Command-line utilities Updated: January 21, 2005 Applies To: Windows Server 2003, Windows Server 2003 R2,

Windows Server 2003 with SP1, Windows Server 2003 with SP2

Command-line utilities
This section covers:

Viewing configuration by using ipconfig /all Viewing configuration by using the Status feature Refreshing configuration by using ipconfig /renew Managing DNS and DHCP class IDs by using ipconfig Testing connections by using ping Troubleshooting hardware addresses by using arp Troubleshooting NetBIOS names by using nbstat Displaying connection statistics by using netstat Tracing network connections by using tracert Testing routers by using pathping

Viewing configuration by using ipconfig /all

When you troubleshoot a TCP/IP networking problem, begin by checking the TCP/IP configuration on the computer that is experiencing the problem. You can use the ipconfig command to get host computer configuration information, including the IP address, subnet mask, and default gateway. Note

For clients running Windows 95, Windows 98, and Windows Millennium Edition, use the winipcfg command instead of ipconfig.

When you use the ipconfig command with the /all option, a detailed configuration report is produced for all interfaces, including any configured serial ports. With ipconfig /all, you can redirect command output to a file and paste the output into other documents. You can also use

this output to confirm the TCP/IP configuration of each computer on the network or to further investigate TCP/IP network problems. For example, if a computer is configured with an IP address that is a duplicate of an existing IP address, the subnet mask appears as 0.0.0.0. The following example shows the output of the ipconfig /all command on a computer that running Windows XP Professional and is configured to use the DHCP server for automatic TCP/IP configuration, and WINS and DNS servers for name resolution.
IP Configuration Node Type . . . . . . . . . : Hybrid IP Routing Enabled. . . . . : No WINS proxy Enabled. . . . . : No Ethernet adapter Local Area Connection: Host Name . . . . . . . . DNS Servers . . . . . . . Description . . . . . . . Physical Address. . . . . DHCP Enabled. . . . . . . Autoconfiguration Enabled IP Address. . . . . . . . Subnet Mask . . . . . . . Default Gateway . . . . . DHCP Server . . . . . . . Primary WINS Server . . . Secondary WINS Server . . Lease Obtained. . . . . . AM Lease Expires . . . . . . . : Friday, September 18, 1998 10:32:13 AM . . . . . . . . . . . . . : : : : : : : : : : : : : client1.microsoft.com 10.1.0.200 3Com 3C90x Ethernet Adapter 00-60-08-3E-46-07 Yes Yes 192.168.0.112 255.255.0.0 192.168.0.1 10.1.0.50 10.1.0.101 10.1.0.102 Wednesday, September 02, 1998 10:32:13

If no problems appear in the TCP/IP configuration, the next step is testing the ability to connect to other host computers on the TCP/IP network.

Viewing configuration by using the Status feature

An alternate method of viewing configuration is available through the Status feature of a network connection. For more information, see View the status of a local area connection.

Refreshing configuration by using ipconfig /renew

When you troubleshoot a TCP/IP networking problem, begin by checking the TCP/IP configuration on the computer that is experiencing the problem. If the computer is DHCPenabled and is using a DHCP server to obtain configuration, you can initiate a refresh of the lease by using the ipconfig /renew command.

When you use ipconfig /renew, all network adapters on the computer that uses DHCP (except those that are manually configured) try to contact a DHCP server and renew their existing configuration or obtain a new configuration. You can also use the ipconfig command with the /release option to immediately release the current DHCP configuration for a host. Note

For Windows 95, Windows 98, and Windows Millennium Edition DHCP-enabled clients, use the release and renew options of the winipcfg command instead of ipconfig /release and ipconfig /renew to perform manual release or renewal of the IP configuration lease for a client.

