Windows: netsh, PowerShell and the rest
ipconfig shows your configuration and juggles DHCP and DNS caches, but it cannot change an address, set a DNS server, or reset the stack. For that Windows has netsh (since Windows 2000), the NetTCPIP and NetAdapter PowerShell modules (since Windows 8 and Server 2012), and a dozen smaller tools. This page is the map.
Which tool when
| Task | Command Prompt | PowerShell |
|---|---|---|
| Show configuration | ipconfig /all | Get-NetIPConfiguration -Detailed |
| List adapters and link speed | netsh interface show interface | Get-NetAdapter |
| Set static IP | netsh interface ip set address … | New-NetIPAddress |
| Back to DHCP | netsh interface ip set address … dhcp | Set-NetIPInterface -Dhcp Enabled |
| Set DNS servers | netsh interface ip set dns … | Set-DnsClientServerAddress |
| Flush DNS | ipconfig /flushdns | Clear-DnsClientCache |
| Routing table | route print | Get-NetRoute |
| ARP table | arp -a | Get-NetNeighbor |
| Enable / disable adapter | netsh interface set interface … admin=disable | Disable-NetAdapter / Enable-NetAdapter |
| Wi-Fi details | netsh wlan show interfaces | (same; no cmdlet) |
| Listening ports | netstat -ano | Get-NetTCPConnection -State Listen |
| Test a port | (none built in) | Test-NetConnection host -Port 443 |
| Reset TCP/IP | netsh int ip reset | (same) |
netsh
netsh (network shell) is a hierarchical command tool with contexts: interface, wlan, advfirewall, winsock, http, dhcpclient and more. You can type a whole command on one line or enter a context interactively. Abbreviations are accepted: netsh int ip is netsh interface ipv4.
Viewing configuration
netsh interface show interface
netsh interface ipv4 show config
netsh interface ipv4 show interfaces
netsh interface ipv4 show addresses
netsh interface ipv4 show dnsservers
netsh interface ipv4 show route
netsh interface ipv6 show addresses
netsh interface ipv6 show route
netsh interface ipv4 show subinterfaces # MTU per interface
netsh interface ipv4 show ipstats
netsh interface ipv4 show neighbors # ARPC:\>netsh interface show interface
Admin State State Type Interface Name
-------------------------------------------------------------------------
Enabled Connected Dedicated Ethernet
Enabled Disconnected Dedicated Wi-Fi
Enabled Connected Dedicated vEthernet (WSL (Hyper-V firewall))Static IP with netsh
netsh interface ipv4 set address name="Ethernet" static 192.168.1.50 255.255.255.0 192.168.1.1
netsh interface ipv4 set dnsservers name="Ethernet" static 1.1.1.1 primary
netsh interface ipv4 add dnsservers name="Ethernet" 1.0.0.1 index=2The three positional values after static are address, mask and gateway. An optional fourth is the gateway metric. Older documentation shows source=static addr=… mask=… gateway=…, which still works. If you get The parameter is incorrect, the usual causes are a wrong interface name (check with netsh interface show interface) or a mask that does not fit the address.
Back to DHCP
netsh interface ipv4 set address name="Ethernet" source=dhcp
netsh interface ipv4 set dnsservers name="Ethernet" source=dhcpAdd a second address
netsh interface ipv4 add address name="Ethernet" 192.168.1.51 255.255.255.0
netsh interface ipv4 delete address name="Ethernet" 192.168.1.51IPv6
netsh interface ipv6 set address "Ethernet" 2001:db8::50/64
netsh interface ipv6 add route ::/0 "Ethernet" fe80::1
netsh interface ipv6 set dnsservers "Ethernet" static 2606:4700:4700::1111
netsh interface ipv6 show privacy # temporary address settings
netsh interface ipv6 set privacy state=disabled # stop using temporary addresses
netsh interface ipv6 set global randomizeidentifiers=disabled # use EUI-64 instead of random IIDsEnable, disable, rename
netsh interface set interface "Wi-Fi" admin=disable
netsh interface set interface "Wi-Fi" admin=enable
netsh interface set interface name="Ethernet" newname="LAN"MTU
netsh interface ipv4 show subinterfaces
netsh interface ipv4 set subinterface "Ethernet" mtu=1400 store=persistentResetting the stack
These are the commands behind most "fix your internet" articles. They rewrite the TCP/IP registry keys and the Winsock catalogue to defaults, which repairs damage done by badly uninstalled VPNs, antivirus network filters and malware. A reboot is required afterwards.
