Complete tutorial on the NETSH command in Windows

If you work with Windows and frequently deal with networks, sooner or later you'll encounter the netsh command and its full potential for managing networks and Wi-Fi with commands . While most things can be done from the graphical interface, when you want to work quickly, automate tasks, or fix a serious problem, the command line is your best friend.

This tutorial gathers and clearly reorganizes the information from the best guides on the subject, so you have a complete netsh manual in one place: what it is, how it works, and the most useful commands for IPv4, Wi-Fi, firewall, DNS, proxy, scripts, and network diagnostics in Windows.

What is netsh and what is it used for in Windows?

Netsh (Network Shell) is a command-line tool included in Windows that allows you to query, configure, and diagnose your network , both on client computers (Windows 10, 11, etc.) and on Windows Server. Everything is done using commands, without a graphical interface.

This utility works using command contexts loaded via DLLs . Each DLL file adds a set of commands for a specific function: DHCP, firewall, IP, Wi-Fi, TCP, etc. For example, the dhcpmon.dll library adds the context for managing DHCP servers from netsh.

In many cases, netsh commands offer the same functionality as the Microsoft Management Console (MMC) snap-ins you use in graphical mode: advanced firewall, Network Policy Server (NPS), BranchCache, IPsec, HTTP, and more. In other scenarios, you can even access settings that the graphical interface cannot, such as certain IPv6, WFP, or RPC configurations.

The great advantage of netsh is that you can automate changes, run actions remotely, and generate reusable scripts , which is pure gold if you manage multiple computers or servers and want to work consistently.

General syntax of the netsh command

The basic syntax of netsh, as documented by Microsoft, is this (adapted to Spanish):

netsh

Each parameter has a specific purpose and all are optional, except for the command itself or the script you want to run:

• -to: indicates that you want to run an alias file (plain text with several netsh commands) and, when finished, return to the netsh shell instead of exiting.
• -c: defines the initial context, that is, the command area you will be working with (for example, wlan, interface, advfirewall).
• -r: Runs the command on another computer, using its computer name, FQDN, or IP address. Requires the Remote Registry service to be active; if it is not, you will see errors. "Network path not found".
• -or: allows launching netsh with the credentials of another user account, local or domain.
• -p | *: accompanies -u to enter the account password. With * forces you to be asked for the key securely without displaying it on the screen.
• -F: executes a netsh script (list of commands) and exits automatically upon completion.

When a string value contains spaces, it is mandatory. enclose it in double quotesFor example, to use a remote computer whose name includes spaces, you would do something like this: -r "equipo remoto oficina".

Netsh contexts, subcontexts, and built-in help

Netsh works as a kind of internal "mini console" where you switch between contexts and subcontexts depending on the network component you want to manage: interface, IPv4, IPv6, firewall, Wi-Fi, TCP, UDP, etc.

If you type only from CMD or PowerShell netsh and you press Enter, you will enter netsh interactive shellThere you will see a prompt similar to netsh>and from there you can change the context:

• Typing dhcpclient You will enter the DHCP client context.
• If you write interface, you jump to the context of network interfaces.
• From interface You can go to the subcontext ipv4 o ipv6, among others.

The text that appears before the symbol > tells you where you are at any given moment. For example, netsh interface ipv4> It makes it clear that you are in the IPv4 interface subcontext.

To see which contexts your system supports, you can use netsh ? o netsh helpAmong the typical list you'll find things like:

• advfirewall: Windows Firewall management with advanced security.
• wlan: everything related to Wi-Fi networks.
• interface: management of network interfaces and their subcontexts (ipv4, ipv6, tcp, udp…).
• branchcache, http, ipsec, ras, winsock, winhttp and many others.

Furthermore, each context has its own nested subcontextsFor example, within interface you have ipv4, ipv6, tcp, udp, portproxy, teredoetc., each with its own specific commands.

If you don't want to change locations, you can use the full path to the command . For example, from anywhere (even outside of netsh) you can run:

netsh interface ipv4 set address "NetLAN1" static <IP> <MASCARA> <PUERTA_DE_ENLACE>

This applies a static IP address to the "NetLAN1" interface without having to manually switch between contexts.

Legend and syntax of netsh commands

The netsh documentation uses a very clear convention to explain which parts of a command are literal and which you should replace with your own data.

