When a server cannot reach a resource — or something cannot reach the server — diagnosing the network problem quickly requires knowing which tools to use and what to look for. Here is how to check network connectivity from a Windows Server using both Command Prompt and PowerShell.
Ping — Basic Connectivity Test
The first test to run — confirms whether the server can reach an IP address or hostname:
ping 8.8.8.8
ping google.com
ping SERVERNAMEIf the IP responds but the hostname does not, the problem is DNS. If neither responds, there may be a firewall blocking ICMP, or genuine network unreachability. Note that some hosts block ping — a non-response does not always mean a host is down.
# Continuous ping (useful for monitoring during a network change)
ping -t 8.8.8.8
# Ping with a specific count and timeout
ping -n 10 -w 1000 192.168.1.1Test-NetConnection — PowerShell’s Better Ping
Test-NetConnection is more useful than ping — it tests specific TCP ports and provides more diagnostic output:
# Basic connectivity test (ICMP ping equivalent)
Test-NetConnection -ComputerName google.com
# Test a specific port (e.g. HTTPS port 443)
Test-NetConnection -ComputerName google.com -Port 443
# Test RDP port on another server
Test-NetConnection -ComputerName SERVERNAME -Port 3389
# Test SQL Server port
Test-NetConnection -ComputerName DBSERVER -Port 1433TcpTestSucceeded: True confirms the port is open and reachable. False means either the port is closed, the service is not listening, or a firewall is blocking it.
Tracert — Find Where the Connection Fails
Traceroute maps each hop between the server and a destination, showing where a connection times out:
tracert google.com
tracert 8.8.8.8Each line shows a router hop. Timeouts (shown as * * *) at early hops indicate a local network or gateway issue. Timeouts only at the final destination often mean the target is blocking ICMP. A consistent timeout partway through indicates a routing or ISP issue.
nslookup — DNS Troubleshooting
# Resolve a hostname
nslookup google.com
# Query a specific DNS server
nslookup google.com 8.8.8.8
# Look up a hostname in internal DNS
nslookup SERVERNAME
If nslookup returns an IP but the server cannot connect, the issue is routing or firewalling, not DNS. If nslookup fails, the DNS server is unreachable or the record does not exist.
ipconfig — Check Network Configuration
# Show IP, subnet, and gateway for all adapters
ipconfig
# Show full details including DNS servers and lease info
ipconfig /all
# Flush DNS cache (if experiencing DNS resolution issues)
ipconfig /flushdns
Check that the server has the correct IP, subnet mask, default gateway, and DNS server addresses. A missing default gateway means the server cannot route traffic outside its subnet.
netstat — Check Listening Ports and Active Connections
# Show all active connections and listening ports
netstat -an
# Show connections with process ID
netstat -anob
# Show only listening ports
netstat -an | findstr LISTENING
# Show network interface statistics
netstat -eUse netstat to confirm that a service is actually listening on the expected port. If a web server should be on port 80 but netstat does not show 0.0.0.0:80 in LISTENING state, the service has not started or is bound to a different port.
Get-NetAdapter — Check NIC Status in PowerShell
# List all network adapters and their status
Get-NetAdapter | Select-Object Name, Status, LinkSpeed, MacAddress
# Show detailed IP configuration
Get-NetIPConfiguration
# Show IP addresses
Get-NetIPAddress | Where-Object {$_.AddressFamily -eq 'IPv4'}An adapter with Status “Up” and a LinkSpeed value is connected. “Disconnected” means no physical link — check the cable and switch port LED.
Checking the Windows Firewall
If connectivity tests fail only to or from specific ports, the Windows Firewall may be blocking them:
# List all enabled inbound firewall rules
Get-NetFirewallRule | Where-Object {$_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound'} | Select-Object DisplayName, Action
# Test if a specific port is blocked locally
Test-NetConnection -ComputerName localhost -Port 80Open Windows Defender Firewall with Advanced Security (wf.msc) to view and manage rules graphically.