netsh int ip reset
netsh int ipv6 reset
netsh winsock reset
netsh advfirewall reset
ipconfig /release
ipconfig /renew
ipconfig /flushdnsnetsh int ip reset writes a log to the current directory by default; netsh int ip reset C:\resetlog.txt names it. If the output shows Resetting , failed. Access is denied. for one of the lines, a permissions issue on HKLM\SYSTEM\CurrentControlSet\Control\Nsi\{eb004a00-9b1a-11d4-9123-0050047759bc}\26 is the usual cause: grant Everyone full control on that key, rerun, then remove the permission. Windows 10 and 11 also offer Settings › Network & internet › Advanced network settings › Network reset, which does all of the above plus reinstalling every adapter, and reboots for you.
Wi-Fi with netsh wlan
netsh wlan show interfaces # SSID, BSSID, signal, channel, speed
netsh wlan show networks mode=bssid # scan
netsh wlan show profiles # saved networks
netsh wlan show profile name="HomeWiFi" key=clear # includes the password (admin)
netsh wlan export profile name="HomeWiFi" key=clear folder=C:\temp
netsh wlan add profile filename=C:\temp\Wi-Fi-HomeWiFi.xml
netsh wlan delete profile name="OldNetwork"
netsh wlan connect name="HomeWiFi"
netsh wlan disconnect
netsh wlan show drivers # driver, supported bands, hosted network support
netsh wlan show wlanreport # HTML report of recent Wi-Fi eventsC:\>netsh wlan show interfaces
There is 1 interface on the system:
Name : Wi-Fi
Description : Intel(R) Wi-Fi 6E AX211 160MHz
GUID : 3f2a1b0c-...
Physical address : 84:5c:f3:1a:2b:3c
Interface type : Primary
State : connected
SSID : HomeWiFi
BSSID : d4:6e:0e:11:22:34
Network type : Infrastructure
Radio type : 802.11ax
Authentication : WPA3-Personal
Cipher : CCMP
Connection mode : Auto Connect
Band : 5 GHz
Channel : 44
Receive rate (Mbps) : 1201
Transmit rate (Mbps) : 1201
Signal : 91%
Profile : HomeWiFiOther netsh contexts
netsh advfirewall show allprofiles
netsh advfirewall set allprofiles state off # (temporarily, for testing)
netsh advfirewall firewall add rule name="Allow 8080" dir=in action=allow protocol=TCP localport=8080
netsh interface portproxy add v4tov4 listenport=8080 connectaddress=172.29.32.5 connectport=80 # port forwarding, e.g. into WSL
netsh interface portproxy show all
netsh winhttp show proxy
netsh winhttp set proxy proxy.example.com:8080
netsh winhttp reset proxy
netsh trace start capture=yes tracefile=C:\temp\net.etl # packet capture without Wireshark
netsh trace stop
netsh dhcpclient trace enablePowerShell
The cmdlets return objects, so you filter with Where-Object, pick columns with Select-Object and format with Format-Table or Format-List. They work in Windows PowerShell 5.1 and PowerShell 7.
Viewing
Get-NetIPConfiguration # alias: gip
Get-NetIPConfiguration -Detailed
Get-NetIPConfiguration -InterfaceAlias Ethernet
Get-NetIPAddress
Get-NetIPAddress -AddressFamily IPv4 | Format-Table InterfaceAlias, IPAddress, PrefixLength, PrefixOrigin
Get-NetAdapter
Get-NetAdapter | Where-Object Status -eq Up | Select-Object Name, MacAddress, LinkSpeed
Get-NetAdapterStatistics
Get-NetRoute -AddressFamily IPv4 | Sort-Object RouteMetric
Get-NetRoute -DestinationPrefix 0.0.0.0/0 # default gateway
Get-NetNeighbor -AddressFamily IPv4 | Where-Object State -ne Unreachable
Get-DnsClientServerAddress -AddressFamily IPv4
Get-DnsClientCache
Get-DnsClient # suffixes, registration settings
Get-NetIPInterface # per-interface DHCP, metric, MTU
Get-NetTCPConnection -State Listen | Sort-Object LocalPort
Get-NetTCPConnection | Where-Object State -eq Established | Select-Object RemoteAddress, RemotePort, OwningProcessPS C:\> Get-NetIPConfiguration
InterfaceAlias : Ethernet
InterfaceIndex : 12
InterfaceDescription : Intel(R) Ethernet Connection (7) I219-V
NetProfile.Name : home
IPv6Address : 2a00:23c4:5f1a:8b00:1c3e:7a2f:9d4b:6e01
