Complete tutorial on the NETSH command in Windows

If you work with Windows and frequently deal with networks, sooner or later you're going to encounter the netsh command and all its potential for manage networks and Wi-Fi with commandsAlthough most things can be done from the graphical interface, when you want to go fast, automate tasks, or fix a serious problem, the command line is your best friend.

This tutorial gathers and clearly reorganizes the information from the best guides on the subject, so you have it all in one place. A complete manual for netsh: what it is, how it works, and the most useful commands. for IPv4, Wi-Fi, firewall, DNS, proxy, scripts and network diagnostics on Windows.

What is netsh and what is it used for in Windows?

Netsh (Network Shell) is a A console tool included in Windows that allows you to query, configure, and diagnose the network.This applies to both client computers (Windows 10, 11…) and Windows Server. Everything is done via commands, without graphical interfaces.

This utility works by command contexts that are loaded via DLLEach DLL file adds a set of commands for a specific function: DHCP, firewall, IP, Wi-Fi, TCP, etc. For example, the library dhcpmon.dll It adds the context for managing DHCP servers from netsh.

In many cases, netsh commands offer the same functionality as MMC (Microsoft Management Console) add-ins that you use in graphical mode: advanced firewall, NPS (Network Policy Server), BranchCache, IPsec, HTTP, among others. In other scenarios you can even access areas that the graphical interface cannot, such as certain IPv6, WFP, or RPC settings.

The great advantage of netsh is that you can automate changes, execute actions remotely, and generate reusable scriptswhich is pure gold if you manage multiple computers or servers and want to work consistently.

General syntax of the netsh command

The basic syntax of netsh, as documented by Microsoft, is this (adapted to Spanish):

netsh

Each parameter has a specific purpose and they are all optional, except for the command itself or the script that you want to run:

• -to: indicates that you want to run an alias file (plain text with several netsh commands) and, when finished, return to the netsh shell instead of exiting.
• -c: defines the initial context, that is, the command area you will be working with (for example, wlan, interface, advfirewall).
• -r: Runs the command on another computer, using its computer name, FQDN, or IP address. Requires the Remote Registry service to be active; if it is not, you will see errors. "Network path not found".
• -or: allows launching netsh with the credentials of another user account, local or domain.
• -p | *: accompanies -u to enter the account password. With * forces you to be asked for the key securely without displaying it on the screen.
• -F: executes a netsh script (list of commands) and exits automatically upon completion.

When a string value contains spaces, it is mandatory. enclose it in double quotesFor example, to use a remote computer whose name includes spaces, you would do something like this: -r "equipo remoto oficina".

Netsh contexts, subcontexts, and built-in help

Netsh functions as a kind of internal "mini console" where you switch between contexts and subcontexts depending on the network component that you want to manage: interface, IPv4, IPv6, firewall, Wi-Fi, TCP, UDP, etc.

If you type only from CMD or PowerShell netsh and you press Enter, you will enter netsh interactive shellThere you will see a prompt similar to netsh>and from there you can change the context:

• Typing dhcpclient You will enter the DHCP client context.
• If you write interface, you jump to the context of network interfaces.
• From interface You can go to the subcontext ipv4 o ipv6, among others.

The text that appears before the symbol > tells you where you are at any given moment. For example, netsh interface ipv4> It makes it clear that you are in the IPv4 interface subcontext.

To see which contexts your system supports, you can use netsh ? o netsh helpAmong the typical list you'll find things like:

• advfirewall: Windows Firewall management with advanced security.
• wlan: everything related to Wi-Fi networks.
• interface: management of network interfaces and their subcontexts (ipv4, ipv6, tcp, udp…).
• branchcache, http, ipsec, ras, winsock, winhttp and many others.

Furthermore, each context has its own nested subcontextsFor example, within interface you have ipv4, ipv6, tcp, udp, portproxy, teredoetc., each with its own specific commands.

If you don't want to change location, you can use the full path of the commandFor example, from anywhere (even outside of netsh) you can run:

netsh interface ipv4 set address "NetLAN1" static <IP> <MASCARA> <PUERTA_DE_ENLACE>

This applies a static IP address to the "NetLAN1" interface without having to manually switch between contexts.

Legend and syntax of netsh commands

The netsh documentation uses a very clear convention to explain Which parts of a command are literal and which should you replace? based on your own data.