Repair feature
As an alternative to ipconfig you can use Repair to renew LAN or high-speed Internet connection IP settings. Repair performs a series of commands that repair a connection. The commands that are invoked by Repair are listed below with their command-line equivalents:

Repair Checks whether DHCP is enabled and, if enabled, issues a broadcast renew to refresh the IP address Flushes the ARP cache Flush the NetBIOS cache Flushes the DNS cache Re-registers with WINS Re-registers with DNS Important

Command-line equivalent No command line equivalent available arp -d * nbtstat -R ipconfig /flushdns nbtstat -RR ipconfig /registerdns

Repair uses a broadcast renew and will cause a computer to accept any lease from any DHCP server that is on the network. In contrast, a unicast renew (ipconfig /renew) will only renew the existing lease from the last DHCP server from which the client got a lease.

For more information, see Repair a LAN or high-speed Internet connection.

Managing DNS and DHCP class IDs by using ipconfig

You can also use the ipconfig command to:

Display or reset the DNS cache. For more information, see Flush and reset a client resolver cache using the ipconfig command.

Refresh registered DNS names. For more information, see Renew DNS client registration using the ipconfig command.

Display the DHCP class IDs for an adapter. For more information, see Show DHCP class ID information at a client computer.

Set the DHCP class IDs for an adapter. For more information, see Set DHCP class ID information at a client computer.

Testing connections by using ping

The ping command helps to verify IP-level connectivity. When troubleshooting, you can use ping to send an ICMP echo request to a target host name or IP address. Use ping whenever you need to verify that a host computer can connect to the TCP/IP network and network resources. You can also use ping to isolate network hardware problems and incompatible configurations. It is usually best to verify that a route exists between the local computer and a network host by first using the ping command and the IP address of the network host to which you want to connect. Try pinging the IP address of the target host to see if it responds, as follows: ping IP_address You should perform the following steps when using ping: 1. Ping the loopback address to verify that TCP/IP is configured correctly on the local computer. ping 127.0.0.1 2. Ping the IP address of the local computer to verify that it was added to the network correctly. pingIP_address_of_local_host 3. Ping the IP address of the default gateway to verify that the default gateway is functioning and that you can communicate with a local host on the local network. pingIP_address_of_default_gateway

4. Ping the IP address of a remote host to verify that you can communicate through a router. pingIP_address_of_remote_host The ping command uses Windows Sockets-style name resolution to resolve a computer name to an IP address, so if pinging by address succeeds, but pinging by name fails, then the problem lies in address or name resolution, not network connectivity. For more information, see Troubleshooting hardware addresses by using arp. If you cannot use ping successfully at any point, confirm that:

The computer was restarted after TCP/IP was configured. The IP address of the local computer is valid and appears correctly on the General tab of the Internet protocol (TCP/IP) properties dialog box. IP routing is enabled and the link between routers is operational.

You can use different options with the ping command to specify the size of packets to use, how many packets to send, whether to record the route used, what Time-to-Live (TTL) value to use, and whether to set the "don't fragment" flag. You can type ping -? to see these options. The following example illustrates how to send two pings, each 1,450 bytes in size, to IP address 131.107.8.1:
C:\>ping -n 2 -l 1450 131.107.8.1 Pinging 131.107.8.1 with 1450 bytes of data: Reply from 131.107.8.1: bytes=1450 time<10ms TTL=32 Reply from 131.107.8.1: bytes=1450 time<10ms TTL=32 Ping statistics for 131.107.8.1: Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate roundtrip times in milliseconds: Minimum = 0ms, Maximum = 10ms, Average = 2ms

By default, ping waits 4,000 milliseconds (4 seconds) for each response to be returned before displaying the "Request Timed Out" message. If the remote system being pinged is across a high-delay link, such as a satellite link, responses may take longer to be returned. You can use the -w (wait) option to specify a longer time-out.

Troubleshooting hardware addresses by using arp

The Address Resolution protocol (ARP) allows a host to find the media access control address of a host on the same physical network, given the IP address of the host. To make ARP efficient, each computer caches IP-to-media access control address mappings to eliminate repetitive ARP broadcast requests.

You can use the arp command to view and modify the ARP table entries on the local computer. The arp command is useful for viewing the ARP cache and resolving address resolution problems. For more information, see View the Address Resolution Protocol (ARP) cache and Add a static ARP cache entry.

