Windows: Networking Commands
List Mac Address of Network Adapters (NIC)
Type ipconfig /all. Each block of text is a network adapter.
Find IP Address of Network Adapter
Type ipconfig. The line IPv6 and IPv4 are your IP addresses (for that network adapter).
Find MAC Address of Network Adapter
Type ipconfig /all. The line “Physical Address” shows the MAC address of that network adapter on your machine.
Find IP Address of Router
Type ipconfig, then the “Default Gateway” line contains your router's IP address.
Or, type route print. The column “Gateway” shows the IP address of router.
Or, find your router's address. (see elsewhere on this page.)
Then, open a browser, and goto that address, usually it's
http://192.168.0.1/
Then type password to login to your router.
You can see your router's address there.
Alternatively, go to [ https://www.google.com/ ], then type “What's my IP address”. Google will tell you.
Find MAC Address of Router
- Type
ipconfig, then the “Default Gateway” line contains your router's IP address. - Type
arp -ato show a table of IP address and its corresponding MAC address.
Interface: 192.168.1.3 --- 0xd Internet Address Physical Address Type 192.168.1.1 00-0f-b5-ac-a0-58 dynamic 192.168.1.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.251 01-00-5e-00-00-fb static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static 255.255.255.255 ff-ff-ff-ff-ff-ff static
ipconfig
ipconfig is most useful internet config tool.
Type ipconfig /? to show help.
options:
ipconfig /all= show configipconfig /displaydns= display DNS cacheipconfig /flushdns= Clear DNS Cacheipconfig /release= Release All IP Address Connectionsipconfig /renew= Renew All IP Address Connectionsipconfig /registerdns= ReRegister the DNS connectionsipconfig /showclassid= Display DHCP Class Informationipconfig /setclassid= Change/Modify DHCP Class ID
ping
used to test the reachability of a host on an Internet Protocol (IP) network and to measure the round-trip time for messages sent from the originating host to a destination computer.
Ping operates by sending Internet Control Message Protocol (ICMP) echo request packets to the target host and waiting for an ICMP response. In the process it measures the time from transmission to reception (round-trip time) and records any packet loss. The results of the test are printed in the form of a statistical summary of the response packets received, including the minimum, maximum, and the mean round-trip times, and sometimes the standard deviation of the mean.
type ping /? to show help.
Usage: ping [-t] [-a] [-n count] [-l size] [-f] [-i TTL] [-v TOS]
[-r count] [-s count] [[-j host-list] | [-k host-list]]
[-w timeout] [-R] [-S srcaddr] [-4] [-6] target_name
Options:
-t Ping the specified host until stopped.
To see statistics and continue - type Control-Break;
To stop - type Control-C.
-a Resolve addresses to hostnames.
-n count Number of echo requests to send.
-l size Send buffer size.
-f Set Don't Fragment flag in packet (IPv4-only).
-i TTL Time To Live.
-v TOS Type Of Service (IPv4-only. This setting has been deprecated
and has no effect on the type of service field in the IP Head
er).
-r count Record route for count hops (IPv4-only).
-s count Timestamp for count hops (IPv4-only).
-j host-list Loose source route along host-list (IPv4-only).
-k host-list Strict source route along host-list (IPv4-only).
-w timeout Timeout in milliseconds to wait for each reply.
-R Use routing header to test reverse route also (IPv6-only).
-S srcaddr Source address to use.
-4 Force using IPv4.
-6 Force using IPv6.
ping google.com
sample output
C:\Users\h3>ping xahlee.info
Pinging xahlee.info [74.208.207.117] with 32 bytes of data:
Reply from 74.208.207.117: bytes=32 time=91ms TTL=48
Reply from 74.208.207.117: bytes=32 time=71ms TTL=48
Reply from 74.208.207.117: bytes=32 time=71ms TTL=48
Reply from 74.208.207.117: bytes=32 time=71ms TTL=48
Ping statistics for 74.208.207.117:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 71ms, Maximum = 91ms, Average = 76ms
C:\Users\h3>ping google.com
Pinging google.com [74.125.224.131] with 32 bytes of data:
Reply from 74.125.224.131: bytes=32 time=18ms TTL=55
Reply from 74.125.224.131: bytes=32 time=15ms TTL=55
Reply from 74.125.224.131: bytes=32 time=15ms TTL=55
Reply from 74.125.224.131: bytes=32 time=18ms TTL=55
Ping statistics for 74.125.224.131:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 15ms, Maximum = 18ms, Average = 16ms
traceroute
traceroute is a computer network diagnostic tool for displaying the route (path) and measuring transit delays of packets across an Internet Protocol (IP) network.
