Windows Networking & IT Support Commands Cheat Sheet

This guide collects the Windows commands, consoles and networking concepts that come up every day on a service desk. Each section builds on the previous one: learn the tools (A–C), understand the network (D), then practise a repeatable troubleshooting method (E–I). The final section is a one-page quick reference you can print and keep beside your keyboard.

A. Windows Run Commands

Press Win + R, type the command and press Enter. File extensions tell you what kind of tool opens: .msc is a Microsoft Management Console snap-in (an admin console), .cpl is a Control Panel applet, and no extension means a stand-alone program.

B. Networking Commands

Programs such as ipconfig, ping and netstat are .exe files, so they run in both Command Prompt and PowerShell. Cmdlets such as Test-NetConnection follow PowerShell’s Verb-Noun naming and only run in PowerShell.

ipconfig — CMD (runs in Command Prompt and PowerShell)

Purpose: Shows the basic IP settings (IPv4/IPv6 address, subnet mask, default gateway) for every adapter.

Syntax:

ipconfig

Example output (illustrative):

Ethernet adapter Ethernet:
   Connection-specific DNS Suffix  . : home
   IPv4 Address. . . . . . . . . . . : 192.168.1.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.1.1

Troubleshooting: Your first check. Is there an address in the expected subnet and a default gateway? An address in 169.254.x.x means DHCP failed (APIPA).

ipconfig /all — CMD (runs in Command Prompt and PowerShell)

Purpose: Full TCP/IP configuration: adapter description, MAC (Physical Address), DHCP on/off, DHCP server, DNS servers and lease times.

Syntax:

ipconfig /all
ipconfig /all | findstr /i "IPv4 DNS Gateway"

Example output (illustrative):

   Description . . . . . . . . . . . : Intel(R) Ethernet Connection
   Physical Address. . . . . . . . . : 00-1A-2B-3C-4D-5E
   DHCP Enabled. . . . . . . . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.1.10(Preferred)
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DNS Servers . . . . . . . . . . . : 192.168.1.1

Troubleshooting: Confirms which DNS servers are in use, whether the address came from DHCP or is static, and gives the MAC address for DHCP reservations or network access control.

ipconfig /release — CMD (runs in Command Prompt and PowerShell)

Purpose: Sends a DHCP release and discards the IPv4 address on adapters set to obtain an address automatically.

Syntax:

ipconfig /release
ipconfig /release "Ethernet"

Example output (illustrative):

Ethernet adapter Ethernet:
   Connection-specific DNS Suffix  . :
   Default Gateway . . . . . . . . . :      (no IPv4 address is listed)

Troubleshooting: Used just before /renew to force a fresh lease. Connectivity drops immediately – never run it over Remote Desktop or another remote session or you will lose the connection. Use an elevated prompt if you see an elevation error.

ipconfig /renew — CMD (runs in Command Prompt and PowerShell)

Purpose: Requests a new DHCP lease (Discover, Offer, Request, Acknowledge) for DHCP-enabled adapters.

Syntax:

ipconfig /renew
ipconfig /renew "Ethernet"

Example output (illustrative):

An error occurred while renewing interface Ethernet : unable to contact
your DHCP server. Request has timed out.

Troubleshooting: Success shows a new address and gateway. The time-out above means no DHCP server answered: check the cable, switch port/VLAN and DHCP server.

ipconfig /flushdns — CMD (runs in Command Prompt and PowerShell)

Purpose: Clears the Windows DNS client (resolver) cache. ipconfig /displaydns shows what is cached.

Syntax:

ipconfig /flushdns

Example output (illustrative):

Successfully flushed the DNS Resolver Cache.

Troubleshooting: Use after a DNS record has changed or when a stale or incorrect cached entry is suspected. It does not fix a broken DNS server – it only discards local cached answers.

ping — CMD (runs in Command Prompt and PowerShell)

Purpose: Sends ICMP Echo Requests and reports replies, round-trip time and packet loss (4 packets by default).

Syntax:

ping [-n count] [-t] [-4|-6] <host>
ping 192.168.1.1
ping -n 10 8.8.8.8

Example output (illustrative):

Pinging 192.168.1.1 with 32 bytes of data:
Reply from 192.168.1.1: bytes=32 time=2ms TTL=64
Reply from 192.168.1.1: bytes=32 time=1ms TTL=64
Ping statistics for 192.168.1.1:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)

Troubleshooting: Request timed out = no reply (host down or ICMP blocked). Destination host unreachable = a local routing/ARP failure, often reported by your own PC or router. could not find host = name resolution failed – a DNS problem, not a connectivity result. -t pings until Ctrl+C.

tracert — CMD (runs in Command Prompt and PowerShell)

Purpose: Lists each router (hop) on the path to a destination by sending probes with increasing TTL (30 hops maximum by default).

