How to Inspect Network Compartments in Windows 11 Using PowerShell

Modern enterprise networking, virtualization, and VPN architectures often require operating systems to isolate network traffic across multiple distinct logical routing domains. While Linux systems handle this through network namespaces, the Windows operating system architecture uses Network Compartments within the core TCP/IP stack (tcpip.sys). Network compartments allow Windows 11 to partition network interfaces, routing tables, and ARP/neighbour caches into completely isolated routing environments on the same physical computer.

Hyper-V virtual switches, Windows Defender Application Guard, Windows Sandbox, and enterprise DirectAccess/Always On VPN clients use compartments to prevent traffic leaking between corporate internal networks and untrusted external subnets. System administrators and security engineers can query and audit these boundaries using PowerShell. This guide explains how to inspect and query network compartments in Windows 11 using PowerShell.

Understanding Windows Network Compartments

A network compartment is a logical instance of the TCP/IP network layer within the Windows kernel. Each compartment maintains its own independent networking state:

• Compartment 1 (Default): The host operating system’s primary routing realm, where physical Ethernet and Wi-Fi adapters reside alongside standard local services.
• Secondary Compartments (IDs 2, 3, etc.): Ephemeral or persistent isolated routing realms instantiated by virtualization platforms (Hyper-V, WSL2), container runtimes, or VPN tunnels.
• Routing Independence: Each compartment possesses its own discrete IP routing table. Route entries or default gateways in Compartment 2 are completely invisible to processes communicating in Compartment 1.

Querying Compartments with Get-NetCompartment

The NetTCPIP module in PowerShell includes the Get-NetCompartment cmdlet, which queries the kernel network stack directly for active compartments.

Listing All Active Network Compartments

1. Right-click the Start menu button on Windows 11 and select Terminal (Admin) or PowerShell (Admin).
2. Run the following command:

Get-NetCompartment

Windows outputs a summary table listing all active compartments:

CompartmentId  CompartmentType   CompartmentDescription
-------------  ---------------   ----------------------
1              Default           Default Compartment
2              Native            Hyper-V Internal Switch
3              Native            Isolated VPN Tunnel

Interpreting the Compartment Properties

• CompartmentId: An unsigned integer identifying the unique logical network slice.
• CompartmentType: Indicates the mode of isolation (such as Default or Native).
• CompartmentDescription: A descriptive label assigned by the subsystem or hypervisor creating the network boundary.

Associating Network Adapters with Compartments

To determine which physical or virtual network adapters are bound to a specific compartment, query the network IP interfaces using Get-NetIPInterface:

Auditing Interfaces by Compartment ID

Run the following command to display interface aliases alongside their assigned compartment membership:

Get-NetIPInterface | Select-Object InterfaceAlias, InterfaceIndex, AddressFamily, CompartmentId, ConnectionState | Sort-Object CompartmentId

To filter exclusively for interfaces operating inside isolated secondary compartments (outside the default compartment):

Get-NetIPInterface | Where-Object { $_.CompartmentId -ne 1 } | Format-Table InterfaceAlias, InterfaceIndex, AddressFamily, CompartmentId

This verification confirms whether virtual switch ports or VPN adapters are properly confined to isolated routing planes.

Inspecting Routing Tables by Compartment

Because each compartment manages an isolated routing table, querying routes without filtering defaults to the host table. Use Get-NetRoute with the -CompartmentId parameter to inspect routing entries within a specific boundary.

Viewing Routes in an Isolated Compartment

To inspect routes belonging to Compartment 2, execute:

Get-NetRoute -CompartmentId 2 | Format-Table DestinationPrefix, NextHop, RouteMetric, InterfaceAlias

This command reveals default gateways and route destinations active inside that specific virtualized container or sandbox environment, verifying that no routes point back to private corporate subnets in Compartment 1.

Inspecting IP Addresses and Neighbour Caches

Similar to routing tables, IP address assignments and ARP/neighbour resolution caches operate per compartment:

Querying IP Addresses in Compartments

Get-NetIPAddress | Where-Object { $_.InterfaceIndex -in (Get-NetIPInterface -CompartmentId 2).InterfaceIndex } | Select-Object IPAddress, InterfaceAlias, PrefixLength

Querying the Neighbour Cache

To audit resolved MAC addresses and neighbour entries for a specific compartment:

Get-NetNeighbor -CompartmentId 2 | Select-Object IPAddress, LinkLayerAddress, State, InterfaceAlias

Administrative Security and Troubleshooting Notes

• Administrative Privileges: Querying low-level TCP/IP compartments and non-default interface states requires an elevated PowerShell session with administrator privileges.
• Process Execution Context: Standard Windows applications always launch inside Compartment 1 by default. Specialized Windows services (such as container agents or Hyper-V worker processes) invoke the native Windows API SetCurrentThreadCompartmentId to bind their communication sockets to secondary compartments dynamically.
• Non-Destructive Inspection: The Get-NetCompartment cmdlet is purely read-only and safe to execute in production enterprise environments without disrupting active virtual machines or VPN sessions.