netsh: the Windows network shell reference
netsh is a shell inside the shell: dozens of contexts, each with its own show, set, add and delete verbs. Nobody remembers it all; this page is the map, with the commands from each context that are worth remembering.
How to drive it
netsh /? :: top-level contexts
netsh interface /? :: sub-contexts of interface
netsh interface ipv4 show /? :: what 'show' can show here
netsh interface ipv4 set address /? :: full syntax of one command
:: one-liners
netsh interface ipv4 show config
:: interactive: enter a context, then type commands without the prefix
netsh
netsh>interface ipv4
netsh interface ipv4>show addresses
netsh interface ipv4>..
netsh interface>exit
:: abbreviations work if unambiguous
netsh int ip sh conf
netsh int ipv6 sh addr
:: run against another computer (needs remote registry and admin rights)
netsh -r PC2 -u DOMAIN\admin interface ipv4 show config
:: run a script file of commands
netsh -f commands.txt
netsh exec commands.txtMost show commands work as a normal user; anything that changes state needs an administrator prompt. Interface names with spaces must be quoted. The form name="Ethernet" and the bare positional "Ethernet" are both accepted by most commands.
Contexts at a glance
| Context | What it covers | PowerShell equivalent |
|---|---|---|
interface ipv4 / ipv6 | Addresses, DNS, routes, MTU, neighbours, TCP/IP statistics, reset | NetTCPIP and DnsClient modules |
interface (top) | Enable/disable/rename adapters | Get-/Enable-/Disable-/Rename-NetAdapter |
interface tcp | TCP global settings: autotuning, ECN, RSS, chimney | Get-/Set-NetTCPSetting, Get-NetOffloadGlobalSetting |
interface portproxy | TCP port forwarding on the host | none |
interface ipv6 6to4 / isatap / teredo | IPv6 transition tunnels | Get-/Set-NetTeredoConfiguration, Get-Net6to4Configuration |
wlan | Wi-Fi: interfaces, networks, profiles, passwords, connect | none (wrap netsh) |
lan | Wired 802.1X profiles | none |
advfirewall | Windows Defender Firewall rules and profiles | NetSecurity module (Get-NetFirewallRule…) |
winsock | Winsock catalogue: reset, show LSPs | none |
http | HTTP.sys URL reservations, SSL bindings, cache | none |
winhttp | System proxy for services and WinHTTP apps | none |
dhcpclient | DHCP client tracing | none |
trace | ETW network tracing and packet capture | NetEventPacketCapture module |
bridge | Network bridge settings | none |
namespace | DNS Name Resolution Policy Table (DirectAccess, split DNS) | Get-DnsClientNrptRule |
nlm | Network Location (Public/Private) manager | Get-/Set-NetConnectionProfile |
ras, routing, rpc, mbn, p2p, ipsec, branchcache, dnsclient | Remote access, RRAS, RPC ports, mobile broadband, peer-to-peer, IPsec policies, BranchCache, DNS client | various |
dhcp, dns, wins, nap | Server roles (removed or deprecated on modern Windows) | DhcpServer, DnsServer modules |
interface ipv4 and ipv6
netsh interface ipv4 show config :: the ipconfig-like view per interface
netsh interface ipv4 show interfaces :: index, metric, MTU, state
netsh interface ipv4 show addresses
netsh interface ipv4 show dnsservers
netsh interface ipv4 show route
netsh interface ipv4 show neighbors :: ARP
netsh interface ipv4 show subinterfaces :: MTU and counters
netsh interface ipv4 show ipstats
netsh interface ipv4 show tcpstats
netsh interface ipv4 show udpstats
netsh interface ipv4 show icmpstats
netsh interface ipv4 show tcpconnections
netsh interface ipv4 show dynamicportrange tcp :: ephemeral port range
netsh interface ipv4 show excludedportrange tcp :: ports reserved by Hyper-V/WSL
netsh interface ipv4 show global :: forwarding, ICMP redirects, MLD, etc.