Syntax:

tracert [-d] [-h max_hops] <host>
tracert -d 8.8.8.8

Example output (illustrative):

Tracing route to 8.8.8.8 over a maximum of 30 hops
  1     1 ms     1 ms     1 ms  192.168.1.1
  2     9 ms     8 ms     9 ms  10.20.0.1
  3     *        *        *     Request timed out.
  4    12 ms    11 ms    12 ms  8.8.8.8

Troubleshooting: A * at one hop with later hops answering is normal – that router simply doesn’t reply to probes. If every hop after a certain point times out, the path is breaking there. -d skips reverse DNS lookups so the trace runs much faster.

pathping — CMD (runs in Command Prompt and PowerShell)

Purpose: Combines tracert with per-hop loss statistics. It samples each hop (about 25 seconds per hop by default), so it takes several minutes.

Syntax:

pathping [-n] <host>
pathping -n 8.8.8.8

Example output (illustrative):

Computing statistics for 100 seconds...
            Source to Here   This Node/Link
Hop  RTT    Lost/Sent = Pct  Lost/Sent = Pct  Address
  0                                           192.168.1.10
                                0/ 100 =  0%   |
  1    1ms     0/ 100 =  0%     0/ 100 =  0%  192.168.1.1

Troubleshooting: Best for slow or intermittent connections. Loss that starts at one hop and continues to all later hops points to that link. Loss shown only at an intermediate hop usually means that router de-prioritises replies to probes, not real loss.

nslookup — CMD (runs in Command Prompt and PowerShell)

Purpose: Queries DNS servers directly. Optionally name the server to ask as the second argument.

Syntax:

nslookup <name> [server]
nslookup example.com
nslookup example.com 1.1.1.1

Example output (illustrative):

Server:  router.home
Address:  192.168.1.1

Non-authoritative answer:
Name:    example.com
Addresses:  2001:db8::10
          203.0.113.10

Troubleshooting: Non-authoritative answer is normal – the reply came from a recursive or caching server. Compare your default server with a public one: if only the default fails, your configured DNS server is the problem. DNS request timed out means the DNS server could not be reached. Note that nslookup bypasses the Windows DNS cache and the hosts file.

arp -a — CMD (runs in Command Prompt and PowerShell)

Purpose: Shows the ARP cache: the IPv4-address-to-MAC-address mappings this PC has learned on each local interface.

Syntax:

arp -a
arp -a -N 192.168.1.10

Example output (illustrative):

Interface: 192.168.1.10 --- 0xb
  Internet Address      Physical Address      Type
  192.168.1.1           a4-91-b1-22-33-44     dynamic
  192.168.1.255         ff-ff-ff-ff-ff-ff     static

Troubleshooting: A dynamic entry for the gateway proves layer-2 communication with it is working. A missing entry points to cabling, Wi-Fi, VLAN or switch problems. A gateway MAC that keeps changing can indicate a duplicate IP address or ARP spoofing. Clearing the cache (arp -d *) needs Admin.

route print — CMD (runs in Command Prompt and PowerShell)

Purpose: Displays the routing table – where the PC sends traffic for each destination network. -4 limits output to IPv4.

Syntax:

route print
route print -4

Example output (illustrative):

IPv4 Route Table
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.10     25
      192.168.1.0    255.255.255.0         On-link     192.168.1.10    281

Troubleshooting: Check that a default route (0.0.0.0 / 0.0.0.0) exists and points at the right gateway, and look for VPN routes that override it. route add / route delete need Admin and can cut connectivity – record the original table first.

netstat -ano — CMD (runs in Command Prompt and PowerShell)

Purpose: Lists all connections and listening ports (-a), in numeric form (-n), with the owning process ID (-o).

Syntax:

netstat -ano
netstat -ano | findstr :3389
netstat -ano | findstr LISTENING

Example output (illustrative):

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1012
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    192.168.1.10:52344     203.0.113.25:443       ESTABLISHED     8420

Troubleshooting: Confirms whether a service is actually listening on the expected port and on which address. Map a PID to a program with tasklist /fi "PID eq 8420". 0.0.0.0:port listens on all IPv4 interfaces; 127.0.0.1:port accepts local connections only.

hostname — CMD (runs in Command Prompt and PowerShell)

Purpose: Prints the computer’s name.

Syntax:

hostname

Example output (illustrative):

DESKTOP-4KQ7T2B

Troubleshooting: Confirm the exact name for a ticket, a DNS lookup, an RDP connection or an asset record.

getmac — CMD (runs in Command Prompt and PowerShell)

Purpose: Lists the MAC (physical) address of each adapter. /v adds the connection and adapter names.

Syntax:

getmac
getmac /v

Example output (illustrative):

Connection Name Network Adapter Physical Address    Transport Name
=============== =============== =================== ==============
Ethernet        Intel(R) Ethern 00-1A-2B-3C-4D-5E   \Device\Tcpip_{...}
Wi-Fi           Intel(R) Wi-Fi  A0-B1-C2-D3-E4-F5   Media disconnected

Troubleshooting: Provides MACs for DHCP reservations, MAC filtering and asset records. Media disconnected means no link on that adapter. Windows can use random hardware addresses on Wi-Fi for privacy, so a Wi-Fi MAC may differ from the one printed on the device.

netsh — CMD (runs in Command Prompt and PowerShell)

Purpose: Network Shell – views and configures many network components from the command line.