• The text in Cursive usually points out information you need to change, such as usernames, files, or interfaces.
• The text in bold font It represents what you have to write exactly as is, without modification.
• When you see a parameter followed by ellipses (...) means that that parameter can be repeated several times along the same lines.
• Everything in brackets es Optional.
• The elements in brackets {} separated by | they imply that You can only choose one of the options, for example {enable|disable}.
• Text in monospace font (Courier type) represents command code or output.

Note that many parameters accept string values . If they contain spaces, remember to enclose them in double quotes, for example when configuring an interface called Wireless Network Connection :

netsh interface ipv4 set address name="Wireless Network Connection" dhcp

Instead of the interface name, you can also use its index number (useful when the name is in another language or is very long), for example:

netsh interface ipv4 set address name=15 dhcp

How to run netsh: CMD, PowerShell, and interactive mode

Netsh can be launched from both Windows PowerShell and the classic command prompt (CMD) , but the way you work with it changes slightly in each case.

To open it in administrator mode you can:

• Pulsar Windows + X and choose “Windows PowerShell (Administrator)” or “Command Prompt (Administrator)”.
• Or search “cmd" or "PowerShell"In the Start menu, right-click and run as administrator."

From either console you can write netsh To enter the netsh shell. There you will enter the commands one after the otherchanging context and using ? to see the options available at each point.

If you prefer not to enter interactive mode, in CMD it is very common to type the full command in one go and press Enter, for example netsh /? to see general help or something like netsh interface tcp show global to view global TCP parameters.

Using netsh with IPv4: IP, mask, gateway, and DNS

One of the most typical applications of netsh is to query and modify the IPv4 configuration of the interfaces : IP, subnet mask, gateway and DNS servers.

To display a summary of the current IPv4 configuration on all interfaces, you can use:

netsh interface ip show config

The exit is somewhat less exhaustive than ipconfig /allbut it offers All the important information at a glance: Current IP, mask, gateway and DNS configured.

If you want to change the IP address of a network interface to a static address, for example to optimize online gaming, you can use the classic IPv4 syntax:

netsh interface ip set address name="Ethernet" source=static addr=192.168.1.10 mask=255.255.255.0 gateway=192.168.1.1

This command sets the IP address 192.168.1.10, subnet mask /24, and gateway 192.168.1.1 for the "Ethernet" interface . If you later want the IP address to be reassigned via DHCP, you would simply run:

netsh interface ip set address name="Ethernet" source=dhcp

The same applies to DNS servers. To set a static DNS:

netsh interface ip set dnsserver "Ethernet" static 8.8.8.8 primary

And to return name resolution to DHCP:

netsh interface ip set dnsserver "Ethernet" dhcp

In IPv4 you will also have commands at hand to display IP statistics , the ARP table, or configured TCP connections:

• netsh interface ip show ipstats – IP protocol statistics.
• netsh interface ip show ipnet – associated IP and MAC addresses (triggers ARP requests on the network).
• netsh interface ip show tcpconn – summary of existing TCP connections.

Interface management: names, indexes, and state

Before changing anything, it's important to know what interfaces you have, their names, and their current state . Using netsh makes this very simple: to better understand the network connection flow, it will be helpful to list the interfaces before making any configuration changes.

To view the general list of network interfaces and their status (connected, disconnected, disabled):

netsh interface show interface

If you need the numeric indices of all IPv4 interfaces (useful when the name has spaces or accents):

netsh interface ip show interfaces

You also have commands to display the addresses and DNS configured by interface , for example:

• netsh interface ipv4 show address Wi-Fi
• netsh interface ipv4 show dns Wi-Fi
• netsh interface ipv4 show address Ethernet
• netsh interface ipv4 show dns Ethernet

When you are outside of any subcontext, you can use the full path, for example:

netsh interface ipv4 show interfaces

With that, you see it all at once. All IPv4 interfaces with their indexes, MTU, and statuswithout needing to jump to the context interface.

Wi-Fi Networks: Profiles, Keys, Drivers, and Capabilities

The wlan context encompasses virtually everything you can do with wireless networks from netsh: listing profiles, viewing saved passwords, checking drivers and capabilities, and generating reports . It also allows you, for example, to create a virtual Wi-Fi network using netsh.