netsh interface ipv4 show offload
netsh interface ipv4 show joins :: multicast groups
netsh interface ipv4 show destinationcache
netsh interface ipv4 set address "Ethernet" static 192.168.1.50 255.255.255.0 192.168.1.1
netsh interface ipv4 set address "Ethernet" dhcp
netsh interface ipv4 add address "Ethernet" 192.168.1.51 255.255.255.0
netsh interface ipv4 delete address "Ethernet" 192.168.1.51
netsh interface ipv4 set dnsservers "Ethernet" static 1.1.1.1 primary
netsh interface ipv4 add dnsservers "Ethernet" 1.0.0.1 index=2
netsh interface ipv4 set dnsservers "Ethernet" dhcp
netsh interface ipv4 add route 10.0.0.0/8 "Ethernet" 192.168.1.254 metric=5 store=persistent
netsh interface ipv4 delete route 10.0.0.0/8 "Ethernet" 192.168.1.254
netsh interface ipv4 set interface "Ethernet" metric=10
netsh interface ipv4 set interface "Ethernet" forwarding=enabled :: make Windows route between interfaces
netsh interface ipv4 set subinterface "Ethernet" mtu=1400 store=persistent
netsh interface ipv4 set dynamicportrange tcp start=49152 num=16384
netsh interface ipv4 add excludedportrange tcp startport=8080 numberofports=1
netsh interface ipv4 add neighbors "Ethernet" 192.168.1.5 00-11-22-33-44-55 :: static ARP
netsh interface ipv4 delete arpcache
netsh interface ipv4 delete destinationcache
netsh interface ipv4 reset :: same as netsh int ip reset
netsh interface ipv6 show addresses
netsh interface ipv6 show route
netsh interface ipv6 show neighbors
netsh interface ipv6 show interfaces
netsh interface ipv6 show privacy
netsh interface ipv6 show prefixpolicies :: address selection order (IPv4 vs IPv6 preference)
netsh interface ipv6 set address "Ethernet" 2001:db8::50/64
netsh interface ipv6 add route ::/0 "Ethernet" fe80::1
netsh interface ipv6 set dnsservers "Ethernet" static 2606:4700:4700::1111
netsh interface ipv6 set privacy state=disabled
netsh interface ipv6 set global randomizeidentifiers=disabled
netsh interface ipv6 set interface "Ethernet" routerdiscovery=disabled
netsh interface ipv6 set teredo disabled
netsh interface ipv6 6to4 set state disabled
netsh interface ipv6 isatap set state disabled
netsh interface ipv6 resetinterface (adapters) and interface tcp
netsh interface show interface
netsh interface set interface "Wi-Fi" admin=disable
netsh interface set interface "Wi-Fi" admin=enable
netsh interface set interface name="Ethernet" newname="LAN"
netsh interface tcp show global :: autotuning, ECN, RSS, timestamps, initial RTO
netsh interface tcp set global autotuninglevel=normal :: the classic 'fix slow downloads' knob; normal is the default
netsh interface tcp set global ecncapability=enabled
netsh interface tcp set global rss=enabled
netsh interface tcp show supplemental :: congestion provider (CUBIC on modern Windows)
netsh interface tcp set supplemental template=internet congestionprovider=cubic
netsh interface tcp show heuristics
netsh interface tcp set heuristics disabledinterface portproxy
Forwards a TCP port on this machine to another address and port, including into WSL2, Hyper-V VMs or another host. IPv4 to IPv6 and back are supported. Requires the IP Helper service.
netsh interface portproxy show all
netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=8080 connectaddress=172.29.32.5 connectport=80
netsh interface portproxy add v4tov4 listenport=2222 connectaddress=192.168.1.10 connectport=22
netsh interface portproxy add v4tov6 listenport=8443 connectaddress=[2001:db8::5] connectport=443
netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=8080
netsh interface portproxy reset
:: don't forget a firewall rule for the listen portwlan
netsh wlan show interfaces
netsh wlan show networks mode=bssid
netsh wlan show profiles
netsh wlan show profile name="HomeWiFi" key=clear
netsh wlan export profile name="HomeWiFi" key=clear folder=C:\temp
netsh wlan add profile filename="C:\temp\Wi-Fi-HomeWiFi.xml" user=all
netsh wlan delete profile name="OldCafe"
netsh wlan connect name="HomeWiFi"
netsh wlan disconnect
netsh wlan show drivers
netsh wlan show wirelesscapabilities
netsh wlan show settings
netsh wlan set autoconfig enabled=no interface="Wi-Fi" :: stop Windows managing Wi-Fi (rare)
netsh wlan set profileparameter name="HomeWiFi" connectionmode=manual
netsh wlan set profileorder name="HomeWiFi" interface="Wi-Fi" priority=1
netsh wlan add filter permission=block ssid="Neighbour" networktype=infrastructure
netsh wlan show filters
netsh wlan show wlanreport
netsh wlan set hostednetwork mode=allow ssid=Test key=password12 :: legacy soft AP; usually unsupported nowFull detail on the Wi-Fi page.
