> ## Documentation Index
> Fetch the complete documentation index at: https://docs.derekdinh.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IT Diagnostic Commands Reference for Windows and Mac

> Essential IT diagnostic commands for network troubleshooting, disk health, system info, and OS-specific tools on Windows, macOS, and Linux.

Command-line diagnostic tools give you a fast, scriptable, and reliable way to investigate system and network issues without relying on GUI utilities that may not be available in all environments. This reference organises the most important diagnostic commands by category, with syntax examples and notes on what to look for in the output. Where Windows and Unix-based (macOS/Linux) commands differ, both variants are shown side by side.

## Network Diagnostics

Network diagnostic commands help you verify connectivity, resolve DNS names, trace packet routes, and inspect active connections.

### Ping — Test Basic Connectivity

Ping sends ICMP echo requests to a target host and measures the round-trip time. It confirms whether a host is reachable and whether there is packet loss.

<CodeGroup>
  ```cmd Windows theme={null}
  ping google.com
  ping -n 20 8.8.8.8
  ping -t 192.168.1.1
  ```

  ```bash macOS / Linux theme={null}
  ping google.com
  ping -c 20 8.8.8.8
  ping -i 0.5 192.168.1.1
  ```
</CodeGroup>

**Key flags:**

* `-n <count>` (Windows) / `-c <count>` (macOS/Linux): Send a specific number of packets
* `-t` (Windows): Ping continuously until stopped with `Ctrl+C`
* `-i <interval>` (Linux/macOS): Set interval between packets in seconds

**What to look for:** `Request timed out` indicates the host is unreachable or blocking ICMP. High latency or intermittent packet loss suggests a network path issue.

***

### Tracert / Traceroute — Trace Packet Route

Tracert (Windows) and traceroute (macOS/Linux) show each hop a packet takes to reach its destination, helping you identify where in the network path a failure or delay is occurring.

<CodeGroup>
  ```cmd Windows theme={null}
  tracert google.com
  tracert -d 8.8.8.8
  ```

  ```bash macOS / Linux theme={null}
  traceroute google.com
  traceroute -n 8.8.8.8
  # macOS alternative with TCP
  tcptraceroute google.com 443
  ```
</CodeGroup>

**Key flags:**

* `-d` (Windows) / `-n` (Linux): Do not resolve IP addresses to hostnames (faster)
* `-h <max_hops>` (Windows): Set maximum hop count (default 30)

**What to look for:** Asterisks (`* * *`) at a specific hop indicate packet loss at that hop. High latency at one hop that does not improve in subsequent hops often points to a congested or mis-configured router at that point.

***

### IPConfig / IFConfig — IP Address and Network Adapter Information

<CodeGroup>
  ```cmd Windows theme={null}
  ipconfig
  ipconfig /all
  ipconfig /flushdns
  ipconfig /release
  ipconfig /renew
  ```

  ```bash macOS theme={null}
  ifconfig
  ifconfig en0
  networksetup -getinfo Wi-Fi
  ```

  ```bash Linux theme={null}
  ip addr show
  ip route show
  nmcli device show
  ```
</CodeGroup>

**What to look for:**

* Check the assigned IP address, subnet mask, and default gateway
* Look for `169.254.x.x` (APIPA) addresses, which indicate DHCP has failed
* Use `ipconfig /flushdns` to clear the local DNS cache when resolving stale DNS records

***

### NSLookup — DNS Query Tool

NSLookup queries DNS servers to resolve names to IP addresses or look up specific DNS record types.

<CodeGroup>
  ```cmd Windows / macOS / Linux theme={null}
  nslookup google.com
  nslookup google.com 8.8.8.8
  nslookup -type=MX company.com
  nslookup -type=TXT company.com
  ```

  ```bash Linux (dig — more powerful alternative) theme={null}
  dig google.com
  dig @8.8.8.8 google.com A
  dig company.com MX
  dig +short google.com
  dig +trace google.com
  ```
</CodeGroup>

**What to look for:** Compare the result from your local DNS server against a public DNS server (e.g., `8.8.8.8`) to determine if a DNS resolution issue is local or global. Use `dig +trace` to follow the full delegation chain from root servers.

***

### Netstat — Active Connections and Listening Ports

Netstat displays active TCP/UDP connections, listening ports, and associated process IDs.