Syntax:

netsh interface ipv4 show config
netsh wlan show interfaces
netsh advfirewall show allprofiles
netsh winsock reset        (Admin, restart needed)
netsh int ip reset          (Admin, restart needed)

Example output (illustrative):

Configuration for interface "Ethernet"
    DHCP enabled:                         Yes
    IP Address:                           192.168.1.10
    Subnet Prefix:                        192.168.1.0/24 (mask 255.255.255.0)
    Default Gateway:                      192.168.1.1

Troubleshooting: wlan show interfaces reports SSID, signal strength and link rates for Wi-Fi problems. The reset commands rebuild the network stack and remove custom settings – use them as a later step, not a first resort. Microsoft recommends PowerShell for many networking tasks, but netsh remains widely used.

Test-NetConnection — PS (PowerShell cmdlet)

Purpose: Tests ICMP reachability or, more usefully, a specific TCP port. Alias: tnc.

Syntax:

Test-NetConnection 192.168.1.1
Test-NetConnection example.com -Port 443
Test-NetConnection server01 -CommonTCPPort RDP
Test-NetConnection example.com -TraceRoute

Example output (illustrative):

ComputerName     : example.com
RemoteAddress    : 203.0.113.10
RemotePort       : 443
InterfaceAlias   : Ethernet
SourceAddress    : 192.168.1.10
TcpTestSucceeded : True

Troubleshooting: Works where ping is blocked and separates “host reachable but port closed or filtered” (TcpTestSucceeded : False) from a name-resolution or routing failure. -CommonTCPPort accepts SMB, HTTP, RDP and WINRM.

Resolve-DnsName — PS (PowerShell cmdlet)

Purpose: PowerShell DNS lookup that returns objects. Can choose the record type and the server to query.

Syntax:

Resolve-DnsName example.com
Resolve-DnsName example.com -Type AAAA
Resolve-DnsName example.com -Server 1.1.1.1 -DnsOnly

Example output (illustrative):

Name          Type   TTL   Section    IPAddress
----          ----   ---   -------    ---------
example.com   AAAA   300   Answer     2001:db8::10
example.com   A      300   Answer     203.0.113.10

Troubleshooting: -DnsOnly queries DNS only (skipping LLMNR/NetBIOS), giving a clean test of the DNS server. Output can be filtered or exported in scripts.

Get-NetIPConfiguration — PS (PowerShell cmdlet)

Purpose: Compact summary of each adapter’s IP address, gateway and DNS servers. Alias: gip.

Syntax:

Get-NetIPConfiguration
Get-NetIPConfiguration -Detailed
Get-NetIPConfiguration -InterfaceAlias "Ethernet"

Example output (illustrative):

InterfaceAlias       : Ethernet
InterfaceIndex       : 11
InterfaceDescription : Intel(R) Ethernet Connection
NetProfile.Name      : HomeNetwork
IPv4Address          : 192.168.1.10
IPv4DefaultGateway   : 192.168.1.1
DNSServer            : 192.168.1.1

Troubleshooting: A quicker read than ipconfig /all and includes the network profile name. Related cmdlets: Get-NetAdapter (status, link speed) and Get-DnsClientServerAddress.

C. System Administration Commands

These commands diagnose and repair the operating system. They are tools for specific symptoms – not routine maintenance to run “just in case”. Record what you ran, and why, in the ticket.

D. Networking Fundamentals

TCP versus UDP

Common TCP/UDP ports

Special and private IPv4 addresses

E. Troubleshooting Workflow

Work from the bottom up: physical link → IP configuration → gateway → internet by IP → DNS → application. Each test either clears a layer or tells you where to dig. Always separate IP connectivity (can I reach 8.8.8.8?) from name resolution (can I resolve example.com?) – they fail for different reasons.

Reading an IP configuration

Example output (illustrative) – ipconfig /all, trimmed

Ethernet adapter Ethernet:
   Description . . . . . . . . . . . : Intel(R) Ethernet Connection
   Physical Address. . . . . . . . . : 00-1A-2B-3C-4D-5E
   DHCP Enabled. . . . . . . . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.1.10(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Wednesday, 21 October 2026 8:02:11 AM
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DNS Servers . . . . . . . . . . . : 192.168.1.1

• Healthy: 192.168.1.10 with mask 255.255.255.0 places the PC in network 192.168.1.0/24; the gateway 192.168.1.1 is inside that subnet; DHCP is on and the router (192.168.1.1) issued the lease and also acts as the DNS forwarder.
• Red flag – Autoconfiguration IPv4 Address ... 169.254.x.x: DHCP failed → Scenario 2.
• Red flag – blank Default Gateway: local traffic only; no route off the subnet.
• Red flag – gateway outside the subnet (e.g. IP 192.168.1.10/24, gateway 192.168.2.1): typing error in a static configuration.
• Red flag – (Duplicate) after the IPv4 address: another device is using the same address.
• Red flag – Media disconnected: no physical link – check cable, port or Wi-Fi first.

Scenario decision trees

Scenario 1 – No internet access

Symptoms: Network icon shows no internet; every website fails; email and Teams disconnected.

