IT Diagnostic Commands Reference for Windows and Mac - IT Troubleshooting Knowledge Base

Command-line diagnostic tools give you a fast, scriptable, and reliable way to investigate system and network issues without relying on GUI utilities that may not be available in all environments. This reference organises the most important diagnostic commands by category, with syntax examples and notes on what to look for in the output. Where Windows and Unix-based (macOS/Linux) commands differ, both variants are shown side by side.

Network Diagnostics

Network diagnostic commands help you verify connectivity, resolve DNS names, trace packet routes, and inspect active connections.

Ping — Test Basic Connectivity

Ping sends ICMP echo requests to a target host and measures the round-trip time. It confirms whether a host is reachable and whether there is packet loss.

ping google.com
ping -n 20 8.8.8.8
ping -t 192.168.1.1

ping google.com
ping -c 20 8.8.8.8
ping -i 0.5 192.168.1.1

Key flags:

-n <count> (Windows) / -c <count> (macOS/Linux): Send a specific number of packets
-t (Windows): Ping continuously until stopped with Ctrl+C
-i <interval> (Linux/macOS): Set interval between packets in seconds

What to look for: Request timed out indicates the host is unreachable or blocking ICMP. High latency or intermittent packet loss suggests a network path issue.

Tracert / Traceroute — Trace Packet Route

Tracert (Windows) and traceroute (macOS/Linux) show each hop a packet takes to reach its destination, helping you identify where in the network path a failure or delay is occurring.

tracert google.com
tracert -d 8.8.8.8

traceroute google.com
traceroute -n 8.8.8.8
# macOS alternative with TCP
tcptraceroute google.com 443

Key flags:

-d (Windows) / -n (Linux): Do not resolve IP addresses to hostnames (faster)
-h <max_hops> (Windows): Set maximum hop count (default 30)

What to look for: Asterisks (* * *) at a specific hop indicate packet loss at that hop. High latency at one hop that does not improve in subsequent hops often points to a congested or mis-configured router at that point.

IPConfig / IFConfig — IP Address and Network Adapter Information

ipconfig
ipconfig /all
ipconfig /flushdns
ipconfig /release
ipconfig /renew

ifconfig
ifconfig en0
networksetup -getinfo Wi-Fi

ip addr show
ip route show
nmcli device show

What to look for:

Check the assigned IP address, subnet mask, and default gateway
Look for 169.254.x.x (APIPA) addresses, which indicate DHCP has failed
Use ipconfig /flushdns to clear the local DNS cache when resolving stale DNS records

NSLookup — DNS Query Tool

NSLookup queries DNS servers to resolve names to IP addresses or look up specific DNS record types.

nslookup google.com
nslookup google.com 8.8.8.8
nslookup -type=MX company.com
nslookup -type=TXT company.com

dig google.com
dig @8.8.8.8 google.com A
dig company.com MX
dig +short google.com
dig +trace google.com

What to look for: Compare the result from your local DNS server against a public DNS server (e.g., 8.8.8.8) to determine if a DNS resolution issue is local or global. Use dig +trace to follow the full delegation chain from root servers.

Netstat — Active Connections and Listening Ports

Netstat displays active TCP/UDP connections, listening ports, and associated process IDs.

netstat -ano
netstat -b
netstat -an | findstr :443

netstat -tuln
netstat -anp tcp
ss -tulnp
# ss is the modern replacement for netstat on Linux
ss -anp | grep LISTEN

Key flags:

-a: Show all connections and listening ports
-n: Show addresses as numbers (no DNS lookup)
-o (Windows): Show owning process ID
-b (Windows): Show the executable involved in each connection
-p (Linux): Show the process using the socket

What to look for: Identify unexpected listening ports or connections to unknown remote addresses that could indicate a misconfiguration or malicious process.

Test-NetConnection / Curl — Port-Level Connectivity

Test-NetConnection -ComputerName mail.company.com -Port 443
Test-NetConnection -ComputerName 192.168.1.1 -Port 3389

nc -zv mail.company.com 443
nc -zv 192.168.1.1 3389
curl -v telnet://mail.company.com:25

What to look for: TcpTestSucceeded: True (Windows) or succeeded (nc) confirms the port is open and the service is listening. Failures indicate a firewall block, service not running, or wrong port.

Disk & Storage

CHKDSK — Check Disk for Errors

CHKDSK scans the file system and disk surface for errors and optionally repairs them.

chkdsk C:
chkdsk C: /f
chkdsk C: /r /x

diskutil verifyDisk /dev/disk0
diskutil repairDisk /dev/disk0

fsck -n /dev/sda1
fsck -y /dev/sda1

Key flags (Windows):

/f: Fix errors on the disk
/r: Locate bad sectors and recover readable information (includes /f)
/x: Force the volume to dismount first

Running chkdsk /r on a live system volume requires a reboot. The scan runs during the next startup and can take several hours on large drives.