advfirewall
netsh advfirewall show allprofiles
netsh advfirewall show currentprofile
netsh advfirewall firewall show rule name=all
netsh advfirewall firewall show rule name="Remote Desktop - User Mode (TCP-In)"
netsh advfirewall firewall add rule name="Allow 8080" dir=in action=allow protocol=TCP localport=8080
netsh advfirewall firewall add rule name="Block host" dir=out action=block remoteip=203.0.113.5
netsh advfirewall firewall set rule name="Allow 8080" new enable=no
netsh advfirewall firewall delete rule name="Allow 8080"
netsh advfirewall set allprofiles state off
netsh advfirewall set allprofiles state on
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
netsh advfirewall set allprofiles logging droppedconnections enable
netsh advfirewall export C:\temp\firewall.wfw
netsh advfirewall import C:\temp\firewall.wfw
netsh advfirewall reset
netsh advfirewall monitor show firewall
netsh advfirewall consec show rule name=all :: IPsec connection security rulesMore on the firewall page.
winsock, http, winhttp
netsh winsock show catalog :: Layered Service Providers: leftover VPN/AV filters show up here
netsh winsock reset :: rebuild the catalogue; reboot
netsh winsock audit trail
netsh http show servicestate :: what HTTP.sys is serving (IIS, WinRM, WSUS, some apps)
netsh http show urlacl :: URL reservations (why port 80 is 'in use' by PID 4)
netsh http add urlacl url=http://+:8080/ user=Everyone
netsh http delete urlacl url=http://+:8080/
netsh http show sslcert
netsh http add sslcert ipport=0.0.0.0:443 certhash=<thumbprint> appid={<guid>}
netsh http flush logbuffer
netsh winhttp show proxy :: proxy used by services and WinHTTP apps (Windows Update, PowerShell Invoke-WebRequest under system)
netsh winhttp set proxy proxy.example.com:8080 bypass-list="*.example.com;<local>"
netsh winhttp import proxy source=ie :: copy the user's IE/Edge proxy settings
netsh winhttp reset proxytrace and dhcpclient
netsh trace show scenarios
netsh trace start scenario=NetConnection capture=yes tracefile=C:\temp\net.etl maxsize=250 report=yes
netsh trace start capture=yes tracefile=C:\temp\cap.etl provider=Microsoft-Windows-TCPIP
netsh trace stop
netsh trace show status
netsh trace convert C:\temp\net.etl :: to text; use etl2pcapng or pktmon for pcap
netsh trace diagnose scenario=NetworkSnapshot
netsh dhcpclient trace enable
netsh dhcpclient trace dump :: DHCP client log
netsh dhcpclient trace disable
netsh dhcpclient listpktmon is the friendlier capture tool on Windows 10 1809 and later. Details →
lan, bridge, namespace, nlm
netsh lan show interfaces :: wired 802.1X state
netsh lan show profiles
netsh lan export profile folder=C:\temp
netsh lan reconnect
netsh bridge show adapter
netsh bridge set adapter 1 forcecompatmode=enable
netsh namespace show policy :: NRPT rules: which DNS servers handle which suffixes (VPN split DNS)
netsh namespace show effectivepolicy
netsh nlm show connection
netsh nlm show categoryDump and restore a configuration
netsh -c interface dump > C:\temp\interface.txt :: script that recreates the interface config
netsh interface ipv4 dump > C:\temp\ipv4.txt
netsh advfirewall export C:\temp\fw.wfw
netsh wlan export profile key=clear folder=C:\temp\wifi
:: restore
netsh -f C:\temp\interface.txt
netsh exec C:\temp\ipv4.txtThe reset sequence
netsh winsock reset
netsh int ip reset
netsh int ipv6 reset
netsh advfirewall reset
netsh interface ipv4 delete arpcache
ipconfig /flushdns
shutdown /r /t 0What each does and when it helps is on the Windows tools page.