IPv4Address : 192.168.1.42
IPv6DefaultGateway : fe80::1
IPv4DefaultGateway : 192.168.1.1
DNSServer : 192.168.1.1Static IP with PowerShell
# remove the DHCP address and gateway first, then add the static one
Remove-NetIPAddress -InterfaceAlias Ethernet -AddressFamily IPv4 -Confirm:$false
Remove-NetRoute -InterfaceAlias Ethernet -DestinationPrefix 0.0.0.0/0 -Confirm:$false
New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 192.168.1.50 -PrefixLength 24 -DefaultGateway 192.168.1.1
Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 1.1.1.1, 1.0.0.1To go back to DHCP:
Remove-NetRoute -InterfaceAlias Ethernet -DestinationPrefix 0.0.0.0/0 -Confirm:$false
Set-NetIPInterface -InterfaceAlias Ethernet -Dhcp Enabled
Set-DnsClientServerAddress -InterfaceAlias Ethernet -ResetServerAddresses
Restart-NetAdapter -Name EthernetDHCP release and renew in PowerShell
There is no Renew-NetIPLease cmdlet. ipconfig /renew works from PowerShell exactly as it does from cmd. The pure-PowerShell alternative uses CIM:
$nic = Get-CimInstance Win32_NetworkAdapterConfiguration -Filter "IPEnabled=True AND DHCPEnabled=True"
$nic | Invoke-CimMethod -MethodName ReleaseDHCPLease
$nic | Invoke-CimMethod -MethodName RenewDHCPLease
# or bounce the adapter, which also re-runs DHCP
Restart-NetAdapter -Name EthernetDNS
Clear-DnsClientCache
Register-DnsClient
Resolve-DnsName example.com
Resolve-DnsName example.com -Type AAAA -Server 1.1.1.1
Resolve-DnsName -Name 192.168.1.1 -Type PTR
Set-DnsClientGlobalSetting -SuffixSearchList @('corp.example.com','example.com')
Get-DnsClientDohServerAddress # DNS-over-HTTPS (Windows 11)
Add-DnsClientDohServerAddress -ServerAddress 1.1.1.1 -DohTemplate https://cloudflare-dns.com/dns-query -AutoUpgrade $trueAdapters
Disable-NetAdapter -Name Wi-Fi -Confirm:$false
Enable-NetAdapter -Name Wi-Fi
Restart-NetAdapter -Name Ethernet
Rename-NetAdapter -Name Ethernet -NewName LAN
Set-NetAdapter -Name Ethernet -MacAddress 02-11-22-33-44-55 # if the driver allows
Get-NetAdapterAdvancedProperty -Name Ethernet # driver settings such as Jumbo Packet, EEE
Set-NetAdapterAdvancedProperty -Name Ethernet -DisplayName 'Jumbo Packet' -DisplayValue '9014 Bytes'
Set-NetIPInterface -InterfaceAlias Ethernet -NlMtuBytes 1400
Set-NetIPInterface -InterfaceAlias Wi-Fi -InterfaceMetric 50 # prefer Wi-Fi over Ethernet
Get-NetAdapterBinding -Name Ethernet # protocols bound (IPv6, LLDP…)
Disable-NetAdapterBinding -Name Ethernet -ComponentID ms_tcpip6 # turn IPv6 off on one adapterConnectivity tests
Test-NetConnection # basic internet check
Test-NetConnection example.com -Port 443
Test-NetConnection 192.168.1.1 -TraceRoute
Test-NetConnection example.com -InformationLevel Detailed
Test-Connection example.com -Count 4 # ping
Test-Connection 192.168.1.1 -Quiet # returns True/False
1..254 | ForEach-Object { Test-Connection -Count 1 -Quiet "192.168.1.$_" } # crude sweep
Get-NetConnectionProfile # Public / Private / Domain
Set-NetConnectionProfile -InterfaceAlias Ethernet -NetworkCategory PrivateRoutes
New-NetRoute -DestinationPrefix 10.0.0.0/8 -InterfaceAlias Ethernet -NextHop 192.168.1.254
Remove-NetRoute -DestinationPrefix 10.0.0.0/8 -Confirm:$false
Find-NetRoute -RemoteIPAddress 1.1.1.1 # which route and source address will be usedOne-liners people search for
# just my IPv4 address
(Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias Ethernet).IPAddress
# the address of whichever adapter has the default route
(Get-NetIPConfiguration | Where-Object { $_.IPv4DefaultGateway }).IPv4Address.IPAddress
# my MAC address
(Get-NetAdapter -Name Ethernet).MacAddress
# my public IP
(Invoke-WebRequest -UseBasicParsing https://ipconfig.co.uk/ip).Content.Trim()
Invoke-RestMethod https://ipconfig.co.uk/ip/json
# export the whole configuration for a ticket
Get-NetIPConfiguration -Detailed | Out-File $env:USERPROFILE\Desktop\netconfig.txtThe classic command-line tools
