When a network stops working, you don't guess — you run commands and read the output. These six tools are the core of Windows network troubleshooting, and all of them appear on the CompTIA A+ exam. Learning them in order is the fastest way to build a real diagnostic workflow.
Don't just read — open a Command Prompt and run each command as you go. The output will look exactly like the exam scenarios. Type cmd in the Windows search bar to open it.
ipconfig — Check Your IP Configuration
ipconfig shows your computer's current IP address, subnet mask, and default gateway. It's almost always the first command you run when diagnosing a network problem — it tells you immediately whether you have a valid IP address or an APIPA address (169.254.x.x).
C:\>ipconfig /all— full details including DNS and MAC address
C:\>ipconfig /release— release current DHCP lease
C:\>ipconfig /renew— request a new IP from DHCP
C:\>ipconfig /flushdns— clear the local DNS cache
Connection-specific DNS Suffix:
IPv4 Address. . . . . . : 192.168.1.25
Subnet Mask . . . . . . : 255.255.255.0
Default Gateway . . . . : 192.168.1.1
ping — Test Connectivity
ping sends test packets to a destination and measures the response. It tells you whether a device is reachable and how long packets take to get there. The sequence matters — ping loopback first, then your own IP, then the gateway, then an external IP, then a domain name. Each step isolates a different layer of the problem.
C:\>ping 192.168.1.25— your own IP: confirms TCP/IP stack
C:\>ping 192.168.1.1— default gateway: tests local routing
C:\>ping 8.8.8.8— external IP: tests internet (bypasses DNS)
C:\>ping google.com— domain name: tests DNS resolution
Reply from 8.8.8.8: bytes=32 time=14ms TTL=117
Reply from 8.8.8.8: bytes=32 time=13ms TTL=117
Ping statistics for 8.8.8.8:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)
ping 8.8.8.8 works → ping google.com fails = DNS problem.
If an IP address works but a domain name doesn't, the internet connection is fine — DNS resolution is broken. Fix: try ipconfig /flushdns or change the DNS server to 8.8.8.8.
tracert — Trace the Route
tracert (Trace Route) shows every hop a packet takes on its way to a destination. Where ping just tells you if something is reachable, tracert tells you where along the path things are breaking down. Each line is one router the packet passed through, with response times.
C:\>tracert 8.8.8.8
1 1ms 1ms 1ms 192.168.1.1 (your router)
2 8ms 9ms 8ms 10.0.0.1 (ISP hop)
3 12ms 11ms 13ms 72.14.232.1
4 14ms 13ms 14ms 142.250.72.14 (destination)
nslookup — Query DNS
nslookup (Name Server Lookup) queries DNS servers directly and shows what IP address a domain resolves to. It's the go-to tool when you suspect a DNS problem — you can query your default DNS server or specify a different one to compare results.
C:\>nslookup google.com 8.8.8.8— query a specific DNS server
Address: 8.8.8.8
Non-authoritative answer:
Name: google.com
Addresses: 142.250.72.14
netstat — View Active Connections
netstat (Network Statistics) shows all active TCP connections and listening ports on your machine. It's useful for seeing what your computer is currently connected to, identifying unusual connections, and confirming which ports are open.
C:\>netstat -a— all connections and listening ports
C:\>netstat -n— show IP addresses instead of hostnames
C:\>netstat -b— show which program owns each connection
TCP 192.168.1.25:443 142.250.72.14:443 ESTABLISHED
TCP 192.168.1.25:80 151.101.1.140:80 ESTABLISHED
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING
nbtstat — NetBIOS Name Resolution
nbtstat displays NetBIOS over TCP/IP statistics and name tables. It's used in Windows environments to troubleshoot name resolution issues when devices can't find each other by computer name on a local network. Less common than the others but it does appear on the A+ exam.