Troubleshooting NetBIOS names by using nbtstat

NetBIOS over TCP/IP (NetBT) resolves NetBIOS names to IP addresses. TCP/IP provides many options for NetBIOS name resolution, including local cache lookup, WINS server query, broadcast, DNS server query, and Lmhosts and Hosts file lookup. Nbtstat is a useful tool for troubleshooting NetBIOS name resolution problems. You can use the nbtstat command to remove or correct preloaded entries:

nbtstat -n displays the names that were registered locally on the system by programs such as the server and redirector. nbtstat -c shows the NetBIOS name cache, which contains name-to-address mappings for other computers. nbtstat -R purges the name cache and reloads it from the Lmhosts file. nbtstat -RR releases NetBIOS names registered with a WINS server and then renews their registration. nbtstat -a name performs a NetBIOS adapter status command against the computer specified by name. The adapter status command returns the local NetBIOS name table for that computer plus the media access control address of the adapter. nbtstat -S lists the current NetBIOS sessions and their status, including statistics, as shown in the following example:
NetBIOS connection table Local name State In/out Remote Host Input Output -----------------------------------------------------------------CORP1 <00> Connected Out CORPSUP1<20> 6MB 5MB CORP1 <00> Connected Out CORPPRINT<20> 108KB 116KB CORP1 <00> Connected Out CORPSRC1<20> 299KB 19KB CORP1 <00> Connected Out CORPEMAIL1<20> 324KB 19KB CORP1 <03> Listening

Displaying connection statistics by using netstat

You can use the netstat command to display protocol statistics and current TCP/IP connections. The netstat -a command displays all connections, and netstat -r displays the route table plus active connections. The netstat -o command displays process IDs so you can view the owner of the port for each connection. The netstat -e command displays Ethernet statistics, and netstat -s displays per-protocol statistics. If you use netstat -n, addresses and port numbers are not converted to names. The following shows sample output for netstat:
C:\>netstat -e Interface Statistics Bytes Unicast packets Non-unicast packets Discards Errors Unknown protocols C:\>netstat -n -o Active Connections proto TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP TCP Local Address 172.31.71.152:1136 172.31.71.152:2730 172.31.71.152:3110 172.31.71.152:3796 172.31.71.152:3800 172.31.71.152:3815 172.31.71.152:3819 172.31.71.152:4034 172.31.71.152:4037 172.31.71.152:4043 172.31.71.152:4044 172.31.71.152:4045 172.31.71.152:4046 172.31.71.152:4047 172.31.71.152:4048 172.31.71.152:4049 172.31.71.152:4050 Foreign Address 157.54.2.84:389 172.31.71.99:139 157.54.2.84:389 172.30.236.233:1479 172.30.236.233:1740 172.30.236.233:1479 172.30.236.233:1740 172.31.16.197:139 157.54.4.183:445 157.60.218.11:119 157.60.218.11:119 157.60.218.11:119 157.60.218.11:119 157.60.218.11:119 157.60.218.11:119 157.60.218.11:119 157.60.218.11:119 State CLOSE_WAIT ESTABLISHED CLOSE_WAIT ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED TIME_WAIT TIME_WAIT TIME_WAIT TIME_WAIT TIME_WAIT TIME_WAIT TIME_WAIT TIME_WAIT TIME_WAIT TIME_WAIT PID 180 4 364 1128 1128 908 908 0 0 0 0 0 0 0 0 0 0 Received 3995837940 120099 7579544 0 0 363054211 Sent 47224622 131015 3823 0 0

C:\>netstat -a Active Connections proto Local Address TCP CORP1:1572 TCP CORP1:1589 TCP CORP1:1606 TCP CORP1:1632 TCP CORP1:1659 TCP CORP1:1714 TCP CORP1:1719 TCP CORP1:1241 UDP CORP1:1025 Foreign Address 172.16.48.10:nbsession 172.16.48.10:nbsession 172.16.105.245:nbsession 172.16.48.213:nbsession 172.16.48.169:nbsession 172.16.48.203:nbsession 172.16.48.36:nbsession 172.16.48.101:nbsession *:* State ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED ESTABLISHED