Commands:

ipconfig /all
ping 192.168.1.1
ping 8.8.8.8
nslookup example.com

Interpret:

• No valid IP → Scenario 2.
• Gateway ping fails → Scenario 4.
• Gateway OK but 8.8.8.8 fails → problem beyond your LAN (router WAN, ISP); run tracert -d 8.8.8.8.
• 8.8.8.8 OK but nslookup fails → Scenario 3 (DNS).
• Everything passes → browser, proxy or application issue.

Likely causes: Unplugged cable or Wi-Fi disconnected, DHCP failure, router or modem fault, ISP outage, DNS failure, wrong proxy settings.

Next step: Ask whether other users or devices are affected – one PC versus everyone halves the problem. Restart the modem/router only if everyone is affected; escalate to the ISP with your tracert results.

Scenario 2 – Ethernet connected but no valid IP address

Symptoms: “Unidentified network”; ipconfig shows 169.254.x.x or no IPv4 address.

Commands:

ipconfig /all
ipconfig /release
ipconfig /renew
Get-NetIPConfiguration

Interpret:

• 169.254.x.x → the PC asked for DHCP and nobody answered.
• Renew error “unable to contact your DHCP server” → DHCP is unreachable or down.
• DHCP Enabled : No → static settings – check every value.

Likely causes: DHCP server down or scope full, wrong switch-port VLAN, faulty cable or port, port security / 802.1X blocking the device, DHCP Client service stopped.

Next step: Try a known-good cable and port; confirm the DHCP Client service is running (services.msc); check whether other devices on the same switch get addresses; check the DHCP scope and leases.

Scenario 3 – Cannot access a website by name

Symptoms: ping 8.8.8.8 works, but sites fail with “server’s DNS address could not be found”.

Commands:

nslookup example.com
nslookup example.com 1.1.1.1
Resolve-DnsName example.com -DnsOnly
ipconfig /flushdns
Test-NetConnection example.com -Port 443

Interpret:

• Default server fails but 1.1.1.1 answers → your configured DNS server is the problem.
• Both fail for one domain only → typo, or a problem with that domain’s DNS.
• Non-existent domain → the name doesn’t exist (or is internal-only).
• Name resolves but TCP 443 fails → not DNS: firewall, proxy or site outage.

Likely causes: DNS server down or unreachable, wrong DNS servers configured, stale cache, an entry in C:\Windows\System32\drivers\etc\hosts, VPN DNS settings, site outage.

Next step: Correct the DNS servers (via DHCP or adapter settings), flush the cache and check the hosts file. On a corporate network escalate to the DNS team – don’t simply switch to public DNS, because internal names will stop resolving.

Scenario 4 – Cannot ping the default gateway

Symptoms: Request timed out or Destination host unreachable when pinging the gateway; no local or internet access.

Commands:

ipconfig
ping 127.0.0.1
ping 192.168.1.1
arp -a
Test-NetConnection 192.168.1.1 -Port 80

Interpret:

• 127.0.0.1 fails → TCP/IP stack problem on this PC.
• Gateway not in the PC’s subnet → configuration error.
• No ARP entry for the gateway → layer-2 problem (cable, Wi-Fi, VLAN, switch).
• ARP entry present but ping fails → the gateway may block ICMP; the TCP test to its web interface (if it has one) or another device will tell you.

Likely causes: Physical or Wi-Fi fault, wrong static IP, mask or gateway, VLAN mismatch, router down, ICMP filtered.

Next step: Check link lights and Wi-Fi association; compare settings with a working device; check the switch port; restart the router only if several devices are affected.

Scenario 5 – Slow network connection

Symptoms: Slow page loads or file copies, choppy video calls, intermittent drop-outs.

Commands:

ping -n 50 192.168.1.1
ping -n 50 8.8.8.8
pathping -n 8.8.8.8
netsh wlan show interfaces
Get-NetAdapter | Format-Table Name, Status, LinkSpeed
resmon   (Network tab)

Interpret:

• High latency or loss to the gateway → local problem (Wi-Fi signal, interference, cable).
• Gateway fine but external poor → WAN or ISP congestion.
• pathping loss starting at one hop and continuing → that link.
• Link speed 100 Mbps on gigabit hardware → bad cable or port negotiation.
• One process using most bandwidth → updates, backup or cloud sync.

Likely causes: Weak Wi-Fi or interference, damaged cable, bandwidth-heavy processes, outdated NIC driver, ISP congestion, malware.

Next step: Compare wired with wireless, move closer to the access point, swap the cable, update the NIC driver, reschedule heavy transfers; give the ISP pathping evidence.

Scenario 6 – Cannot access a shared network folder

Symptoms: \\fileserver\share gives “Windows cannot access”, error 0x80070035 (network path not found), “Access denied” or a repeating credential prompt.

Commands:

ping fileserver
nslookup fileserver
Test-NetConnection fileserver -CommonTCPPort SMB
net use
whoami /groups

Interpret:

• Name fails but \\192.168.1.20\share works → DNS or name-resolution problem.
• TCP 445 fails → server down or SMB blocked by a firewall.
• Access denied → share and NTFS permissions both apply (the most restrictive wins), or wrong cached credentials.

Likely causes: Server offline, DNS, firewall blocking 445, missing permissions, stale credentials in Credential Manager, a network set to the Public profile, an old NAS that relies on guest access or SMB1.