To list all the Wi-Fi profiles that the system has saved:

netsh wlan show profiles

If you want to filter by a specific wireless interface, you can use:

netsh wlan show profiles interface="nombre_interfaz"

To view the Wi-Fi controller in detail (manufacturer, version, date, radio type, etc.):

netsh wlan show drivers

In recent systems you can also see the wireless capabilities supported by the adapter:

netsh wlan show wireless capabilities

If you want to see real-time data about the active Wi-Fi interface (connected SSID, channel, signal strength, link speed):

netsh wlan show interfaces

And if you have several, you can specify the name:

netsh wlan show interface name="Nombre_interfaz"

To list the wireless networks your adapter is currently seeing:

netsh wlan show networks

If you need much more detailed information about each BSSID (channel, power levels, supported speeds), you can add the BSSID mode:

netsh wlan show networks mode=bssid

A very common use is to retrieve the saved Wi-Fi password for a specific profile. To do this, you can run:

netsh wlan show profile name="NombrePerfil" key=clear

The password will appear in plain text in the security settings section of the output, so only use it on computers you control, because anyone with administrator access can see those passwords.

If you want a Wi-Fi network to stop automatically connecting when it's detected, you can change its connection mode:

netsh wlan set profileparameter name="Nombre de perfil" connectionmode=manual

And if you're interested in the exact opposite, that it connects automatically when it's within range:

netsh wlan set profileparameter name="Nombre de perfil" connectionmode=auto

To disconnect from the current Wi-Fi network via the console, you can do the following:

netsh wlan disconnect

And to connect to another network whose profile already exists on the computer, something like:

netsh wlan connect name="NombreDeTuSSID"

Export, import, and clean Wi-Fi profiles

When managing multiple devices, it can be very convenient to export the Wi-Fi profiles from one that is already properly configured, and then import them into others without having to manually enter keys.

To export all profiles to a specific folder, using the clear keys so they can be migrated without problems:

netsh wlan export profile key=clear folder="C:\perfileswifi"

This will generate one or more XML files in the specified path. Later, to import them onto another computer, simply:

netsh wlan add profile filename="C:\perfileswifi\perfil1.xml"

If you have old profiles for networks you no longer connect to, it's a good idea to clear them to avoid confusion and connection problems . To delete a specific profile:

netsh wlan delete profile name="Nombre de perfil"

If you want a complete HTML report on Wi-Fi connection history, errors, and adapter configuration, you can generate a report with:

netsh wlan show wlanreport

The command will tell you the path to an .html file with all the information; when you open it in the browser you will see a very detailed summary of connections, events and Wi-Fi statistics of the device.

Windows Firewall and netsh advfirewall

Another key component is advfirewall , which allows you to manage the Windows Firewall in an advanced way: view rules, create new ones, allow ports, block ICMP, reset settings, etc.; if you need practical guides for using Windows Defender Firewall as a reference, it will be helpful.

To list all configured firewall rules:

netsh advfirewall firewall show rule name=all

If you are only interested in the user's current profile (private, public, domain), with their active parameters:

netsh advfirewall show currentprofile

If you need to view or open specific ports, a commonly used command is:

netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

This creates an inbound rule to allow TCP traffic on port 80. To open the Remote Desktop port (3389), another classic example is:

netsh advfirewall firewall add rule name="Open Remote Desktop" protocol=TCP dir=in localport=3389 action=allow

If you want to delete a specific rule later, you can use:

netsh advfirewall firewall delete rule name="NombreDeLaRegla" protocol=udp localport=500

Many network audits require you to not respond to incoming ICMP ping requests. To allow incoming ICMPv4 ping requests, you can use:

netsh advfirewall firewall add rule name="All ICMP V4" dir=in action=allow protocol=icmpv4

And to block them, by changing the action:

netsh advfirewall firewall add rule name="All ICMP V4" dir=in action=block protocol=icmpv4

It is also possible to completely disable the firewall for all profiles (with great care):

netsh advfirewall set allprofiles state off

If you need to revert to factory settings because you've changed too much, you can reset all the rules:

netsh advfirewall reset

DNS, proxy, TCP/IP and network repair

Netsh is also very useful for tweaking advanced aspects of TCP/IP, Winsock, and proxy configuration , especially when you have issues that aren't fixed by simply restarting your adapter.

To review the WinHTTP proxy configuration used by the system:

netsh winhttp show proxy

If you need to configure a specific proxy for WinHTTP connections, you can do it like this:

netsh winhttp set proxy "servidorproxy.dominio.com:8484" "<local>"

Replace the host and port with those of your real server, and adapt the exclusion list for local addresses or domains that should not go through a proxy.