UDP UDP UDP UDP UDP

CORP1:snmp CORP1:nbname CORP1:nbdatagram CORP1:nbname CORP1:nbdatagram

*:* *:* *:* *:* *:*

C:\>netstat -s IP Statistics Packets Received = 5378528 Received Header Errors = 738854 Received Address Errors = 23150 Datagrams Forwarded = 0 Unknown protocols Received = 0 Received Packets Discarded = 0 Received Packets Delivered = 4616524 Output Requests = 132702 Routing Discards = 157 Discarded Output Packets = 0 Output Packet No Route = 0 Reassembly Required = 0 Reassembly Successful = 0 Reassembly Failures = 0 Datagrams Successfully Fragmented = 0 Datagrams Failing Fragmentation = 0 Fragments Created = 0 ICMP Statistics Messages Errors Destination Unreachable Time Exceeded Parameter problems Source Quenches Redirects Echoes Echo Replies Timestamps Timestamp Replies Address Masks Address Mask Replies TCP Statistics Active Opens Passive Opens Failed Connection Attempts Reset Connections Current Connections Segments Received Segments Sent Segments Retransmitted UDP Statistics Datagrams Received = 4157136 = = = = = = = = 597 135 107 91 8 106770 118431 461 Received 693 0 685 0 0 0 0 4 0 0 0 0 0 Sent 4 0 0 0 0 0 0 0 4 0 0 0 0

No Ports Receive Errors Datagrams Sent

= 351928 = 2 = 13809

Tracing network connections by using tracert

Tracert (Trace Route) is a route-tracing utility that is used to determine the path that an IP datagram takes to reach a destination. The tracert command uses the IP Time-to-Live (TTL) field and ICMP error messages to determine the route from one host to another through a network.

How tracert works

The Tracert diagnostic utility determines the route taken to a destination by sending Internet Control Message protocol (ICMP) echo packets with varying IP Time-to-Live (TTL) values to the destination. Each router along the path is required to decrement the TTL on a packet by at least 1 before forwarding it. When the TTL on a packet reaches 0, the router should send an "ICMP Time Exceeded" message back to the source computer. Tracert determines the route by sending the first echo packet with a TTL of 1 and incrementing the TTL by 1 on each subsequent transmission until the target responds or the maximum TTL is reached. The route is determined by examining the "ICMP Time Exceeded" messages sent back by intermediate routers. Some routers silently drop packets with expired TTLs and are invisible to the Tracert utility. The tracert command prints out an ordered list of the near-side interface of the routers in the path that returned the "ICMP Time Exceeded" message. If the -d option is used, the Tracert utility does not perform a DNS lookup on each IP address. In the following example, the packet must travel through two routers (10.0.0.1 and 192.168.0.1) to get to host 172.16.0.99. The default gateway of the host is 10.0.0.1 and the IP address of the router on the 192.168.0.0 network is 192.168.0.1.
C:\>tracert 172.16.0.99 -d Tracing route to 172.16.0.99 over a maximum of 30 hops 1 2 ms 3 ms 2 ms 10.0.0.1 2 75 ms 83 ms 88 ms 192.168.0.1 3 73 ms 79 ms 93 ms 172.16.0.99 Trace complete.

Troubleshooting with tracert

You can use the tracert command to determine where a packet stopped on the network. In the following example, the default gateway has determined that there is not a valid path for the host on 192.168.10.99. There is probably a router configuration problem or the 192.168.10.0 network does not exist (a bad IP address).

C:\>tracert 192.168.10.99 Tracing route to 192.168.10.99 over a maximum of 30 hops 1 10.0.0.1 reports: Destination net unreachable. Trace complete.

The Tracert utility is useful for troubleshooting large networks where several paths can be taken to arrive at the same point.