Next step: Test by IP, clear stored credentials, confirm permissions with the server owner, check the server’s network profile and File and Printer Sharing rule. Recent Windows versions block insecure guest access – don’t re-enable SMB1 or guest logons as a fix.

Scenario 7 – Suspected port or firewall issue

Symptoms: The host answers ping but an application can’t connect; it works from one network but not another; connection refused or timed out on one port.

Commands:

Test-NetConnection server01 -Port 8080
netstat -ano | findstr :8080      (on the server)
tasklist /fi "PID eq <pid>"
netsh advfirewall show allprofiles
wf.msc

Interpret:

• TcpTestSucceeded : False while the server shows LISTENING → something in between is blocking (host or network firewall).
• Not listening → service stopped or using a different port.
• Listening only on 127.0.0.1:8080 → accepts local connections only.
• A fast “refused” = host reachable, nothing listening; a slow time-out usually = packets silently dropped by a firewall.

Likely causes: Missing inbound rule, network classified as Public, service not running, application bound to localhost, upstream firewall.

Next step: Add a narrowly scoped allow rule (one port or program, the right profile, specific remote addresses) through change control. Never disable the firewall as a fix. Check %systemroot%\system32\LogFiles\Firewall\pfirewall.log if logging is enabled.

Scenario 8 – Cannot connect to a remote Windows computer

Symptoms: Remote Desktop Connection reports it can’t connect, or rejects the credentials.

Commands:

ping PC-NAME
nslookup PC-NAME
Test-NetConnection PC-NAME -CommonTCPPort RDP
sysdm.cpl   (Remote tab, on the target)
services.msc   (Remote Desktop Services)

Interpret:

• Name doesn’t resolve → DNS.
• Port 3389 test fails → Remote Desktop disabled, firewall rule off, host down or VPN not connected.
• Port test succeeds but sign-in fails → credentials, or the user isn’t in Remote Desktop Users / Administrators.
• Target runs a Home edition → it cannot accept RDP connections.

Likely causes: Remote Desktop not enabled, Home edition, firewall, user not authorised, wrong name or IP, VPN disconnected, account locked.

Next step: Enable Remote Desktop (Settings → System → Remote Desktop) on Pro/Enterprise, add the user to Remote Desktop Users, confirm the Remote Desktop firewall rule. Don’t expose 3389 directly to the internet – use a VPN or Remote Desktop Gateway.

F. IT Support Tools

Worked example: diagnosing a faulty network adapter

Situation: a desktop’s Ethernet shows “Network cable unplugged” even though the cable is connected; Wi-Fi on the same PC works.

1. Check the adapter state – ncpa.cpl. If the adapter is Disabled, enable it. Note whether it shows Network cable unplugged.
2. Rule out layer 1 – try a known-good cable and a different switch port; check the link lights on both the PC and the switch.
3. Check Device Manager – devmgmt.msc → Network adapters. A warning icon plus a status code such as Code 10 (device cannot start) or Code 43 (device reported problems) points to a driver or hardware fault; Code 22 means the device is disabled.
4. Check the driver – Driver tab: if the problem started after an update, use Roll Back Driver; otherwise install the manufacturer’s current driver.
5. Look for evidence – eventvwr.msc → Windows Logs → System, filtered to the time of the fault, for adapter or driver errors and repeated link down/up events.
6. Confirm the link – PowerShell: Get-NetAdapter | Format-Table Name, InterfaceDescription, Status, LinkSpeed. Status Up at the expected speed means the fault is solved; Disconnected with a known-good cable and port suggests hardware failure.
7. Resolve and document – fit a USB adapter as a workaround or replace the NIC; record the symptoms, tests and fix in the ticket.

G. Practical Lab Exercises

Lab 1 – View your IP configuration

Objective: View your IP configuration.

Commands:

ipconfig
ipconfig /all

Expected observation: Your IPv4 address, subnet mask, default gateway, DNS servers and MAC address.

Explanation: This is the baseline you compare against whenever something breaks.

Follow-up question: Is your IPv4 address private or public, and which private range does it belong to?

Show answerHide answer

On a home or office network it is almost always private. Check which RFC 1918 range it falls in:

• 10.0.0.0/8 – 10.0.0.0 to 10.255.255.255
• 172.16.0.0/12 – 172.16.0.0 to 172.31.255.255
• 192.168.0.0/16 – 192.168.0.0 to 192.168.255.255

For example, 192.168.1.10 is private (192.168.0.0/16). Your public address belongs to the router’s internet-facing (WAN) side – see it on the router’s status page or a “what is my IP” site. If you see 169.254.x.x instead, that isn’t a private range at all: it’s APIPA, meaning DHCP failed.

Lab 2 – Test loopback and gateway connectivity

Objective: Test loopback and gateway connectivity.

Commands:

ping 127.0.0.1
ping <your default gateway>

Expected observation: Replies from both; loopback replies in under 1 ms.

Explanation: Loopback proves the local TCP/IP stack works; the gateway reply proves the local network path works.

Follow-up question: If loopback succeeds but the gateway fails, which layers are now suspect?

