AJapps

Command Output Explainer — ipconfig, ping, route, netstat, w32tm

Paste the output of a Windows network or time command and get it explained line by line in plain language: what it shows, what is wrong, and what to do next. Written for SCADA and commissioning engineers who are asked to “send the ipconfig” and want to understand it first.

Paste the output

Examples and how to run each command

  • ipconfig /all

    Every network adapter with its IP address, mask, gateway, DNS, DHCP and link state.

  • route print -4

    The IPv4 routing table: which adapter and gateway Windows uses for each destination.

  • arp -a

    The IP-to-MAC table: which devices on the local subnets have answered recently.

  • ping -n 10 <address>

    Whether a device answers ICMP echo, with loss and round-trip time.

  • tracert -d <address>

    The routers (hops) on the path to a device and where the path stops.

  • netstat -ano

    TCP and UDP connections and listening ports, with the owning process ID.

  • w32tm /query /status

    The Windows time service: synchronisation source, stratum, last sync and accuracy estimate.

  • w32tm /stripchart /computer:<time server> /samples:10 /dataonly

    Measured offset between this computer and a time server.

  • nslookup <name>

    Whether a name resolves through DNS, and which DNS server answered.

Run them in Command Prompt (Win+R, cmd). To copy the output, select it with the mouse and press Enter, or add | clip to the command.

ipconfig /all
Network adapters

3 adapter(s), 3 connected with an IPv4 address on ENG-LAPTOP-07.

What it says

  • ProblemEthernet: gateway 10.13.1.1 is outside the adapter's subnet (10.13.0.200/24). Windows cannot reach it, so traffic to other subnets fails.
  • ProblemEthernet 2: 169.254.31.7 is a link-local (169.254.x.x) address. The adapter is set to obtain an address automatically and no DHCP server answered. On a substation network set a static IP address in the IED's subnet.
  • Check2 connected adapters have a default gateway (Ethernet → 10.13.1.1; Wi-Fi → 192.168.20.1). Windows sends traffic for unknown destinations through only one of them (lowest metric), so devices behind the other gateway may be unreachable. On an engineering laptop, normally only the corporate or internet adapter has a gateway; the substation adapter has none, or a specific route is added.
  • NoteWi-Fi is connected at the same time as a wired adapter. If both reach networks with overlapping addresses, traffic can leave through the wrong one; disable Wi-Fi while testing.

Key values

Host nameENG-LAPTOP-07

As read from the output

AdapterLinkIPv4 addressMaskGatewayAddressing
Ethernet (Ethernet)connected10.13.0.200255.255.255.010.13.1.1static
Ethernet 2 (Ethernet)connected169.254.31.7 (link-local)255.255.0.0—DHCP
Wi-Fi (Wireless LAN)connected192.168.20.45255.255.255.0192.168.20.1DHCP

Next steps

  • Check the IED is in the same subnet as the adapter you use (SCADA Connectivity Assistant).
  • Run route print to see which adapter Windows uses for the IED's address.
  • Run arp -a after a ping to see whether the IED answered at the Ethernet level.
Tool guide · know before you use

What this tool is, how it works and how far to trust it

An explainer for the output of the Windows network and time commands that support teams ask for: it reads the text you paste and explains it in plain language, with the problems it shows.

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

  • Recognise ipconfig /all, route print, arp -a, ping, tracert, netstat -ano, w32tm /query /status, w32tm /stripchart and nslookup automatically.
  • Flag duplicate and link-local addresses, gateways outside the subnet, several default gateways, VPN and Wi-Fi conflicts and overlapping adapters.
  • Show which route Windows uses for an address, what 'Destination host unreachable' and time-outs really mean, blocked ports (SYN_SENT), connection leaks and exposed services.
  • Judge the Windows time service: unsynchronised, local clock, host time provider, dispersion and measured offset.

Why you need it

  • These outputs contain the answer to most site communication problems, but they are hard to read without network experience.
  • Understanding them yourself turns 'please help' into 'the laptop has two default gateways' — fixed in minutes, or escalated precisely.

Understand this first

  • Each command shows one layer: ipconfig the adapter settings, route print the routing decision, arp the Ethernet neighbours, ping and tracert IP reachability, netstat the connections, w32tm the clock.
  • A message 'Reply from' your own address is not a reply from the target.
  • Command outputs are snapshots; repeat them while the problem is happening.

What you need before you start

  • The output of the command, copied from Command Prompt (select and press Enter, or add | clip to the command). English-language Windows output is recognised.
  • For route print: the address you want to reach.
  • A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

  • Run the command (the list on the page shows each one and what it is for) and paste the output.
  • Leave 'Detect automatically' or choose the command if it is not recognised.
  • Read 'What it says' first, then the values and the table read from the output.
  • Follow the next steps; paste the next command's output to continue.

What you get

  • A summary, findings marked Problem, Check, Note or OK, the key values and a table of what was read, and suggested next steps.

How to read the results

  • Problems explain a failure on their own (a duplicate address, a gateway outside the subnet, an unsynchronised clock); fix them first.
  • Checks are conditions that often cause problems (two default gateways, VPN connected); confirm whether they apply to your case.

Technical basis

  • IPv4 addressing and routing (RFC 791, 950, 1122): longest-prefix match, then lowest metric.
  • ICMP messages (RFC 792), ARP (RFC 826), link-local addresses (RFC 3927), TCP states (RFC 9293), NTP as used by the Windows Time service (RFC 5905).
  • TTL interpretation (64 / 128 / 255 starting values) is labelled as a rule of thumb.

Limits: when not to rely on it

  • Reads only the text pasted; it cannot see the network or the time of the test.
  • Non-English Windows output may not be recognised.
  • IPv6 lines are ignored.

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 5da9168 · 2026-11-13