Tracert command-line options

The tracert command supports several options, as shown in the following table. tracert [-d] [-h maximum_hops] [-j host-list] [-w timeout] target_name

Option -d -h maximum_hops -j host-list -w timeout target_name

Description Specifies that IP addresses are not resolved to host names. Specifies the number of hops to allow in tracing a route to the host named in target_name. Specifies the list of router interfaces in the path taken by the Tracert utility packets. Waits the number of milliseconds specified by timeout for each reply. Name or IP address of the target host.

For more information, see Trace a path by using the tracert command.

Testing routers by using pathping

The pathping command is a route tracing tool that combines features of the ping and tracert commands with additional information that neither of those tools provides. The pathping command sends packets to each router on the way to a final destination over a period of time, and then computes results based on the packets returned from each hop. Since the command shows the degree of packet loss at any given router or link, it is easy to determine which routers or links might be causing network problems. A number of options are available, as shown in the following table.

Option Name Function Hostnames Does not resolve addresses to host names. -n Maximum hops Maximum number of hops to search for target. -h Host-list Loose source route along host list. -g

-p -q -w -i -4 -6

Period Num_queries Time-out address IPv4 IPv6

Number of milliseconds to wait between pings. Number of queries per hop. Waits this many milliseconds for each reply. Use the specified source address. Force pathping to use IPv4. Force pathping to use IPv6.

The default number of hops is 30, and the default wait time before a time-out is 3 seconds. The default period is 250 milliseconds, and the default number of queries to each router along the path is 100. The following is a typical pathping report. The compiled statistics that follow the hop list indicate packet loss at each individual router.
D:\>pathping -n server1 Tracing route to server1 [10.54.1.196] over a maximum of 30 hops: 0 172.16.87.35 1 172.16.87.218 2 192.168.52.1 3 192.168.80.1 4 10.54.247.14 5 10.54.1.196 Computing statistics for 125 seconds... Source to Here This Node/Link Hop RTT Lost/Sent = Pct Lost/Sent = Pct 0 0/ 100 = 0% 1 41ms 0/ 100 = 0% 0/ 100 = 0% 13/ 100 = 13% 2 22ms 16/ 100 = 16% 3/ 100 = 3% 0/ 100 = 0% 3 24ms 13/ 100 = 13% 0/ 100 = 0% 0/ 100 = 0% 4 21ms 14/ 100 = 14% 1/ 100 = 1% 0/ 100 = 0% 5 24ms 13/ 100 = 13% 0/ 100 = 0% Trace complete.

Address 172.16.87.35 | 172.16.87.218 | 192.168.52.1 | 192.168.80.1 | 10.54.247.14 | 10.54.1.196

When pathping is run, you first see the results for the route as it is tested for problems. This is the same path that is shown by the tracert command. The pathping command then displays a busy message for the next 125 seconds (this time varies by the hop count). During this time, pathping gathers information from all the routers previously listed and from the links between them. At the end of this period, it displays the test results. The two rightmost columns--This Node/Link Lost/Sent=Pct and Address--contain the most useful information. The link between 172.16.87.218 (hop 1), and 192.168.52.1 (hop 2) is

dropping 13 percent of the packets. All other links are working normally. The routers at hops 2 and 4 also drop packets addressed to them (as shown in the This Node/Link column), but this loss does not affect their forwarding path. The loss rates displayed for the links (marked as a | in the rightmost column) indicate losses of packets being forwarded along the path. This loss indicates link congestion. The loss rates displayed for routers (indicated by their IP addresses in the rightmost column) indicate that those routers' CPUs might be overloaded. These congested routers might also be a factor in end-to-end problems, especially if packets are forwarded by software routers.

Ipconfig
Displays all current TCP/IP network configuration values and refreshes Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) settings. Used without parameters, ipconfig displays the IP address, subnet mask, and default gateway for all adapters.