Show answerHide answer

Loopback succeeding proves the TCP/IP software on the PC works, so the problem is between the PC and the router:

• Layer 1 – Physical: cable, network port, Wi-Fi connection, adapter disabled or faulty.
• Layer 2 – Data link: switch port, wrong VLAN, no ARP entry for the gateway (arp -a).
• Layer 3 – Network configuration: wrong IP address, subnet mask or gateway (e.g. a gateway outside your subnet).

One more possibility: the gateway is up but blocks ICMP. If arp -a shows the gateway’s MAC address, layer 2 is working – try Test-NetConnection <gateway> -Port 80 or another device.

Lab 3 – Test external connectivity without relying on ping

Objective: Test external connectivity without relying on ping.

Commands:

ping -n 4 8.8.8.8
Test-NetConnection 1.1.1.1 -Port 443

Expected observation: Ping replies (if ICMP is allowed) and TcpTestSucceeded : True.

Explanation: A TCP test checks a real service, so it still works where ICMP is filtered.

Follow-up question: Why could a host fail ping yet pass a TCP port test?

Show answerHide answer

Because ping and the port test use different protocols. Ping uses ICMP Echo, while Test-NetConnection -Port opens a real TCP connection to a service.

Firewalls – on the host or the network – very often block or ignore ICMP but still allow the service’s port (for example 443 for a web server). So the host is up and working; it just doesn’t answer ping. That’s why a TCP test to the actual service port is the better evidence.

Lab 4 – Resolve DNS names

Objective: Resolve DNS names.

Commands:

nslookup example.com
nslookup example.com 1.1.1.1
Resolve-DnsName example.com -Type AAAA

Expected observation: IPv4 and IPv6 addresses for the name, plus the server that answered.

Explanation: Querying two servers shows whether a problem is with your DNS server or the domain itself.

Follow-up question: Why might two DNS servers return different answers for the same name?

Show answerHide answer

Several normal reasons:

• Caching: if a record changed recently, one server may still hold the old answer until its TTL expires.
• Load balancing / CDNs: big sites return different addresses depending on where the request comes from, to send you to a nearby server.
• Split-horizon (internal) DNS: a company DNS server can return private addresses for internal names that public DNS doesn’t know or answers differently.
• Filtering DNS: security or parental-control resolvers may block a name or redirect it to a warning page.
• Misconfiguration on one of the servers.

Different answers aren’t automatically a problem – but if one is clearly stale or wrong, that’s your lead.

Lab 5 – Trace a route

Objective: Trace a route.

Commands:

tracert -d 8.8.8.8
pathping -n 8.8.8.8   (optional – takes several minutes)

Expected observation: A numbered list of hops; hop 1 is your router. Some hops may show *.

Explanation: Each hop is a router decrementing TTL. * usually means a router that doesn’t answer probes.

Follow-up question: Which hop is your router, and where does traffic appear to enter your ISP’s network?

Show answerHide answer

Hop 1 is usually your router – the same address as your default gateway (e.g. 192.168.1.1).

Traffic generally enters your ISP’s network at the first hop with a public IP address, often hop 2. Some ISPs use carrier-grade NAT, so that hop may show a 100.64.x.x address instead. If you have a separate modem and router (double NAT), hop 2 may also be private.

Tip: run tracert without -d once – the reverse-DNS names of the hops often include the ISP’s domain name, which makes the hand-over easy to spot.

Lab 6 – Inspect the ARP cache

Objective: Inspect the ARP cache.

Commands:

arp -a
ping <your default gateway>
arp -a

Expected observation: A dynamic entry for your gateway’s IP and MAC address.

Explanation: ARP maps IPv4 addresses to MAC addresses for devices on the local subnet only.

Follow-up question: Why is there never an ARP entry for 8.8.8.8, even after you ping it?

Show answerHide answer

Because ARP only works on the local subnet. Your PC only needs MAC addresses for devices it can talk to directly.

8.8.8.8 is on another network, so your PC sends those packets to the default gateway’s MAC address – that’s the ARP entry you’ll see. The router then forwards the packet and builds new layer-2 frames for each hop. MAC addresses never travel beyond the local network; IP addresses do.

Lab 7 – View the routing table

Objective: View the routing table.

Commands:

route print -4

Expected observation: A 0.0.0.0 default route via your gateway, an on-link route for your subnet and 127.0.0.0 loopback routes.

Explanation: The default route catches every destination not matched by a more specific route.

Follow-up question: What new routes appear when you connect to a VPN?

Show answerHide answer

It depends on the VPN, but you’ll usually see:

• A new virtual network adapter with its own IP address (the VPN interface).
• Routes to the company’s networks through the VPN interface – this is split tunnelling: only work traffic uses the VPN.
• Or, for a full tunnel, a new default route through the VPN with a better (lower) metric – sometimes as two half routes, 0.0.0.0/1 and 128.0.0.0/1, which beat the normal 0.0.0.0/0.
• A host route to the VPN server itself via your normal gateway, so the tunnel’s own traffic still reaches the internet.

Compare route print -4 before and after connecting to see exactly what your VPN adds.

Lab 8 – Check listening ports

Objective: Check listening ports.

