Windows networking commands cheat sheet

Show the full TCP/IP configuration of every adapter, including MAC address, DHCP lease and DNS servers.

Release the DHCP lease on all adapters, or on one named adapter.

The adapter has no IPv4 address until you renew, so do not run it over a remote session. Use /release6 for DHCPv6.

Request a new DHCP lease for all adapters or one named adapter.

Only works on adapters set to obtain an address automatically. Use /renew6 for DHCPv6.

Show connected interfaces with their IP address, default gateway and DNS servers.

-Detailed adds MAC address, network profile, MTU and DHCP status. -All includes disconnected and virtual interfaces.

List IP addresses with their prefix length and origin.

Assign a static IP address, prefix length and default gateway.

Adding an address to a DHCP-enabled interface turns DHCP off for it. The gateway must be in the same subnet as the address.

Set static DNS servers on an interface.

Static DNS servers override the ones handed out by DHCP.

Remove static DNS servers so the interface uses the ones from DHCP again.

Send four ICMP echo requests and show round-trip times.

-4 or -6 forces the IP version when you ping a name; -a resolves an IP address to a host name. Many firewalls block ICMP, so no reply does not prove the host is down.

Ping continuously until you stop it.

Ctrl+Break shows statistics and keeps going; Ctrl+C stops.

Send a set number of echo requests with a custom data size.

Default is 4 requests of 32 bytes; the maximum size is 65,500 bytes.

Send pings with the Do Not Fragment flag set to find path MTU problems.

IPv4 only. Lower the size until replies come back instead of a fragmentation error.

Ping from PowerShell and return objects you can filter.

Add -Quiet to get True or False. PowerShell 7 calls the parameter -TargetName; -ComputerName still works as an alias.

Test whether a TCP port on a remote host accepts connections.

Look for TcpTestSucceeded : True. -CommonTCPPort accepts HTTP, RDP, SMB or WINRM instead of a number. TCP only.

Trace the route to a host from PowerShell.

Show name resolution results, source address, next hop and ping result in one view.

-InformationLevel Quiet returns only True or False, which suits scripts.

List each router hop to a destination without reverse DNS lookups.

-d makes it much faster. -h sets the maximum hops (default 30). Rows of * mean a hop did not answer, not necessarily a fault.

Trace the route, then measure packet loss at every hop and link.

Takes several minutes because it sends 100 queries to each hop by default (-q). Loss on a link line points at congestion on that link.

Clear the DNS client resolver cache.

Use it after fixing a DNS record so the PC stops using a stale or negative cached answer.

Show the DNS client cache, including entries preloaded from the Hosts file.

Re-register this computer's name and IP addresses in DNS without a reboot.

Handy when a domain PC's A record is missing or out of date on the DNS server.

Look up a name, optionally against a specific DNS server.

Without a server it uses the default DNS server. Typing nslookup on its own opens interactive mode; type exit to leave.

Query a specific record type such as MX, TXT, NS or AAAA.

Resolve a name from PowerShell and return the records as objects.

By default it queries A and AAAA. -DnsOnly skips LLMNR and NetBIOS; -NoHostsFile ignores the Hosts file.

Query a record type against a chosen DNS server.

Show the DNS client cache as objects.

Clear the DNS client cache from PowerShell, like ipconfig /flushdns.

Show which DNS servers each interface is using.

Display the IPv4 and IPv6 routing tables, interface list and persistent routes.

A destination with * or ? shows only matching routes. netstat -r prints the same table.

Add a persistent static route that survives restarts.

Without -p the route is lost when TCP/IP restarts. Get the interface index for if from route print.

Delete a route from the routing table.

Warning: Deleting the default route (0.0.0.0) cuts off all traffic beyond the local subnet, including your remote session. Wildcards such as 10.* delete every matching route.

Show the ARP cache of IP-to-MAC address mappings.

-N limits output to the interface with that IP address and is case-sensitive.

Remove an entry from the ARP cache so it is learned again.

arp -d * clears the whole cache. Entries are relearned automatically on the next packet.

List routes from PowerShell, with next hop and metric.

Filtering on 0.0.0.0/0 shows the default gateway for each interface.

Add a static route from PowerShell.

By default the route is saved in both the active and persistent stores, so it survives a restart.

Show the neighbor (ARP and IPv6 neighbor discovery) cache as objects.

List all connections and listening ports in numeric form with the owning process ID.

Match the PID in the last column with Task Manager or Get-Process -Id <pid>.

Show the executable behind each connection or listening port.

Needs an elevated prompt and can be slow.

List listening TCP ports with the owning process ID.

The OwningProcess property holds the PID.

List active TCP connections, optionally filtered by remote address or port.

Show state, default policy, settings and logging for the domain, private and public firewall profiles.

Show firewall profile settings from PowerShell.

Without -PolicyStore it reads the local persistent store; ActiveStore shows the settings in effect, including Group Policy.

Turn the firewall on (or off with False) for one or more profiles.

Group Policy settings win over local changes on domain-joined machines.

Create a firewall rule that allows inbound traffic to a port.

-Action also accepts Block. -LocalPort takes lists and ranges such as 80,443 or 5000-5020.

Find a firewall rule by its display name.

Delete firewall rules that match a display name.

Warning: Every rule with that display name is deleted at once. Check the match with Get-NetFirewallRule first.

Restore the default Windows Firewall policy.

Warning: Custom rules and settings are lost. Add export <file> to save the current policy first; restore it with netsh advfirewall import.

Show IP address, gateway, DNS and WINS settings for each interface.

Older scripts write netsh interface ip; Microsoft recommends PowerShell for new automation.

List the Wi-Fi profiles saved on this computer.

Show a saved Wi-Fi profile, including the network key in plain text.

The key appears under Key Content only for a local administrator. Treat the output as a secret.

Generate a report that summarizes recent Wi-Fi sessions and activity.

Reset TCP/IP to its default configuration.

Warning: Overwrites the TCP/IP and DHCP registry settings, which removes static IP addresses, gateways and DNS servers. Run elevated, then restart.

Reset the Winsock catalog to a clean state.

Warning: Removes installed Layered Service Providers, which some VPN, proxy and security software rely on. Run elevated, then restart.

List network adapters with status, link speed and MAC address.

-Physical hides virtual adapters; -IncludeHidden shows hidden ones.

Disable and re-enable an adapter in one step.

The link drops briefly, which interrupts any session using that adapter.

Disable a network adapter.

Warning: Prompts for confirmation. Disabling the adapter your remote session uses locks you out until someone re-enables it locally.

Enable a disabled network adapter.