• The text in Cursive usually points out information you need to change, such as usernames, files, or interfaces.
• The text in bold font It represents what you have to write exactly as is, without modification.
• When you see a parameter followed by ellipses (...) means that that parameter can be repeated several times along the same lines.
• Everything in brackets es Optional.
• The elements in brackets {} separated by | they imply that You can only choose one of the options, for example {enable|disable}.
• Text in monospace font (Courier type) represents command code or output.

Please note that many parameters accept string valuesIf they contain spaces, remember to enclose them in double quotes, for example when configuring an interface called Wireless network connection:

netsh interface ipv4 set address name="Wireless Network Connection" dhcp

Instead of the interface name, you can also use its index number (useful when the name is in another language or is very long), for example:

netsh interface ipv4 set address name=15 dhcp

How to run netsh: CMD, PowerShell, and interactive mode

Netsh can be launched from both Windows PowerShell as from the classic command prompt (CMD)But the way of working with it changes slightly in each case.

To open it in administrator mode you can:

• Pulsar Windows + X and choose “Windows PowerShell (Administrator)” or “Command Prompt (Administrator)”.
• Or search “cmd" or "PowerShell"In the Start menu, right-click and run as administrator."

From either console you can write netsh To enter the netsh shell. There you will enter the commands one after the otherchanging context and using ? to see the options available at each point.

If you prefer not to enter interactive mode, in CMD it is very common to type the full command in one go and press Enter, for example netsh /? to see general help or something like netsh interface tcp show global to view global TCP parameters.

Using netsh with IPv4: IP, mask, gateway, and DNS

One of the most typical applications of netsh is consult and modify the IPv4 configuration of the interfaces: IP, subnet mask, gateway, and DNS servers.

To display a summary of the current IPv4 configuration on all interfaces, you can use:

netsh interface ip show config

The exit is somewhat less exhaustive than ipconfig /allbut it offers All the important information at a glance: Current IP, mask, gateway and DNS configured.

If you want to change the IP address of a network interface to a static address, for example to optimize online gaming, you can use the classic IPv4 syntax:

netsh interface ip set address name="Ethernet" source=static addr=192.168.1.10 mask=255.255.255.0 gateway=192.168.1.1

With that command you set the interface to "Ethernet" IP 192.168.1.10, mask /24 and gateway 192.168.1.1If you later want the IP address to be reassigned by DHCP, you would only need to run:

netsh interface ip set address name="Ethernet" source=dhcp

The same applies to DNS servers. To set a static DNS:

netsh interface ip set dnsserver "Ethernet" static 8.8.8.8 primary

And to return name resolution to DHCP:

netsh interface ip set dnsserver "Ethernet" dhcp

In IPv4 you will also have commands at hand for Show IP statistics, the ARP table or configured TCP connections:

• netsh interface ip show ipstats – IP protocol statistics.
• netsh interface ip show ipnet – associated IP and MAC addresses (triggers ARP requests on the network).
• netsh interface ip show tcpconn – summary of existing TCP connections.

Interface management: names, indexes, and state

Before changing anything, it's important to know What interfaces do you have, what are their names, and what state are they in?With netsh it's very simple: to better understand the network connection flow It will be helpful to list the interfaces before touching any settings.

To view the general list of network interfaces and their status (connected, disconnected, disabled):

netsh interface show interface

If you need the numerical indexes of all IPv4 interfaces (useful when the name has spaces or accents):

netsh interface ip show interfaces

You also have commands to display the addresses and DNS configured per interface, For example:

• netsh interface ipv4 show address Wi-Fi
• netsh interface ipv4 show dns Wi-Fi
• netsh interface ipv4 show address Ethernet
• netsh interface ipv4 show dns Ethernet

When you are outside of any subcontext, you can use the full path, for example:

netsh interface ipv4 show interfaces

With that, you see it all at once. All IPv4 interfaces with their indexes, MTU, and statuswithout needing to jump to the context interface.

Wi-Fi Networks: Profiles, Keys, Drivers, and Capabilities

The context wlan It encompasses virtually everything you can do with wireless networks from netsh: List profiles, view saved passwords, check drivers and capabilities, and generate reportsIt also allows, for example, create a virtual Wi-Fi network using netsh.