Traceroute sends a sequence of Internet Control Message Protocol (ICMP) echo request packets addressed to a destination host. Determining the intermediate routers traversed involves adjusting the time-to-live (TTL), aka hop limit, Internet Protocol parameter. Frequently starting with a value like 128 (Windows) or 64 (Linux), routers decrement this and discard a packet when the TTL value has reached zero, returning the ICMP error message ICMP Time Exceeded.
Traceroute works by increasing the TTL value of each successive set of packets sent. The first set of packets sent have a hop limit value of 1, expecting that they are not forwarded by the first router. The next set have a hop limit value of 2, so that the second router will send the error reply. This continues until the destination host receives the packets and returns an ICMP Echo Reply message.
Traceroute uses the returned ICMP messages to produce a list of routers that the packets have traversed. The timestamp values returned for each router along the path are the delay (aka latency) values, typically measured in milliseconds for each packet.
sample output
C:\Users\h3>tracert twitter.com Tracing route to twitter.com [199.59.149.230] over a maximum of 30 hops: 1 3 ms 2 ms 2 ms c-76-126-112-84.hsd1.ca.comcast.net [76.126.112. 84] 2 38 ms 28 ms 28 ms 76.126.112.1 3 18 ms 14 ms 14 ms te-0-1-0-3-ur05.santaclara.ca.sfba.comcast.net [ 68.87.198.81] 4 19 ms 22 ms 35 ms te-1-1-0-1-ar01.sfsutro.ca.sfba.comcast.net [69. 139.198.90] 5 23 ms 23 ms 22 ms he-1-5-0-0-cr01.sanjose.ca.ibone.comcast.net [68 .86.90.93] 6 21 ms 24 ms 21 ms 4.71.118.37 7 41 ms 29 ms 25 ms ae-4-90.edge2.SanJose3.Level3.net [4.69.152.209] 8 22 ms 34 ms 21 ms TWITTER-INC.edge2.SanJose3.Level3.net [4.53.210. 50] 9 34 ms 33 ms 39 ms ae53.smf1-er2.twttr.com [199.16.159.41] 10 38 ms 40 ms 40 ms www4.twitter.com [199.59.149.230] Trace complete.
netstat
netstat. Displays protocol statistics and current TCP/IP network connections.
netstat (network statistics) displays network connections (both incoming and outgoing), routing tables, and a number of network interface (network interface controller or software-defined network interface) and network protocol statistics.
It is used for finding problems in the network and to determine the amount of traffic on the network as a performance measurement.
C:\Users\h3>netstat /?
Displays protocol statistics and current TCP/IP network connections.
NETSTAT [-a] [-b] [-e] [-f] [-n] [-o] [-p proto] [-r] [-s] [-t] [interval]
-a Displays all connections and listening ports.
-b Displays the executable involved in creating each connection or
listening port. In some cases well-known executables host
multiple independent components, and in these cases the
sequence of components involved in creating the connection
or listening port is displayed. In this case the executable
name is in [] at the bottom, on top is the component it called,
and so forth until TCP/IP was reached. Note that this option
can be time-consuming and will fail unless you have sufficient
permissions.
-e Displays Ethernet statistics. This may be combined with the -s
option.
-f Displays Fully Qualified Domain Names (FQDN) for foreign
addresses.
-n Displays addresses and port numbers in numerical form.
-o Displays the owning process ID associated with each connection.
-p proto Shows connections for the protocol specified by proto; proto
may be any of: TCP, UDP, TCPv6, or UDPv6. If used with the -s
option to display per-protocol statistics, proto may be any of:
IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, or UDPv6.
-r Displays the routing table.
-s Displays per-protocol statistics. By default, statistics are
shown for IP, IPv6, ICMP, ICMPv6, TCP, TCPv6, UDP, and UDPv6;
the -p option may be used to specify a subset of the default.
