Software · guide

Connected without internet, and the test behind the words

By Alberto Gulotta · Updated 24 September 2026 · 13 min read

Connected without internet means two separate things happened: your device joined the network, and a test it ran afterwards failed. The test is a real request to a real address, and Microsoft publishes both. Knowing what it asks tells you which half of the problem you have before you touch a single cable.

The test your computer runs

The part of Windows that decides is called the Network Connectivity Status Indicator, and Microsoft describes its job in one line: it “is the component responsible for determining network connectivity exists and if it’s Internet or local-only.” That phrase — internet or local-only — is the whole distinction the icon is drawing. Joining a router is local. Reaching past it is internet. The indicator is the thing that tells the difference, and the support pages say the same in plainer words: “To determine if your PC has limited connectivity with no Internet connection, Windows sends a small HTTP request to a server on the Internet.”

Microsoft’s own name for the state is limited connectivity, and it describes it in one sentence: “Your Windows PC is connected to your local network but isn’t connected to the Internet.” The wording on screen moves about — wifi connected but no internet on one device, nothing but a small exclamation mark on another — and on Windows the verdict underneath is the same test coming back negative.

Two details in Microsoft’s description change how you read a failure. The first is that there are two requests, not one: “NCSI sends separate IPv4 and IPv6 active probes in parallel. If either probe succeeds, NCSI determines that the device has internet connectivity.” So an icon that says no internet means both failed. The second is when the test runs at all. Microsoft lists the triggers as interface or network condition changes, proxy detection or changes, and hotspot detection or changes.

Why a café or a hotel shows it

Because the reply is the wrong reply, not because there is no reply. A public network that wants you to accept terms first intercepts the request: Microsoft puts it as captive portals that “may send an HTTP redirect or an empty response to the probe instead of allowing it through to the internet.” The page came back, the words in it were not the words expected, and the indicator does the only honest thing and reports local.

The device is not confused, in other words — it is right, and it is telling you there is a sign-in page you have not filled in. Google gives the same situation from the phone end and the same remedy: “Public networks, like at cafes or airports, often have a webpage for you to complete.” If no page appears, its advice is to look for a notification asking you to sign in, or to open a new page in a new window. Windows will usually open a browser for you, and Microsoft says that is deliberate: it wants you to know the network needs authentication.

The second, quieter test

There is a quieter one running alongside. Passive probing does not ask anything; it watches the traffic already arriving and counts how many hops it has travelled. If the count reaches a minimum, the interface is treated as having internet. Microsoft gives the number: “The default hop count is 8 but this isn’t always optimal for enterprises.” And it gives the rhythm: “If the passive probe is allowed to run, it does so every 15 seconds.”

Microsoft warns against switching the active test off as a workaround, because passive polling alone cannot detect every kind of failure.

What actually breaks it

Microsoft publishes the list, with the names it writes into the event log, and each name says where the request stopped.

Two of those are worth translating out of the log and into the room. A VPN that has just connected can leave the machine with no route to the internet until the routing table catches up — if the icon changed the moment a VPN came up, that is the first thing to undo, and turning the VPN off is a one-click test. A proxy that blocks the request answers it with a refusal rather than silence: Microsoft’s example is an HTTP 403 Forbidden.

None of that is a repair procedure, and this page deliberately does not carry one. The ordered steps — the second-device test, restarting the modem before the router, the two frequency bands, the network commands — are set out on the page about Wi-Fi that is not working. If the connection works but goes away again and again, the page on a connection that keeps dropping is the right one; if everything connects and one website does not, this site can’t be reached is a different fault entirely.

The same words on a phone

A phone shows its own version of the message and runs its own version of the check. Google’s troubleshooting does not describe the probe, but it does give the one test that separates the three possible culprits, and it is worth doing before anything else: “If your phone connects to the Wi-Fi network but you still have no internet, the problem is most likely with your internet connection.” In other words, join the same network with a second device. If it also fails, stop looking at the phone.

One cause on that page is specific to phones and has nothing to do with radios at all: “An incorrect date and time on your phone can cause Wi-Fi connection problems.” Setting the time automatically rules it out. Beyond that, the phone-side routes are resetting the network settings and rejoining the network from scratch, which needs the network password.

Not covered here. It is not a repair sequence. The ordered steps live on the Wi-Fi page, and repeating them here would only mean two half-lists instead of one whole one.

It does not cover enterprise configuration of the indicator — private probe servers, group policy, the registry values that change the probe — beyond naming them. That is administrator documentation and it is linked below.

It does not name a cause for your particular machine. The list here is Microsoft’s list of what can break the test, not a diagnosis.