To list all the Wi-Fi profiles that the system has saved:

netsh wlan show profiles

If you want to filter by a specific wireless interface, you can use:

netsh wlan show profiles interface="nombre_interfaz"

To see The Wi-Fi controller in detail (manufacturer, version, date, type of radio, etc.):

netsh wlan show drivers

In recent systems you can also see wireless capabilities supported by the adapter:

netsh wlan show wireless capabilities

If you want to see real-time data about the active Wi-Fi interface (connected SSID, channel, signal strength, link speed):

netsh wlan show interfaces

And if you have several, you can specify the name:

netsh wlan show interface name="Nombre_interfaz"

To list the wireless networks your adapter is currently seeing:

netsh wlan show networks

If you need much more detailed information about each BSSID (channel, power levels, supported speeds), you can add the BSSID mode:

netsh wlan show networks mode=bssid

A very common use is Retrieve the saved Wi-Fi password from a profile Specifically, you can do that by running:

netsh wlan show profile name="NombrePerfil" key=clear

The key will appear in plain text in the security settings section of the output, so only use it on computers you control, because Anyone with administrator access can see those passwords..

If you want a Wi-Fi network to stop automatically connecting when it's detected, you can change its connection mode:

netsh wlan set profileparameter name="Nombre de perfil" connectionmode=manual

And if you're interested in the exact opposite, that it connects automatically when it's within range:

netsh wlan set profileparameter name="Nombre de perfil" connectionmode=auto

To disconnect from the current Wi-Fi network via the console, you can do the following:

netsh wlan disconnect

And to connect to another network whose profile already exists on the computer, something like:

netsh wlan connect name="NombreDeTuSSID"

Export, import, and clean Wi-Fi profiles

Managing multiple teams can be very convenient export Wi-Fi profiles from one that is already well configured, and then import them into others without having to write keys by hand.

To export all profiles to a specific folder, using the clear keys so they can be migrated without problems:

netsh wlan export profile key=clear folder="C:\perfileswifi"

This will generate one or more XML files in the specified path. Later, to import them onto another computer, simply:

netsh wlan add profile filename="C:\perfileswifi\perfil1.xml"

If you have old profiles from networks you no longer connect to, it's a good idea to Clean them to avoid confusion and connection problemsTo delete a specific one:

netsh wlan delete profile name="Nombre de perfil"

If you want a complete HTML report on Wi-Fi connection history, errors, and adapter configuration, you can generate a report with:

netsh wlan show wlanreport

The command will tell you the path to a file .html with all the information; when you open it in the browser you will see a very detailed summary of connections, events and Wi-Fi statistics of the device.

Windows Firewall and netsh advfirewall

Another key context is advfirewallwhich allows you to manage the Windows Firewall in advanced ways: view rules, create new ones, allow ports, block ICMP, reset settings, etc.; if you need practical guides for use Windows Defender Firewall For reference, this will be helpful.

To list all configured firewall rules:

netsh advfirewall firewall show rule name=all

If you are only interested the current user profile (private, public, domain), with their active parameters:

netsh advfirewall show currentprofile

If you need to view or open specific ports, a commonly used command is:

netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

This creates an inbound rule to allow TCP traffic on port 80. To open the Remote Desktop port (3389), another classic example is:

netsh advfirewall firewall add rule name="Open Remote Desktop" protocol=TCP dir=in localport=3389 action=allow

If you want to delete a specific rule later, you can use:

netsh advfirewall firewall delete rule name="NombreDeLaRegla" protocol=udp localport=500

Many network audits require that you do not respond to ping (ICMP) requests from outside the network. allow incoming ICMPv4 ping requests you can use:

netsh advfirewall firewall add rule name="All ICMP V4" dir=in action=allow protocol=icmpv4

And to block them, by changing the action:

netsh advfirewall firewall add rule name="All ICMP V4" dir=in action=block protocol=icmpv4

It is also possible to deactivate completely disable the firewall for all profiles (with great care):

netsh advfirewall set allprofiles state off

If you need to revert to factory settings because you've changed too much, you can reset all the rules:

netsh advfirewall reset

DNS, proxy, TCP/IP and network repair

Netsh is also very useful for Covering advanced aspects of TCP/IP, Winsock, and proxy configurationespecially when you have issues that aren't fixed with a simple adapter restart.

To review the WinHTTP proxy configuration that the system uses:

netsh winhttp show proxy

If you need to configure a specific proxy for WinHTTP connections, you can do it like this:

netsh winhttp set proxy "servidorproxy.dominio.com:8484" "<local>"

Replace the host and port with those of your real server, and adapt the exclusion list for local addresses or domains that should not go through a proxy.