-t Displays the current connection offload state.
interval Redisplays selected statistics, pausing interval seconds
between each display. Press CTRL+C to stop redisplaying
statistics. If omitted, netstat will print the current
configuration information once.
sample output
C:\Users\h3>netstat Active Connections Proto Local Address Foreign Address State TCP 127.0.0.1:5354 h3-HP:49156 ESTABLISHED TCP 127.0.0.1:5354 h3-HP:50406 ESTABLISHED TCP 127.0.0.1:5354 h3-HP:50410 ESTABLISHED TCP 127.0.0.1:5354 h3-HP:50411 ESTABLISHED TCP 127.0.0.1:19872 h3-HP:53073 ESTABLISHED TCP 127.0.0.1:27015 h3-HP:50418 ESTABLISHED TCP 127.0.0.1:27015 h3-HP:58404 ESTABLISHED TCP 127.0.0.1:49156 h3-HP:5354 ESTABLISHED TCP 127.0.0.1:49361 h3-HP:65369 ESTABLISHED TCP 127.0.0.1:50406 h3-HP:5354 ESTABLISHED TCP 127.0.0.1:50410 h3-HP:5354 ESTABLISHED TCP 127.0.0.1:50411 h3-HP:5354 ESTABLISHED TCP 127.0.0.1:50418 h3-HP:27015 ESTABLISHED TCP 127.0.0.1:52931 h3-HP:52932 ESTABLISHED TCP 127.0.0.1:52932 h3-HP:52931 ESTABLISHED TCP 127.0.0.1:53073 h3-HP:19872 ESTABLISHED TCP 127.0.0.1:58404 h3-HP:27015 ESTABLISHED TCP 127.0.0.1:65369 h3-HP:49361 ESTABLISHED TCP 192.168.1.3:50357 108.160.161.157:http ESTABLISHED TCP 192.168.1.3:50420 nuq04s07-in-f22:https ESTABLISHED TCP 192.168.1.3:50422 pb-in-f125:5222 ESTABLISHED TCP 192.168.1.3:50426 bn1wns2011223:https ESTABLISHED TCP 192.168.1.3:50428 108.160.161.157:http ESTABLISHED TCP 192.168.1.3:50451 pb-in-f125:https ESTABLISHED TCP 192.168.1.3:50864 a23-59-191-25:http ESTABLISHED TCP 192.168.1.3:50867 perfora:http TIME_WAIT TCP 192.168.1.3:50868 perfora:http TIME_WAIT TCP 192.168.1.3:50869 perfora:http TIME_WAIT TCP 192.168.1.3:50913 upload-lb:http TIME_WAIT TCP 192.168.1.3:50914 upload-lb:http TIME_WAIT TCP 192.168.1.3:50918 bits-lb:http TIME_WAIT TCP 192.168.1.3:50919 bits-lb:http TIME_WAIT
route
Route (command) Manipulates network routing tables.
route is a command used to view and manipulate the TCP/IP routing table. Manual manipulation of the routing table is characteristic of static routing.
PS C:\Users\h3> route /?
Manipulates network routing tables.
ROUTE [-f] [-p] [-4|-6] command [destination]
[MASK netmask] [gateway] [METRIC metric] [IF interface]
-f Clears the routing tables of all gateway entries. If this is
used in conjunction with one of the commands, the tables are
cleared prior to running the command.
-p When used with the ADD command, makes a route persistent across
boots of the system. By default, routes are not preserved
when the system is restarted. Ignored for all other commands,
which always affect the appropriate persistent routes. This
option is not supported in Windows 95.
-4 Force using IPv4.
-6 Force using IPv6.
command One of these:
PRINT Prints a route
ADD Adds a route
DELETE Deletes a route
CHANGE Modifies an existing route
destination Specifies the host.
MASK Specifies that the next parameter is the 'netmask' value.
netmask Specifies a subnet mask value for this route entry.
If not specified, it defaults to 255.255.255.255.
gateway Specifies gateway.
interface the interface number for the specified route.
METRIC specifies the metric, ie. cost for the destination.
All symbolic names used for destination are looked up in the network database
file NETWORKS. The symbolic names for gateway are looked up in the host name
database file HOSTS.
If the command is PRINT or DELETE. Destination or gateway can be a wildcard,
(wildcard is specified as a star '*'), or the gateway argument may be omitted.