C:\>nbtstat -c— NetBIOS name cache
C:\>nbtstat -R— reload the LMHOSTS file / purge cache
The Diagnostic Workflow — What Order to Run Them
On the exam (and in real life), commands are most useful when run in a logical order. Each step confirms one layer is working before moving to the next:
Linux & macOS Network Commands
The Network+ and Security+ exams test Linux and macOS equivalents alongside Windows commands. In enterprise environments, servers and network devices almost always run Linux — knowing these commands is essential for both certifications and real-world IT work.
ip — The Modern Linux Network Tool
The ip command is the current standard on Linux, replacing the older ifconfig. It controls IP addresses, routes, and interfaces.
ifconfig — Legacy Linux/macOS (still on many systems)
dig — DNS Lookup (Linux/macOS)
dig (Domain Information Groper) is the Linux/macOS equivalent of nslookup — and much more powerful. Security+ tests it for DNS reconnaissance and troubleshooting.
ss — Socket Statistics (replaces netstat on Linux)
ss is faster than netstat and shows the same connection and port information. It's the current standard on modern Linux distributions.
Windows vs Linux Command Equivalents
| Task | Windows | Linux / macOS |
|---|---|---|
| Show IP address | ipconfig | ip addr show / ifconfig |
| Flush DNS cache | ipconfig /flushdns | sudo systemd-resolve --flush-caches / sudo dscacheutil -flushcache (macOS) |
| Test connectivity | ping | ping (runs until Ctrl+C by default) |
| Trace route | tracert | traceroute |
| DNS query | nslookup | dig / nslookup |
| View open ports | netstat -a | ss -tuln / netstat -tuln |
| View routing table | route print | ip route show / netstat -r |
| View ARP cache | arp -a | ip neigh show / arp -n |
| Show MAC address | ipconfig /all | ip link show / ifconfig |
| Test HTTP | curl (modern) / browser | curl / wget |
arp — View and Manage the ARP Cache
The ARP (Address Resolution Protocol) cache maps IP addresses to MAC addresses on the local network. The arp command lets you view, add, and delete these entries. It's tested on both Network+ and Security+ — particularly in the context of ARP spoofing attacks.
arp -a and see two different IP addresses mapped to the same MAC address, that's a strong indicator of ARP spoofing in progress.
route — View and Modify the Routing Table
The routing table determines where a device sends packets destined for different networks. The route command is used on both Windows and Linux to display and modify it.
curl and wget — Test HTTP/S Connectivity
While ping tests ICMP reachability, curl and wget test actual application-layer (HTTP/S) connectivity. They're used in Network+ and Security+ troubleshooting scenarios for web service verification, certificate checking, and API testing.
tcpdump — Packet Capture (Security+ / Network+)
tcpdump is a command-line packet analyser for Linux and macOS. It captures live network traffic for analysis — the CLI equivalent of Wireshark. It's a core Security+ tool for network forensics and incident response, and appears directly in Network+ troubleshooting scenarios.
.pcap format. In incident response scenarios, a packet capture is considered volatile evidence — it should be collected early. Wireshark is the GUI version; tcpdump is the CLI version. Both analyse the same .pcap files.
nmap — Network Scanner (Security+ / Network+)
nmap (Network Mapper) scans networks to discover hosts and open ports. It's a fundamental tool for both network administration and security assessments — and one of the most commonly referenced tools on the Security+ exam.
-sS) is called a "stealth scan" because it never completes the three-way handshake, making it harder to detect in logs. Always get written authorisation before scanning networks you don't own.
Network+ and Security+ Exam Scenarios
ss -tulnp — the -p flag adds process name and PID to the output. On older systems, netstat -tulnp does the same. On Windows, use netstat -ano and cross-reference the PID in Task Manager.arp -a and sees that two different IPs both resolve to the same MAC address. What does this indicate?traceroute google.com on Linux and see asterisks (***) starting at hop 3. What does this mean?nmap -sn 10.10.10.0/24 — the ping scan discovers live hosts using ICMP echo requests and TCP probes without scanning any ports, minimising noise in IDS logs.Quick Reference Cheat Sheet
Key Takeaways
ip addr, ss, and dig — the modern replacements for ifconfig, netstat, and nslookupReady to practice these commands?
Set up a free VM lab on your laptop and run every command in a real Windows environment.
Related Articles
Preparing for A+, Network+, or Security+?
See the books and practice exams that make the most difference.