How to Configure TCP Transport Filters in Windows 11 Using PowerShell New-NetTransportFilter

Windows 11 and Windows Server platforms incorporate an advanced, modular TCP/IP transport architecture capable of applying distinct transport profiles to different categories of network traffic. Rather than enforcing a single global TCP congestion control algorithm or window sizing parameter across all connections, the operating system can map connections to specialized profiles—such as Datacenter, Internet, Compat, or custom user-defined templates. The mechanism that establishes these bindings is the TCP Transport Filter. Using the NetTCPIP PowerShell module and cmdlets like New-NetTransportFilter, system administrators and performance engineers can target specific IP subnets, remote port ranges, or local application sockets to assign optimal TCP transmission policies.

Understanding Windows TCP Transport Profiles and Filters

In high-performance enterprise workloads, network requirements vary dramatically between local storage clusters, database replication fabrics, and public Internet services. The Windows TCP transport layer manages these differences through two interrelated objects:

• TCP Settings (MSFT_NetTCPSetting): Defines the congestion provider (such as CUBIC, CTCP, or DCTCP), receive window auto-tuning levels, Initial Congestion Window (ICW), ECN capabilities, and delayed ACK timeouts. Built-in profiles include Datacenter (optimized for low-latency, high-throughput LANs with DCTCP) and Internet (tuned for variable WAN latencies with CUBIC).
• Transport Filters (MSFT_NetTransportFilter): Act as policy routing selectors. When a TCP connection is established, the network stack evaluates active transport filters against the connection’s destination IP prefix, local port, and remote port. The most specific matching filter determines which NetTCPSetting template governs the socket.
• Precedence Rules: Transport filters are prioritized based on prefix length and port specificity. Specific subnet matches (e.g. 10.200.1.0/24) take precedence over broader wildcard or default filters.

Inspecting Existing TCP Transport Settings and Filters

Before creating new transport filters, review the baseline TCP setting templates and existing filter mappings configured on the Windows host. Elevated administrative privileges are required for all TCP/IP stack configuration cmdlets.

Open an elevated PowerShell session (Run as Administrator) and inspect the available TCP setting templates:

Get-NetTCPSetting | Format-Table SettingName, CongestionProvider, AutoTuningLevelLocal, EcnCapability

Review the active transport filters currently bound in the TCP/IP stack:

Get-NetTransportFilter | Format-Table SettingName, Protocol, DestinationPrefix, LocalPortStart, RemotePortStart

To inspect the detailed parameters of the built-in Datacenter and Internet templates:

Get-NetTCPSetting -SettingName "Datacenter" | Format-List *
Get-NetTCPSetting -SettingName "Internet" | Format-List *

Creating a Custom TCP Setting Profile

While administrators can map filters to existing built-in profiles, creating a custom TCP setting profile allows precise tuning of congestion parameters without modifying system defaults.

Create a custom TCP setting template tailored for high-speed iSCSI or NVMe-over-Fabrics storage networks:

New-NetTCPSetting -SettingName "StorageFabric" -CongestionProvider "CUBIC" -AutoTuningLevelLocal "Normal" -InitialCongestionWindowMss 10 -ScalingHeuristics "Disabled" -EcnCapability "Enabled"

Confirm the creation and inspect the newly provisioned profile:

Get-NetTCPSetting -SettingName "StorageFabric"

Configuring TCP Transport Filters Using New-NetTransportFilter

With the target TCP template identified or created, use New-NetTransportFilter to route specific traffic streams to that profile.

To bind all outbound TCP traffic destined for a dedicated storage subnet (e.g. 192.168.100.0/24) to the Datacenter profile:

New-NetTransportFilter -SettingName "Datacenter" -Protocol TCP -DestinationPrefix "192.168.100.0/24"

To bind database replication traffic directed to Microsoft SQL Server instances on remote port 1433 within an enterprise data centre subnet:

New-NetTransportFilter -SettingName "StorageFabric" -Protocol TCP -DestinationPrefix "10.50.0.0/16" -RemotePortStart 1433 -RemotePortEnd 1433

To apply a custom low-latency profile to web server traffic bound to local listener ports 443 and 8443:

New-NetTransportFilter -SettingName "Internet" -Protocol TCP -LocalPortStart 443 -LocalPortEnd 443
New-NetTransportFilter -SettingName "Internet" -Protocol TCP -LocalPortStart 8443 -LocalPortEnd 8443

Verifying and Auditing Filter Application

Confirm that the new transport filters appear in the system registry and active network configuration:

Get-NetTransportFilter -SettingName "StorageFabric" | Format-List

To inspect active TCP connections and verify which TCP settings are in effect, query active sockets using Get-NetTCPConnection:

Get-NetTCPConnection -State Established | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, AppliedSetting | Format-Table -AutoSize

The AppliedSetting column indicates the exact TCP template assigned to each connection, confirming whether the transport filter successfully matched the traffic flow.

Modifying and Removing Transport Filters

When network topologies change, decommissioning obsolete transport filters ensures that stale rules do not override modern system defaults.

To locate a specific transport filter based on its destination prefix and remove it:

Get-NetTransportFilter -DestinationPrefix "192.168.100.0/24" | Remove-NetTransportFilter -Confirm:$false

To remove all transport filters associated with a deprecated custom profile:

Get-NetTransportFilter -SettingName "StorageFabric" | Remove-NetTransportFilter -Confirm:$false

Once all dependent filters are removed, the custom TCP setting profile can also be deleted:

Remove-NetTCPSetting -SettingName "StorageFabric" -Confirm:$false

Troubleshooting Transport Filter Conflicts

When connections do not inherit expected congestion profiles, verify these common operational caveats:

1. Filter Overlap and Precedence: When multiple filters match a connection, the TCP stack selects the filter with the longest matching prefix (most specific subnet mask). If two filters share the same prefix length, the filter specifying explicit port ranges takes priority over wildcard port rules.
2. IPv4 vs IPv6 Scope: Destination prefixes must explicitly match the IP protocol version. A filter defined for 10.0.0.0/8 will not apply to IPv6 traffic destined for 2001:db8::/32. Distinct filters must be defined for each protocol family.
3. Dynamic Port Shifting: If applications employ non-standard ephemeral ports for high-throughput data transfers (such as FTP passive mode or RPC dynamic ports), filtering solely by port range may fail. In such architectures, bind filters by destination subnet prefix rather than port numbers.

By configuring TCP transport filters with New-NetTransportFilter, administrators unlock granular control over TCP congestion behaviour, maximizing network efficiency across mixed enterprise workloads.