If Dest contains a * or ?, it is treated as a shell pattern, and only
matching destination routes are printed. The '*' matches any string,
and '?' matches any one char. Examples: 157.*.1, 157.*, 127.*, *224*.
Pattern match is only allowed in PRINT command.
Diagnostic Notes:
Invalid MASK generates an error, that is when (DEST & MASK) != DEST.
Example> route ADD 157.0.0.0 MASK 155.0.0.0 157.55.80.1 IF 1
The route addition failed: The specified mask parameter is invalid. (Destination & Mask) != Destination.
Examples:
> route PRINT
> route PRINT -4
> route PRINT -6
> route PRINT 157* .... Only prints those matching 157*
> route ADD 157.0.0.0 MASK 255.0.0.0 157.55.80.1 METRIC 3 IF 2
destination^ ^mask ^gateway metric^ ^
Interface^
If IF is not given, it tries to find the best interface for a given
gateway.
> route ADD 3ffe::/32 3ffe::1
> route CHANGE 157.0.0.0 MASK 255.0.0.0 157.55.80.5 METRIC 2 IF 2
CHANGE is used to modify gateway and/or metric only.
> route DELETE 157.0.0.0
> route DELETE 3ffe::/32
arp, Address Resolution Protocol, IP to MAC address
Address Resolution Protocol (arp) is a telecommunications protocol used for resolution of network layer addresses into link layer addresses, a critical function in multiple-access networks. ARP was defined by RFC 826 in 1982. It is Internet Standard STD 37. It is also the name of the program for manipulating these addresses in most operating systems.
ARP has been implemented in many combinations of network and overlaying internetwork technologies, such as IPv4, Chaosnet, DECnet and Xerox PARC Universal Packet (PUP) using IEEE 802 standards, FDDI, X.25, Frame Relay and Asynchronous Transfer Mode (ATM), IPv4 over IEEE 802.3 and IEEE 802.11 being the most common cases.
In Internet Protocol Version 6 (IPv6) networks, the functionality of ARP is provided by the Neighbor Discovery Protocol (NDP).
arp = Displays and modifies the IP-to-Physical address translation tables used by address resolution protocol (ARP).
PS C:\Users\h3> arp /?
Displays and modifies the IP-to-Physical address translation tables used by
address resolution protocol (ARP).
ARP -s inet_addr eth_addr [if_addr]
ARP -d inet_addr [if_addr]
ARP -a [inet_addr] [-N if_addr] [-v]
-a Displays current ARP entries by interrogating the current
protocol data. If inet_addr is specified, the IP and Physical
addresses for only the specified computer are displayed. If
more than one network interface uses ARP, entries for each ARP
table are displayed.
-g Same as -a.
-v Displays current ARP entries in verbose mode. All invalid
entries and entries on the loop-back interface will be shown.
inet_addr Specifies an internet address.
-N if_addr Displays the ARP entries for the network interface specified
by if_addr.
-d Deletes the host specified by inet_addr. inet_addr may be
wildcarded with * to delete all hosts.
-s Adds the host and associates the Internet address inet_addr
with the Physical address eth_addr. The Physical address is
given as 6 hexadecimal bytes separated by hyphens. The entry
is permanent.
eth_addr Specifies a physical address.
if_addr If present, this specifies the Internet address of the
interface whose address translation table should be modified.
If not present, the first applicable interface will be used.
Example:
> arp -s 157.55.85.212 00-aa-00-62-c6-09 .... Adds a static entry.
> arp -a .... Displays the arp table.
sample output
PS C:\Users\h3> arp -a Interface: 192.168.1.3 --- 0xd Internet Address Physical Address Type 192.168.1.1 00-0f-b5-ac-a0-58 dynamic 192.168.1.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.251 01-00-5e-00-00-fb static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static 255.255.255.255 ff-ff-ff-ff-ff-ff static Interface: 192.168.56.1 --- 0x13 Internet Address Physical Address Type 192.168.56.255 ff-ff-ff-ff-ff-ff static 224.0.0.22 01-00-5e-00-00-16 static 224.0.0.251 01-00-5e-00-00-fb static 224.0.0.252 01-00-5e-00-00-fc static 239.255.255.250 01-00-5e-7f-ff-fa static 255.255.255.255 ff-ff-ff-ff-ff-ff static
hostname= display hostnamecontrol netconnections= open connection GUI