Commands:

netstat -ano | findstr LISTENING
tasklist /fi "PID eq 4"

Expected observation: Ports such as 135 and 445 listening; PID 4 is the System process.

Explanation: Listening ports show which services can accept connections and which process owns each.

Follow-up question: Which ports listen on 0.0.0.0 versus 127.0.0.1, and why does that matter for security?

Show answerHide answer

• 0.0.0.0:port means the service listens on all IPv4 interfaces – other computers on the network can try to connect (subject to the firewall). Ports such as 135 and 445 usually appear like this.
• 127.0.0.1:port means local connections only – nothing on the network can reach it, even with the firewall off.
• [::]:port is the IPv6 equivalent of 0.0.0.0.

Why it matters: every port on 0.0.0.0 is attack surface. A service that only needs to be used on the same machine should listen on 127.0.0.1, and anything listening on all interfaces should be protected by a scoped firewall rule. An unexpected listener is worth investigating – find the program with tasklist /fi "PID eq <pid>".

Lab 9 – Test TCP connectivity to specific ports

Objective: Test TCP connectivity to specific ports.

Commands:

Test-NetConnection example.com -Port 443
Test-NetConnection example.com -Port 23

Expected observation: Port 443 should report True; port 23 will most likely report False with a warning.

Explanation: A failed TCP test means nothing answered on that port – the host itself may still be up.

Follow-up question: How would you tell “service not running” from “blocked by a firewall”?

Show answerHide answer

Check both ends:

1. On the server: netstat -ano | findstr :<port>. No LISTENING line → the service isn’t running, or it’s using a different port.
2. On the server, test locally: if connecting from the server itself works but connecting from another PC fails → something in between is blocking it: a firewall.
3. Watch how it fails from the client:
   • A fast “connection refused” usually means the host is reachable but nothing is listening.
   • A slow time-out usually means a firewall is silently dropping the packets.

Then confirm with the firewall rules (wf.msc) and the firewall log if logging is enabled.

Lab 10 – Refresh the DNS cache

Objective: Refresh the DNS cache.

Commands:

ipconfig /displaydns
ipconfig /flushdns
ping example.com
ipconfig /displaydns

Expected observation: The cache empties, then holds an entry for example.com again after the ping.

Explanation: ping and browsers use the Windows DNS cache; nslookup does not. (PowerShell equivalent: Get-DnsClientCache.)

Follow-up question: In a real ticket, when would flushing the DNS cache help – and when wouldn’t it?

Show answerHide answer

It helps when:

• A DNS record has changed (a server moved to a new IP) and the PC still remembers the old answer.
• You’ve just fixed the PC’s DNS server settings and want to drop answers it cached from the wrong server.
• A name failed earlier and Windows cached that “doesn’t exist” answer, but it exists now.

It won’t help when:

• The DNS server is down or unreachable, or the PC is set to the wrong DNS servers.
• The problem is an entry in the hosts file – it’s read straight back in.
• The browser keeps its own DNS cache or uses DNS over HTTPS.
• The upstream DNS server still holds the old record until its TTL expires.
• The problem isn’t DNS at all – e.g. no connectivity, or a firewall blocking the site.

Lab 11 – Inspect network adapters

Objective: Inspect network adapters.

Commands:

Get-NetAdapter
Get-NetIPConfiguration -Detailed
getmac /v
ncpa.cpl

Expected observation: Each adapter’s name, status, link speed, MAC address and IP settings.

Explanation: The same information appears in several tools – learn to cross-check them.

Follow-up question: Does the MAC from getmac /v match the Physical Address in ipconfig /all?

Show answerHide answer

Yes – for the same adapter they should match: both show the MAC address the adapter is currently using, in the same 00-1A-2B-… format.

Differences you might notice:

• getmac /v shows “Media disconnected” for adapters with no link.
• Virtual adapters (VPN, Hyper-V, VirtualBox) have their own MAC addresses, so you may see more entries than physical cards.
• With random hardware addresses turned on for Wi-Fi, both tools show the randomised address, which won’t match the MAC printed on the device’s label.

Lab 12 – Identify your Windows build and privilege level

Objective: Identify your Windows build and privilege level.

Commands:

winver
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
whoami /groups | findstr Label

Expected observation: Your edition and build; Medium Mandatory Level in a normal prompt.

Explanation: Support work often depends on the exact build and on whether a prompt is elevated.

Follow-up question: Run the last command again in an elevated prompt. What changes, and why?

Show answerHide answer

In an elevated prompt you’ll see Mandatory Label\High Mandatory Level instead of Medium Mandatory Level.

That’s User Account Control (UAC). Even when you sign in as an administrator, Windows normally runs your programs with a filtered, standard-user token (Medium integrity). “Run as administrator” starts the program with your full admin token (High integrity). Without the findstr filter you’d also see the Administrators group change from Group used for deny only to Enabled group.

This is why some commands fail with “access denied” in a normal prompt but work in an elevated one.

