Windows network — diagnostic memo

⌚ About 3 min read

NetworkBeginner to advanced8 sections · 32 reference points

Field workflow to isolate Windows network failures across link, DHCP, IP, DNS, routing, firewall and application layers.

Diagnostic order

1. Link

Get-NetAdapter | Select-Object Name,Status,LinkSpeed

Start by confirming the expected interface is Up.

2. IP address

ipconfig /all

Check DHCP, mask, gateway and DNS before Internet tests.

3. Gateway

ping 192.168.1.1

If the gateway fails, stay focused on LAN before blaming WAN

4. Service

Test-NetConnection serveur.exemple.local -Port 443

An application port test is more meaningful than ping alone.

DHCP & addressing

IP details

ipconfig /all

Check DHCP Enabled, DHCP Server, lease, gateway and DNS.

Release lease

ipconfig /release

Intentionally drops the DHCP lease; avoid on remote-only sessions.

Renew lease

ipconfig /renew

Immediately tests communication with DHCP.

APIPA

169.254.0.0/16

A 169.254.x.x address usually means no IPv4 DHCP lease was obtained.

DNS

Configured DNS

Get-DnsClientServerAddress -AddressFamily IPv4

Verify expected DNS servers are configured on the active interface.

A/AAAA resolution

Resolve-DnsName exemple.fr

Shows responses and the resolver used.

Specific DNS server

Resolve-DnsName exemple.fr -Server 192.168.1.10

Compares resolvers without changing client configuration.

Flush cache

ipconfig /flushdns

Use after fixing a record or cached negative response.

Routes & neighbors

Routing table

route print

Check default route and more specific routes.

PowerShell routes

Get-NetRoute -AddressFamily IPv4 | Sort-Object RouteMetric

Shows interface, metric and next hop.

ARP cache

arp -a

Checks whether gateway or LAN peers resolve to MAC addresses.

Traceroute

tracert 8.8.8.8

Shows where traffic stops progressing; not every router answers ICMP.

Ports & sockets

Remote port

Test-NetConnection 192.168.1.20 -Port 445

Tests TCP establishment to the target service.

Local listeners

Get-NetTCPConnection -State Listen | Sort-Object LocalPort

Confirms a local service is actually listening.

Established connections

Get-NetTCPConnection -State Established | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess

Map OwningProcess to Get-Process to identify the application.

PID by port

Get-NetTCPConnection -LocalPort 443 -ErrorAction SilentlyContinue | Select-Object OwningProcess

Useful when a port is unexpectedly occupied.

SMB & shares

Test SMB

Test-NetConnection serveur -Port 445

Separates SMB issues from general DNS issues.

Mapped shares

Get-SmbMapping

Lists client-side SMB mappings.

Server sessions

Get-SmbSession

Run on a file server to view connected clients.

SMB dialect

Get-SmbConnection | Select-Object ServerName,ShareName,Dialect,Encrypted

Checks SMB dialect and effective encryption.

Wi-Fi

Wi-Fi interface

netsh wlan show interfaces

Shows SSID, BSSID, signal, channel and negotiated rate.

Wi-Fi profiles

netsh wlan show profiles

Lists known profiles without exposing secrets.

WLAN report

netsh wlan show wlanreport

Generates an HTML report for drops and association failures.

Driver info

Get-NetAdapter -Name Wi-Fi | Format-List Name,InterfaceDescription,DriverInformation,DriverVersion

Compare driver version with the vendor recommendation.

Controlled resets

DNS cache

ipconfig /flushdns

Low-impact reset.

Winsock

netsh winsock reset

Usually requires reboot and may affect network agents.

IP stack

netsh int ip reset C:Tempip-reset.log

Reserve for suspected stack corruption after capturing current config.

Firewall profiles

Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction

Do not disable the firewall globally just to test.

Key points

Start with link and addressing before DNS or Internet.
Blocked ping does not prove a TCP service is unavailable.
On AD members, directly configured public DNS is a common domain issue.
Before Winsock/IP resets, capture configuration and keep fallback access.

← All cheat sheets