When things go wrong at the network stack level, many guides recommend Reset Winsock and TCP/IPThe two typical commands are:

• netsh winsock reset catalog – Resets the Winsock catalog.
• netsh int ip reset reset.log – resets the TCP/IP stack to default values ​​and saves a log in reset.log.

After running these commands, it is recommended Restart the system so that all changes to the network stack are applied.

If you want to check the global TCP and UDP parameters configured on your machine, you can use:

• netsh interface tcp show global
• netsh interface udp show global

Some optimizations or advanced diagnostics involve changing these values. A typical example is the Receive Side Scaling (RSS), which distributes the network load across multiple processor cores.

To disable RSS:

netsh interface tcp set global rss=disabled

And to reactivate it:

netsh interface tcp set global rss=enabled

When working with multicasting (videoconferencing, streaming, etc.), you can also check the active multicast subscriptions on the interfaces with:

netsh interface ip show joins

Configure IP, DNS, and DHCP using netsh int ip

In addition to what has already been seen in IPv4, the context int ip (IP interface) allows you to make quick changes to addresses, DNS, and DHCP behavior.

A classic example for setting up Static IP and gateway on a LAN interface would:

netsh int ip set address "local area connection" static 192.168.29.101 255.255.255.0 192.168.29.254 1

netsh interface ip add dns name="Local Area Connection" addr=192.168.0.131

Remember you must Replace the IP addresses with those that correspond to your network. (segment, gateway, own or external DNS).

If you're working with DHCP, you can also change an interface that's statically assigned to receive both IP and DNS via DHCP, for example in the case of Wi-Fi:

netsh interface ipv4 set address "Wi-Fi" dhcp

netsh interface ipv4 set dnsservers "Wi-Fi" dhcp

Dumping configuration, aliases, and usage in batch scripts

One of netsh's strengths is the possibility of dump the network configuration to a text filewhich you can then use as a backup or as a script to clone that configuration to other computers.

For example, you can create a folder C:\networks and then transfer the current configuration there with:

netsh dump >> C:\redes\configuracion.txt

If you ever need to restore that configuration, simply run:

netsh -f C:\redes\configuracion.txt

Besides full dumps, you can prepare batch files (.bat or .cmd) with several netsh commands executed simultaneously. For example, a script that sets the IP address, primary and secondary DNS servers, and activates the firewall:

@echo off
echo Configurando red...
REM IP, máscara y puerta de enlace
netsh interface ip set address name="Ethernet" static 192.168.1.100 255.255.255.0 192.168.1.1
REM DNS principal
netsh interface ip set dns name="Ethernet" static 8.8.8.8
REM DNS secundario
netsh interface ip add dns name="Ethernet" 8.8.4.4 index=2
REM Activar firewall para todos los perfiles
netsh advfirewall set allprofiles state on
echo Configuración de red aplicada.
pause

Lines that begin with REM These are comments and are not executed. To run the script, you would only need to double-click it or run it from CMD/PowerShell with administrator privileges.

Another curious function is that of the aliaswhich allow you to abbreviate long commands. You can see all the aliases defined with:

netsh show alias

Netsh traffic capture, diagnostics, and limitations

When a network problem persists, sometimes there is no other option than to capture packets for detailed analysisNetsh integrates a tracing system that generates ETL files for later analysis with tools such as Microsoft Message Analyzer or Wireshark (after converting the format).

To initiate a general traffic capture:

netsh trace start capture=yes tracefile=C:\trace.etl persistent=yes maxsize=4096

And to stop it when you have enough information:

netsh trace stop

Although netsh is tremendously powerful, it also has its drawbacks. disadvantages and limitations in modern environments:

• Its syntax isn't particularly user-friendly; if you're not used to the console, it is easy to make mistakes typing.
• It has no graphical interface: everything is done by typing, so It's not very intuitive for novice users..
• Part of its functionality It is not designed for very modern networks (SDN, very advanced IPv6 configurations) and Microsoft is increasingly pushing towards PowerShell and specific cmdlets.
• Most actions require administrator privileges, so It is not a tool for standard users..

Even so, netsh remains one of the Essential Swiss Army knives for anyone managing networks in WindowsWith the commands you've seen, you can configure IP and DNS, manage Wi-Fi, open or close ports in the firewall, configure proxy settings, repair the TCP/IP stack, and even capture traffic or complete configuration scripts, quickly and repeatedly when the graphical interface falls short or simply wastes your time.