Unanswered ARP
A machine asked who holds an address on its own network and nobody replied. Everything above this layer fails, and usually confusingly, because the failure happens before any of it starts.
What it looks like
Repeated “who has 10.0.0.5? tell 10.0.0.9” with no reply. The report counts unanswered ARP per address, and a host that never answers appears in the findings.
What it means
ARP is how a machine finds the Ethernet address behind an IP address on its own segment. Without an answer there is nowhere to send the frame, so the connection attempt above never leaves — which is why the application error is usually a timeout with nothing in the capture to explain it.
What causes it
- The host is off, or has moved.
- The address is not on this segment at all. A wrong subnet mask makes a machine ARP for an address it should be routing to, and the answer never comes because nobody there holds it.
- VLAN or trunk misconfiguration. The two machines think they share a segment and do not.
- A quiet address that genuinely does not exist — a scan, or a stale configuration.
The one to watch for
The opposite finding matters more: an address answered by two different Ethernet addresses. That is either a duplicate address or somebody answering for a machine that is not theirs, and on the segment a capture was taken from, it means traffic is being redirected. The report raises that separately, and it deserves attention the same day.