Start by symptom
No address, or 169.254.x.x
ipconfig /allName does not resolve
nslookup hostResolves but will not connect
tnc host -Port 443Slow or dropping
pathping -q 50 hostWhich process owns the port
netstat -anoTraffic takes the wrong path
route print -4
Work up the stack. Link, address, route, name, port, application. Testing the application first is how an afternoon disappears into a problem that was a missing route.
Address and interface
| Task | Command |
|---|---|
| Everything about every adapter | ipconfig /all |
| Release and renew DHCP | ipconfig /release then ipconfig /renew |
| Adapter link state and speed | Get-NetAdapter |
| Errors and discards on the NIC | Get-NetAdapterStatistics |
| Bounce an adapter | Restart-NetAdapter -Name "Ethernet" |
| Addresses, PowerShell style | Get-NetIPAddress -AddressFamily IPv4 |
| Full config of one interface | netsh interface ip show config name="Ethernet" |
| Set a static address | netsh interface ip set address "Ethernet" static 10.0.0.5 255.255.255.0 10.0.0.1 |
| Set DNS servers | netsh interface ip set dns "Ethernet" static 10.0.0.10 |
| Back to DHCP | netsh interface ip set address "Ethernet" dhcp |
Reachability and path
| Task | Command |
|---|---|
| The one command that answers most questions | Test-NetConnection host -Port 443 |
| Short form with full output | tnc host -InformationLevel Detailed |
| Trace with the route included | tnc host -TraceRoute |
| Continuous ping with timestamps | ping -t host |
| Ping a fixed size, no fragmentation | ping -f -l 1472 host |
| Trace, no name lookups, 15 hops | tracert -d -h 15 host |
| Find which hop loses packets | pathping -q 50 host |
| Test several hosts at once | Test-Connection srv01,srv02 -Count 2 |
ICMP is not permission to conclude anything. Plenty of firewalls drop ping while passing TCP, so a failed
ping proves nothing on its own. Test-NetConnection -Port is the test that matches how the application actually connects.
Ports and sockets
| Task | Command |
|---|---|
| Every connection with its PID | netstat -ano |
| Include the executable, needs elevation | netstat -abno |
| One port only | netstat -ano | findstr :443 |
| What is listening, PowerShell style | Get-NetTCPConnection -State Listen |
| Listening ports with the process name | Get-NetTCPConnection -State Listen | Select LocalPort,@{n='Proc';e={(Get-Process -Id $_.OwningProcess).Name}} |
| Translate a PID | tasklist /fi "pid eq 4321" |
| Per-protocol statistics | netstat -s -p tcp |
| Interface counters, errors included | netstat -e |
PID 4 is not a bug. Port 445 and often 80 belong to the System process, so nothing shows up in Task Manager to kill. That is
http.sys or the SMB server, and the fix is a service change, not an end task.
DNS
| Task | Command |
|---|---|
| Resolve a name | nslookup host.corp.local |
| Ask a specific server | nslookup host.corp.local 10.0.0.10 |
| One record type | nslookup -type=MX example.com |
| See which server actually answered | nslookup -debug host |
| PowerShell, scriptable output | Resolve-DnsName host -Type A |
| Bypass the client cache | Resolve-DnsName host -DnsOnly -Server 10.0.0.10 |
| Reverse lookup | Resolve-DnsName 10.0.0.25 -Type PTR |
| Clear the client cache | ipconfig /flushdns |
| Read the client cache | ipconfig /displaydns |
| Re-register this host in DNS | ipconfig /registerdns |
| Check the hosts file before blaming DNS | type %SystemRoot%\System32\drivers\etc\hosts |
The answer may not come from the server you think. The hosts file, the client cache and the suffix search list all resolve before the query leaves the machine.
nslookup -debug shows which one won.
ARP and routing
| Task | Command |
|---|---|
| Local ARP cache | arp -a |
| One entry | arp -a 10.0.0.1 |
| Flush the cache | arp -d * |
| Flush it properly on modern Windows | netsh interface ip delete arpcache |
| Routing table, IPv4 only | route print -4 |
| Add a persistent route | route -p add 10.20.0.0 mask 255.255.0.0 10.0.0.1 |
| Delete a route | route delete 10.20.0.0 |
| PowerShell view, with interface index | Get-NetRoute -AddressFamily IPv4 |
| Which route will be used for a target | Find-NetRoute -RemoteIPAddress 10.20.0.5 |
Two default gateways is not redundancy. If
route print shows two 0.0.0.0 routes on different adapters, traffic follows the lower metric and the other path fails intermittently. That is the usual cause of “it works on Wi-Fi but not on the dock”.