Syntax
ipconfig [/all] [/renew [Adapter]] [/release [Adapter]] [/flushdns] [/displaydns] [/registerdns] [/showclassid Adapter] [/setclassid Adapter [ClassID]]
Top of page

Parameters
/all : Displays the full TCP/IP configuration for all adapters. Without this parameter, ipconfig displays only the IP address, subnet mask, and default gateway values for each adapter. Adapters can represent physical interfaces, such as installed network adapters, or logical interfaces, such as dial-up connections. /renew [Adapter] : Renews DHCP configuration for all adapters (if an adapter is not specified) or for a specific adapter if the Adapter parameter is included. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. To specify an adapter name, type the adapter name that appears when you use ipconfig without parameters. /release [Adapter] : Sends a DHCPRELEASE message to the DHCP server to release the current DHCP configuration and discard the IP address configuration for either all adapters (if an adapter is not specified) or for a specific adapter if the Adapter parameter is included. This parameter disables TCP/IP for adapters configured to obtain an IP address automatically. To specify an adapter name, type the adapter name that appears when you use ipconfig without parameters. /flushdns : Flushes and resets the contents of the DNS client resolver cache. During DNS troubleshooting, you can use this procedure to discard negative cache entries from the cache, as well as any other entries that have been added dynamically. /displaydns : Displays the contents of the DNS client resolver cache, which includes both entries preloaded from the local Hosts file and any recently obtained resource records for name queries resolved by the computer. The DNS Client service uses this information to resolve frequently queried names quickly, before querying its configured DNS servers. /registerdns : Initiates manual dynamic registration for the DNS names and IP addresses that are configured at a computer. You can use this parameter to troubleshoot a failed DNS name registration or resolve a dynamic update problem between a client and the DNS server without rebooting the client computer. The DNS settings in the advanced properties of the TCP/IP protocol determine which names are registered in DNS.

/showclassid Adapter : Displays the DHCP class ID for a specified adapter. To see the DHCP class ID for all adapters, use the asterisk (*) wildcard character in place of Adapter. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. /setclassid Adapter [ClassID] : Configures the DHCP class ID for a specified adapter. To set the DHCP class ID for all adapters, use the asterisk (*) wildcard character in place of Adapter. This parameter is available only on computers with adapters that are configured to obtain an IP address automatically. If a DHCP class ID is not specified, the current class ID is removed. /?: Displays help at the command prompt.
Top of page

Remarks
The ipconfig command is the command-line equivalent to the winipcfg command, which is

available in Windows Millennium Edition, Windows 98, and Windows 95. Although Windows XP does not include a graphical equivalent to the winipcfg command, you can use Network Connections to view and renew an IP address. To do this, open Network Connections, right-click a network connection, click Status, and then click the Support tab. This command is most useful on computers that are configured to obtain an IP address automatically. This enables users to determine which TCP/IP configuration values have been configured by DHCP, Automatic Private IP Addressing (APIPA), or an alternate configuration. If the Adapter name contains any spaces, use quotation marks around the adapter name (that is, "Adapter Name"). For adapter names, ipconfig supports the use of the asterisk (*) wildcard character to specify either adapters with names that begin with a specified string or adapters with names that contain a specified string. For example, Local* matches all adapters that start with the string Local and *Con* matches all adapters that contain the string Con. This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections
Top of page

Examples
To display the basic TCP/IP configuration for all adapters, type: ipconfig To display the full TCP/IP configuration for all adapters, type: ipconfig /all

To renew a DHCP-assigned IP address configuration for only the Local Area Connection adapter, type: ipconfig /renew "Local Area Connection" To flush the DNS resolver cache when troubleshooting DNS name resolution problems, type: ipconfig /flushdns To display the DHCP class ID for all adapters with names that start with Local, type: ipconfig /showclassid Local* To set the DHCP class ID for the Local Area Connection adapter to TEST, type: ipconfig /setclassid "Local Area Connection" TEST
Top of page

Formatting legend
Format Meaning

Italic Bold

Information that the user must supply Elements that the user must type exactly as shown Ellipsis (...) Parameter that can be repeated several times in a command line Between brackets ([]) Optional items Between braces ({}); choices separated by pipe (|). Set of choices from which the user must Example: {even|odd} choose only one Courier font Code or program output