route
route print
route print -4
route print 192.168.*
route add 10.0.0.0 mask 255.0.0.0 192.168.1.254
route add 10.0.0.0 mask 255.0.0.0 192.168.1.254 metric 5 if 12
route -p add 10.0.0.0 mask 255.0.0.0 192.168.1.254 # persistent across reboots
route delete 10.0.0.0
route change 10.0.0.0 mask 255.0.0.0 192.168.1.253IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.42 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
192.168.1.0 255.255.255.0 On-link 192.168.1.42 281
192.168.1.42 255.255.255.255 On-link 192.168.1.42 281
192.168.1.255 255.255.255.255 On-link 192.168.1.42 281
224.0.0.0 240.0.0.0 On-link 192.168.1.42 281
255.255.255.255 255.255.255.255 On-link 192.168.1.42 281
===========================================================================
Persistent Routes:
NoneThe 0.0.0.0 / 0.0.0.0 line is the default route. The top of route print is the Interface List, which maps interface index numbers (the %12 zone IDs in IPv6 addresses) to adapters.
arp
arp -a
arp -a -N 192.168.1.42 # one interface
arp -d * # clear the cache (admin)
arp -s 192.168.1.5 00-11-22-33-44-55 # static entryInterface: 192.168.1.42 --- 0xc
Internet Address Physical Address Type
192.168.1.1 d4-6e-0e-11-22-33 dynamic
192.168.1.10 3c-22-fb-aa-bb-cc dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff static
224.0.0.251 01-00-5e-00-00-fb staticnetstat
netstat -ano # all connections with PID
netstat -anob # with executable name (admin)
netstat -ano | findstr :443
netstat -e # interface byte counters
netstat -s # per-protocol statistics
netstat -r # same as route print
netstat -an | findstr LISTENINGnslookup
nslookup example.com
nslookup example.com 1.1.1.1
nslookup -type=MX example.com
nslookup -type=AAAA example.com
nslookup -debug example.com
nslookup # interactive: server 8.8.8.8 / set type=any / exitping, tracert, pathping
ping example.com
ping -t 192.168.1.1 # continuous, Ctrl+C to stop
ping -n 10 -l 1472 -f 192.168.1.1 # MTU test: 1472 + 28 header = 1500, -f = don't fragment
ping -4 example.com
ping -6 example.com
ping -a 192.168.1.10 # reverse lookup
tracert example.com
tracert -d example.com # no name resolution
pathping example.com # tracert plus loss statistics per hopMiscellaneous
| Command | Purpose |
|---|---|
hostname | Computer name |
getmac /v /fo list | MAC addresses with adapter names |
nbtstat -n, nbtstat -A 192.168.1.10 | NetBIOS names, local and remote |
net view, net use, net share | SMB browsing and mapped drives |
ncpa.cpl | Open Network Connections |
systeminfo | findstr /i "network" | Adapter summary |
wmic nic get name,macaddress,speed | Deprecated but still present on most builds; use Get-NetAdapter |
telnet host 443 | Port test; feature must be enabled: dism /online /Enable-Feature /FeatureName:TelnetClient |
curl https://ipconfig.co.uk/ip | curl has shipped with Windows 10 1803 and later |
ssh, scp, sftp | OpenSSH client, built in since Windows 10 1809 |
pktmon | Built-in packet capture (Windows 10 1809+): pktmon start --capture, pktmon stop, pktmon etl2pcap |
certutil -urlcache | Occasionally used to test HTTP connectivity |
WSL and Hyper-V adapters
Windows Subsystem for Linux 2, Docker Desktop, Windows Sandbox and Hyper-V all add vEthernet adapters that appear in ipconfig. Inside WSL2, ip addr shows a private 172.x address on eth0 that is NATed through the vEthernet (WSL) adapter. Windows can reach WSL by that address; other machines cannot, unless you add a netsh interface portproxy rule or enable mirrored networking (networkingMode=mirrored in .wslconfig, WSL 2.0.5 and later), which makes WSL share the Windows adapters and addresses. You can run Windows tools from inside WSL: ipconfig.exe /all, netsh.exe wlan show interfaces, powershell.exe Get-NetAdapter.