1.1
192.168.1.1 dev enp0s3 lladdr 00:11:22:33:44:55 REACHABLE
```
REACHABLE and STALE show that the gateway address resolved to a link-layer address. INCOMPLETE or FAILED means the host is not resolving the gateway through ARP or NDP.

Check link counters on the same interface.

$ ip -s link show dev enp0s3
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 00:11:22:33:44:66 brd ff:ff:ff:ff:ff:ff
    RX:  bytes packets errors dropped  missed   mcast
      40419857  115529      0       0       0       0
    TX:  bytes packets errors dropped carrier collsns
        641101    9829      0       0       0       0

Rising errors, dropped, or carrier counts point to local link trouble between the host and the gateway. Re-run the command during a failed ping if the counters are already non-zero.