SMART Status — Drive Health

Self-Monitoring, Analysis and Reporting Technology (SMART) data gives early warning of drive failures.

smartctl -a /dev/sda
smartctl -H /dev/sda

diskutil info /dev/disk0
smartctl -a /dev/disk0

smartctl -a /dev/sda
smartctl -t short /dev/sda
smartctl -l selftest /dev/sda

What to look for:

SMART overall-health self-assessment test result: PASSED — drive is healthy
FAILED! — replace the drive immediately and recover data
Attributes with high RAW_VALUE on: Reallocated_Sector_Ct, Pending_Sector_Count, Uncorrectable_Sector_Count

DF / DU — Disk Free Space and Usage

wmic logicaldisk get size,freespace,caption
dir C:\ /-c

df -h
du -sh /var/log/*
du -h --max-depth=1 /home

Key flags (Unix):

df -h: Show disk free space in human-readable format
du -sh <path>: Show total size of a directory
--max-depth=1 / -d 1: Limit depth to one level

System Information

systeminfo
systeminfo | findstr /i "OS Name\|OS Version\|System Boot Time\|Total Physical Memory"
wmic os get Caption,Version,BuildNumber
wmic bios get serialnumber
wmic computersystem get manufacturer,model

system_profiler SPSoftwareDataType
system_profiler SPHardwareDataType
sw_vers
sysctl -n hw.memsize

uname -a
hostnamectl
lsb_release -a
dmidecode -t system
free -h
lscpu

Windows-Specific Commands

SFC — System File Checker

Scans protected Windows system files for corruption and replaces damaged files.

sfc /scannow
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows

Results are logged to %windir%\Logs\CBS\CBS.log. Look for lines containing [SR] for System File Checker activity. If SFC reports it cannot fix certain files, run DISM first.

DISM — Deployment Image Servicing and Management

DISM repairs the Windows Component Store, which SFC depends on. Run DISM before SFC when SFC fails to repair files.

DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth

Sequence to run when dealing with system file corruption:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

Windows Event Log Queries

# View the last 20 System errors
Get-EventLog -LogName System -EntryType Error -Newest 20

# View Application event log for crashes
Get-EventLog -LogName Application -Source "Application Error" -Newest 10

# Query with wevtutil (faster for large logs)
wevtutil qe System /c:20 /rd:true /f:text /q:"*[System[Level=2]]"

GPResult — Group Policy Results

gpresult /r
gpresult /h C:\Temp\gpresult.html
gpresult /scope computer /v
gpresult /scope user /v

Use /h to generate an HTML report, which is the most readable format for reviewing applied policies. Open the resulting file in a browser.

Msinfo32 — System Information GUI

msinfo32
msinfo32 /report C:\Temp\sysinfo.txt

msinfo32 provides a comprehensive snapshot of hardware, software, and system configuration, including installed drivers, running services, and IRQ/port assignments.

macOS-Specific Commands

# Show running processes
top
htop                  # if installed via Homebrew

# List all open files and network connections
lsof -i               # network connections
lsof -n | grep LISTEN # listening ports only

# System logs
log show --predicate 'eventMessage contains "error"' --last 1h
log stream            # live log stream

# Manage launch daemons and agents (equivalent of services)
launchctl list
launchctl stop com.apple.mDNSResponder
launchctl start com.apple.mDNSResponder

# Flush DNS cache
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# Network configuration
networksetup -listallhardwareports
networksetup -getinfo Wi-Fi

# File system check (macOS Catalina and later — APFS)
diskutil apfs listSnapshots /

Linux-Specific Commands

# Service management (systemd)
systemctl status nginx
systemctl start nginx
systemctl stop nginx
systemctl restart nginx
systemctl enable nginx   # start at boot
systemctl disable nginx

# View service logs
journalctl -u nginx -f          # follow logs for a service
journalctl -u nginx --since "1 hour ago"
journalctl -p err -b            # errors since last boot

# Process management
top
htop                            # interactive process viewer
ps aux | grep nginx             # find processes by name
kill -9 <PID>                   # force kill a process

# Memory usage
free -h
cat /proc/meminfo

# Open files and sockets
lsof -i :80                     # processes using port 80
lsof -u username                # files opened by a user

# Package management
# Debian/Ubuntu
apt list --installed
apt-get update && apt-get upgrade
# Red Hat/CentOS/Fedora
rpm -qa | grep nginx
yum update
dnf upgrade

# Network interfaces
ip addr show
ip link show
ip route show
ethtool eth0                    # physical interface details and speed

On Linux systems running systemd, journalctl is the primary log tool. Use journalctl -b -1 to view logs from the previous boot — particularly useful when investigating a system that crashed and was rebooted.

​Network Diagnostics

​Ping — Test Basic Connectivity

​Tracert / Traceroute — Trace Packet Route

​IPConfig / IFConfig — IP Address and Network Adapter Information

​NSLookup — DNS Query Tool

​Netstat — Active Connections and Listening Ports

​Test-NetConnection / Curl — Port-Level Connectivity

​Disk & Storage

​CHKDSK — Check Disk for Errors

​SMART Status — Drive Health

​DF / DU — Disk Free Space and Usage

​System Information

​Windows-Specific Commands

​SFC — System File Checker

​DISM — Deployment Image Servicing and Management

​Windows Event Log Queries

​GPResult — Group Policy Results

​Msinfo32 — System Information GUI

​macOS-Specific Commands

​Linux-Specific Commands

Network Diagnostics

Ping — Test Basic Connectivity

Tracert / Traceroute — Trace Packet Route

IPConfig / IFConfig — IP Address and Network Adapter Information

NSLookup — DNS Query Tool

Netstat — Active Connections and Listening Ports

Test-NetConnection / Curl — Port-Level Connectivity

Disk & Storage

CHKDSK — Check Disk for Errors

SMART Status — Drive Health

DF / DU — Disk Free Space and Usage

System Information

Windows-Specific Commands

SFC — System File Checker

DISM — Deployment Image Servicing and Management

Windows Event Log Queries

GPResult — Group Policy Results

Msinfo32 — System Information GUI

macOS-Specific Commands

Linux-Specific Commands