H. Memorisation Techniques

Windows Run commands

• Extension rule: .msc = admin console (MMC snap-in), .cpl = Control Panel applet, no extension = program.
• “Nobody Deletes System Events” – the four consoles for most network tickets, in order: ncpa.cpl (Network), devmgmt.msc (Devices), services.msc (Services), eventvwr.msc (Events).
• Decode the abbreviations (memory aids, not always official expansions): devmgmt = DEVice MaNaGeMenT · compmgmt = COMPuter MaNaGeMenT · lusrmgr = Local USeR ManaGeR · eventvwr = EVENT VieWeR · gpedit = Group Policy EDITor · resmon / perfmon = RESource / PERFormance MONitor · wf = Windows Firewall · appwiz = APPlication WIZard · mstsc = MicroSoft Terminal Services Client.
• Practise daily: open each tool from Win + R without looking for a week, then quiz yourself with the quick-reference page.

Network troubleshooting order

“Plug In, Get Internet Now” = Physical link → IP configuration → Gateway → Internet by IP → Names (DNS). It is the same bottom-up path as the flowchart in Section I.

Common ports – memory hooks

OSI model and where each command fits

Bottom-up: Please Do Not Throw Sausage Pizza Away (Physical → Application). Top-down: All People Seem To Need Data Processing.

*ARP sits between layers 2 and 3: it maps IP addresses (layer 3) to MAC addresses (layer 2).

I. Internet Connectivity Flowchart

Follow the chart from the top. Each “Yes” moves one layer up; each “No” tells you where the fault is. Replace 192.168.1.1 with your own default gateway.

START: user reports “no internet”

1. Physical link OK? – Cable seated, link light on, Wi-Fi connected, adapter enabled (ncpa.cpl)
   • Yes → continue to the next step
   • No → Reseat or swap the cable, try another port, reconnect Wi-Fi; check devmgmt.msc for adapter errors.
2. Valid IP configuration? – ipconfig /all shows an IP in the right subnet, plus mask, gateway and DNS
   • Yes → continue to the next step
   • No → 169.254.x.x or blank: DHCP problem. ipconfig /release then /renew; check DHCP server, cable and VLAN; verify static settings.
3. Gateway reachable? – ping 192.168.1.1 gets replies
   • Yes → continue to the next step
   • No → Local network fault: wrong subnet or gateway, Wi-Fi, switch or router. Check arp -a; ICMP may be blocked – try Test-NetConnection.
4. Internet reachable by IP? – ping 8.8.8.8 or Test-NetConnection 1.1.1.1 -Port 443 succeeds
   • Yes → continue to the next step
   • No → Router WAN, ISP or upstream issue. Run tracert -d 8.8.8.8 to see where it stops; check modem status and proxy/firewall policy.
5. DNS resolves names? – nslookup example.com returns an address
   • Yes → continue to the next step
   • No → DNS issue: check DNS servers in ipconfig /all, run ipconfig /flushdns, compare with nslookup example.com 1.1.1.1, check the hosts file.

All yes → Network path is healthy → check the application: browser, proxy settings, site outage, or Test-NetConnection <site> -Port 443.

References

1. Microsoft Learn – Windows commands reference – https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/windows-commands
2. Microsoft Learn – ipconfig – https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig
3. Microsoft Learn – shutdown – https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
4. Microsoft Learn – net user – https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/net-user
5. Microsoft Learn – Test-NetConnection – https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection
6. Microsoft Learn – NetTCPIP module (Get-NetIPConfiguration) – https://learn.microsoft.com/en-us/powershell/module/nettcpip
7. Microsoft Learn – Resolve-DnsName – https://learn.microsoft.com/en-us/powershell/module/dnsclient/resolve-dnsname
8. Microsoft Support – Use the System File Checker tool (DISM then SFC) – https://support.microsoft.com/help/929833
9. IANA – Service Name and Transport Protocol Port Number Registry – https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml
10. RFC 1918 – Address Allocation for Private Internets – https://www.rfc-editor.org/rfc/rfc1918
11. RFC 3927 – Dynamic Configuration of IPv4 Link-Local Addresses (APIPA) – https://www.rfc-editor.org/rfc/rfc3927
12. RFC 6890 – Special-Purpose IP Address Registries – https://www.rfc-editor.org/rfc/rfc6890
13. RFC 5737 / RFC 3849 – Documentation address ranges – https://www.rfc-editor.org/rfc/rfc5737

Command behaviour can change between Windows builds. When something differs from this guide, the Microsoft Learn page for that command is the authority.

J. Quick Reference

15 Run commands (Win + R)

15 networking commands

Common ports and protocols

Five-step network troubleshooting

1. Physical – cable, link light, Wi-Fi, adapter enabled
2. IP config – ipconfig /all; 169.254.x.x = DHCP failure
3. Gateway – ping default gateway; check arp -a
4. Internet by IP – ping 8.8.8.8 / Test-NetConnection -Port 443
5. DNS – nslookup example.com; compare with another server

⚠ Important warnings

• A failed ping ≠ host down – ICMP may be blocked.
• ipconfig /release cuts the connection – never over RDP.
• taskkill /F and shutdown lose unsaved work.
• Run DISM before sfc /scannow; back up before chkdsk /r.
• Never disable the firewall as a fix – add a scoped rule.
• Example outputs in this guide are illustrative.

---

Study guide · Example outputs are illustrative · Verify against Microsoft Learn