When things go wrong at the network stack level, many guides recommend resetting Winsock and TCP/IP . The two typical commands are:

• netsh winsock reset catalog – Resets the Winsock catalog.
• netsh int ip reset reset.log – resets the TCP/IP stack to default values ​​and saves a log in reset.log.

After running these commands, it is recommended to restart the computer so that all changes to the network stack are applied.

If you want to check the global TCP and UDP parameters configured on your machine, you can use:

• netsh interface tcp show global
• netsh interface udp show global

Some optimizations or advanced diagnostics involve changing these values. A typical example is Receive Side Scaling (RSS) , which distributes the network load across multiple processor cores.

To disable RSS:

netsh interface tcp set global rss=disabled

And to reactivate it:

netsh interface tcp set global rss=enabled

When working with multicast (videoconferencing, streaming, etc.), you can also check active multicast subscriptions on the interfaces with:

netsh interface ip show joins

Configure IP, DNS, and DHCP using netsh int ip

In addition to what has already been seen in IPv4, the int ip (interface IP) context allows you to make quick changes to addresses, DNS, and DHCP behavior.

A classic example for configuring static IP and gateway on a LAN interface would be:

netsh int ip set address "local area connection" static 192.168.29.101 255.255.255.0 192.168.29.254 1

netsh interface ip add dns name="Local Area Connection" addr=192.168.0.131

Remember that you must replace the IP addresses with those that correspond to your network (segment, gateway, own or external DNS).

If you're working with DHCP, you can also change an interface that's statically assigned to receive both IP and DNS via DHCP, for example in the case of Wi-Fi:

netsh interface ipv4 set address "Wi-Fi" dhcp

netsh interface ipv4 set dnsservers "Wi-Fi" dhcp

Dumping configuration, aliases, and usage in batch scripts

One of netsh's strengths is the ability to dump the network configuration to a text file , which you can then use as a backup or as a script to clone that configuration to other computers.

For example, you can create a folder C:\networks and dump the current configuration there with:

netsh dump >> C:\redes\configuracion.txt

If you ever need to restore that configuration, simply run:

netsh -f C:\redes\configuracion.txt

In addition to full dumps, you can prepare batch files (.bat or .cmd) with several netsh commands that run simultaneously. For example, a script that sets the IP address, primary and secondary DNS servers, and activates the firewall:

@echo off
echo Configurando red...
REM IP, máscara y puerta de enlace
netsh interface ip set address name="Ethernet" static 192.168.1.100 255.255.255.0 192.168.1.1
REM DNS principal
netsh interface ip set dns name="Ethernet" static 8.8.8.8
REM DNS secundario
netsh interface ip add dns name="Ethernet" 8.8.4.4 index=2
REM Activar firewall para todos los perfiles
netsh advfirewall set allprofiles state on
echo Configuración de red aplicada.
pause

Lines beginning with REM are comments and are not executed. To run the script, simply double-click or execute it from CMD/PowerShell with administrator privileges.

Another interesting feature is aliases , which allow you to abbreviate long commands. You can see all the defined aliases with:

netsh show alias

Netsh traffic capture, diagnostics, and limitations

When a network problem persists, sometimes there's no alternative but to capture packets for detailed analysis . Netsh integrates a trace system that generates ETL files for later analysis with tools like Microsoft Message Analyzer or Wireshark (after converting the format).

To initiate a general traffic capture:

netsh trace start capture=yes tracefile=C:\trace.etl persistent=yes maxsize=4096

And to stop it when you have enough information:

netsh trace stop

Although netsh is incredibly powerful, it also has its disadvantages and limitations in modern environments:

• Its syntax isn't particularly user-friendly; if you're not used to the console, it is easy to make mistakes typing.
• It has no graphical interface: everything is done by typing, so It's not very intuitive for novice users..
• Part of its functionality It is not designed for very modern networks (SDN, very advanced IPv6 configurations) and Microsoft is increasingly pushing towards PowerShell and specific cmdlets.
• Most actions require administrator privileges, so It is not a tool for standard users..

Even so, netsh remains one of the essential Swiss Army knives for anyone managing networks on Windows . With the commands you've seen, you can configure IP and DNS, manage Wi-Fi, open or close ports in the firewall, configure proxies, repair the TCP/IP stack, and even quickly and repeatedly capture traffic or complete configuration scripts when the graphical interface falls short or simply wastes your time.