<CodeGroup>
  ```cmd Windows theme={null}
  netstat -ano
  netstat -b
  netstat -an | findstr :443
  ```

  ```bash macOS / Linux theme={null}
  netstat -tuln
  netstat -anp tcp
  ss -tulnp
  # ss is the modern replacement for netstat on Linux
  ss -anp | grep LISTEN
  ```
</CodeGroup>

**Key flags:**

* `-a`: Show all connections and listening ports
* `-n`: Show addresses as numbers (no DNS lookup)
* `-o` (Windows): Show owning process ID
* `-b` (Windows): Show the executable involved in each connection
* `-p` (Linux): Show the process using the socket

**What to look for:** Identify unexpected listening ports or connections to unknown remote addresses that could indicate a misconfiguration or malicious process.

***

### Test-NetConnection / Curl — Port-Level Connectivity

<CodeGroup>
  ```powershell Windows (PowerShell) theme={null}
  Test-NetConnection -ComputerName mail.company.com -Port 443
  Test-NetConnection -ComputerName 192.168.1.1 -Port 3389
  ```

  ```bash macOS / Linux theme={null}
  nc -zv mail.company.com 443
  nc -zv 192.168.1.1 3389
  curl -v telnet://mail.company.com:25
  ```
</CodeGroup>

**What to look for:** `TcpTestSucceeded: True` (Windows) or `succeeded` (nc) confirms the port is open and the service is listening. Failures indicate a firewall block, service not running, or wrong port.

***

## Disk & Storage

### CHKDSK — Check Disk for Errors

CHKDSK scans the file system and disk surface for errors and optionally repairs them.

<CodeGroup>
  ```cmd Windows theme={null}
  chkdsk C:
  chkdsk C: /f
  chkdsk C: /r /x
  ```

  ```bash macOS theme={null}
  diskutil verifyDisk /dev/disk0
  diskutil repairDisk /dev/disk0
  ```

  ```bash Linux theme={null}
  fsck -n /dev/sda1
  fsck -y /dev/sda1
  ```
</CodeGroup>

**Key flags (Windows):**

* `/f`: Fix errors on the disk
* `/r`: Locate bad sectors and recover readable information (includes `/f`)
* `/x`: Force the volume to dismount first

<Warning>
  Running `chkdsk /r` on a live system volume requires a reboot. The scan runs during the next startup and can take several hours on large drives.
</Warning>

***

### SMART Status — Drive Health

Self-Monitoring, Analysis and Reporting Technology (SMART) data gives early warning of drive failures.

<CodeGroup>
  ```powershell Windows (smartctl via smartmontools) theme={null}
  smartctl -a /dev/sda
  smartctl -H /dev/sda
  ```

  ```bash macOS theme={null}
  diskutil info /dev/disk0
  smartctl -a /dev/disk0
  ```

  ```bash Linux theme={null}
  smartctl -a /dev/sda
  smartctl -t short /dev/sda
  smartctl -l selftest /dev/sda
  ```
</CodeGroup>

**What to look for:**

* `SMART overall-health self-assessment test result: PASSED` — drive is healthy
* `FAILED!` — replace the drive immediately and recover data
* Attributes with high `RAW_VALUE` on: `Reallocated_Sector_Ct`, `Pending_Sector_Count`, `Uncorrectable_Sector_Count`

***

### DF / DU — Disk Free Space and Usage

<CodeGroup>
  ```cmd Windows theme={null}
  wmic logicaldisk get size,freespace,caption
  dir C:\ /-c
  ```

  ```bash macOS / Linux theme={null}
  df -h
  du -sh /var/log/*
  du -h --max-depth=1 /home
  ```
</CodeGroup>

**Key flags (Unix):**

* `df -h`: Show disk free space in human-readable format
* `du -sh <path>`: Show total size of a directory
* `--max-depth=1` / `-d 1`: Limit depth to one level