Firewall
| Task | Command |
|---|---|
| Which profile is active and is it on | Get-NetFirewallProfile | Select Name,Enabled |
| Same, classic | netsh advfirewall show allprofiles |
| Open a port inbound | netsh advfirewall firewall add rule name="App 8443" dir=in action=allow protocol=TCP localport=8443 |
| Same in PowerShell | New-NetFirewallRule -DisplayName "App 8443" -Direction Inbound -Protocol TCP -LocalPort 8443 -Action Allow |
| Find the rule that blocks a port | Get-NetFirewallPortFilter | Where LocalPort -eq 445 |
| Rules for one program | netsh advfirewall firewall show rule name=all dir=in | findstr /i "8443" |
| Reset the whole firewall to defaults | netsh advfirewall reset |
Check the profile first. A rule in the Domain profile does nothing while the adapter is classified as Public, which happens on every machine that boots before the DC is reachable.
Get-NetConnectionProfile tells you which one is in force.
Shares and SMB
| Task | Command |
|---|---|
| Map a drive | net use Z: \\SRV01\share /persistent:yes |
| Map as another account | net use Z: \\SRV01\share /user:DOM\svc |
| Drop every mapping and cached session | net use * /delete /y |
| Shares on a remote server | net view \\SRV01 |
| Shares on this machine | net share |
| Live SMB sessions and dialect | Get-SmbConnection |
| Is SMB even reachable | tnc SRV01 -Port 445 |
| Open files held on a server | openfiles /query /fo table |
Old credentials survive a password change. A cached SMB session keeps presenting the old password and locks the account out every few minutes.
net use * /delete /y on the offending machine, then check Credential Manager, is the fix.
Capture and reset
| Task | Command |
|---|---|
| Start a capture, no extra tooling | netsh trace start capture=yes tracefile=C:\temp\net.etl maxsize=512 |
| Stop it | netsh trace stop |
| Packet capture on modern Windows | pktmon start --etw -c --pkt-size 0 |
| Stop and convert to text | pktmon stop then pktmon etl2txt PktMon.etl |
| Which rule or component dropped a packet | pktmon list and pktmon counters |
| Wi-Fi state and signal | netsh wlan show interfaces |
| Wi-Fi connection history report | netsh wlan show wlanreport |
| Reset the TCP/IP stack | netsh int ip reset |
| Reset Winsock | netsh winsock reset |
The resets need a reboot.
netsh int ip reset and netsh winsock reset rewrite registry state and take effect only after a restart. They also remove third-party LSP entries, so run them as a deliberate step, not as a first guess.
Symptom to command
| Symptom | Run this, in order |
|---|---|
| APIPA address 169.254.x.x | Get-NetAdapter, ipconfig /release, ipconfig /renew, then check the DHCP scope |
| Some names resolve, others do not | nslookup -debug name, ipconfig /all for the suffix list, ipconfig /flushdns |
| Resolves, pings, will not connect | tnc host -Port n both ways, then the firewall profile on the target |
| Connection drops under load | Get-NetAdapterStatistics for discards, then pathping -q 50 |
| Two machines fight over one address | arp -a on a third host, System log events 4198 and 4199 |
| Traffic leaves the wrong interface | route print -4, Get-NetIPInterface for metrics |
| Port already in use at service start | netstat -ano | findstr :port, then tasklist /fi "pid eq n" |
| Mapped drive gone after reboot | net use, then check the drive is mapped by the same user context, not elevated |
| Works by IP, fails by name | DNS or SPN. Start with nslookup, then Kerberos. |
FAQ
Ping fails but the application works. Which do I trust?
The application. ICMP is commonly blocked while TCP passes, so a failed ping is evidence about ICMP and nothing else. Test the port the application actually uses with
Test-NetConnection -Port.
netstat shows a port held by PID 4. How do I free it?
PID 4 is the System process, so the listener belongs to a kernel driver: usually
http.sys for 80 and 443, or the SMB server for 445. Move your service to another port, or stop the responsible service. netsh http show servicestate shows who reserved an HTTP port.
Why does a mapped drive disappear in an elevated console?
Mappings belong to a logon session, and the elevated token is a different session. Either map inside the elevated context, or set
EnableLinkedConnections to 1 in the registry and reboot.
How do I capture packets without installing anything?
netsh trace start capture=yes on any supported Windows, or pktmon on Windows 10 1809 and later. Both produce an .etl that Wireshark or Network Monitor can open after conversion, which is enough for a first look on a server where you cannot install tools.
Is there a reliable way to test throughput from the command line?
Not with the built-in tools alone. Copy a large file with
robocopy and read the reported rate, or run iperf3 on both ends. A browser speed test measures your internet link, not the path between two servers.