***

## System Information

<CodeGroup>
  ```cmd Windows theme={null}
  systeminfo
  systeminfo | findstr /i "OS Name\|OS Version\|System Boot Time\|Total Physical Memory"
  wmic os get Caption,Version,BuildNumber
  wmic bios get serialnumber
  wmic computersystem get manufacturer,model
  ```

  ```bash macOS theme={null}
  system_profiler SPSoftwareDataType
  system_profiler SPHardwareDataType
  sw_vers
  sysctl -n hw.memsize
  ```

  ```bash Linux theme={null}
  uname -a
  hostnamectl
  lsb_release -a
  dmidecode -t system
  free -h
  lscpu
  ```
</CodeGroup>

***

## Windows-Specific Commands

### SFC — System File Checker

Scans protected Windows system files for corruption and replaces damaged files.

```cmd theme={null}
sfc /scannow
sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows
```

Results are logged to `%windir%\Logs\CBS\CBS.log`. Look for lines containing `[SR]` for System File Checker activity. If SFC reports it cannot fix certain files, run DISM first.

***

### DISM — Deployment Image Servicing and Management

DISM repairs the Windows Component Store, which SFC depends on. Run DISM before SFC when SFC fails to repair files.

```cmd theme={null}
DISM /Online /Cleanup-Image /CheckHealth
DISM /Online /Cleanup-Image /ScanHealth
DISM /Online /Cleanup-Image /RestoreHealth
```

**Sequence to run when dealing with system file corruption:**

```cmd theme={null}
DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow
```

***

### Windows Event Log Queries

```powershell theme={null}
# View the last 20 System errors
Get-EventLog -LogName System -EntryType Error -Newest 20

# View Application event log for crashes
Get-EventLog -LogName Application -Source "Application Error" -Newest 10

# Query with wevtutil (faster for large logs)
wevtutil qe System /c:20 /rd:true /f:text /q:"*[System[Level=2]]"
```

***

### GPResult — Group Policy Results

```cmd theme={null}
gpresult /r
gpresult /h C:\Temp\gpresult.html
gpresult /scope computer /v
gpresult /scope user /v
```

Use `/h` to generate an HTML report, which is the most readable format for reviewing applied policies. Open the resulting file in a browser.

***

### Msinfo32 — System Information GUI

```cmd theme={null}
msinfo32
msinfo32 /report C:\Temp\sysinfo.txt
```

`msinfo32` provides a comprehensive snapshot of hardware, software, and system configuration, including installed drivers, running services, and IRQ/port assignments.

***

## macOS-Specific Commands

```bash theme={null}
# Show running processes
top
htop                  # if installed via Homebrew

# List all open files and network connections
lsof -i               # network connections
lsof -n | grep LISTEN # listening ports only

# System logs
log show --predicate 'eventMessage contains "error"' --last 1h
log stream            # live log stream

# Manage launch daemons and agents (equivalent of services)
launchctl list
launchctl stop com.apple.mDNSResponder
launchctl start com.apple.mDNSResponder

# Flush DNS cache
sudo dscacheutil -flushcache
sudo killall -HUP mDNSResponder

# Network configuration
networksetup -listallhardwareports
networksetup -getinfo Wi-Fi

# File system check (macOS Catalina and later — APFS)
diskutil apfs listSnapshots /
```

***

## Linux-Specific Commands

```bash theme={null}
# Service management (systemd)
systemctl status nginx
systemctl start nginx
systemctl stop nginx
systemctl restart nginx
systemctl enable nginx   # start at boot
systemctl disable nginx

# View service logs
journalctl -u nginx -f          # follow logs for a service
journalctl -u nginx --since "1 hour ago"
journalctl -p err -b            # errors since last boot

# Process management
top
htop                            # interactive process viewer
ps aux | grep nginx             # find processes by name
kill -9 <PID>                   # force kill a process

# Memory usage
free -h
cat /proc/meminfo

# Open files and sockets
lsof -i :80                     # processes using port 80
lsof -u username                # files opened by a user

# Package management
# Debian/Ubuntu
apt list --installed
apt-get update && apt-get upgrade
# Red Hat/CentOS/Fedora
rpm -qa | grep nginx
yum update
dnf upgrade

# Network interfaces
ip addr show
ip link show
ip route show
ethtool eth0                    # physical interface details and speed
```

<Tip>
  On Linux systems running `systemd`, `journalctl` is the primary log tool. Use `journalctl -b -1` to view logs from the previous boot — particularly useful when investigating a system that crashed and was rebooted.
</Tip>