How to Use the Test-NetConnection Cmdlet in Windows 11 to Audit TCP Ports and Network Latency

When diagnosing connectivity failures across local networks, corporate subnets, or public cloud endpoints, systems engineers historically juggled disparate command-line utilities. Administrators used ping for basic ICMP reachability, tracert for routing path hop analysis, and installed optional Telnet clients just to verify whether a remote TCP socket (such as port 443 for HTTPS or port 3389 for RDP) was actively accepting handshakes. In modern Windows operating systems—including Windows 11—Microsoft unified and superseded these fragmented utilities with a single, native PowerShell cmdlet: Test-NetConnection (commonly referenced by its built-in alias, tnc).

Integrated natively into the Windows PowerShell and PowerShell 7 environments, Test-NetConnection performs end-to-end network diagnostics without requiring third-party port scanners or optional feature installations. It returns structured PowerShell objects containing source IP bindings, resolved DNS addresses, TCP handshake confirmations, ICMP round-trip ping times, and full traceroute hops. This comprehensive tutorial examines the diagnostic mechanics of Test-NetConnection, demonstrates port auditing and latency measurement workflows, explains routing analysis techniques, and provides real-world troubleshooting scenarios.

Comparing Test-NetConnection with Legacy Windows Network Tools

Understanding how Test-NetConnection enhances network diagnostics compared to legacy tools demonstrates why it has become the standard utility for Windows administrators:

Feature / Parameter	Test-NetConnection (tnc)	Legacy Utilities (ping, tracert, telnet)
Output Formatting	Rich .NET object with structured properties; easily piped to Export-Csv or scripts.	Unstructured plain text; requires complex regex or string parsing to automate.
Specific TCP Port Testing	Native parameter (-Port <number>) returning boolean TcpTestSucceeded.	Requires installing the deprecated Telnet client or third-party port scanners.
Common Service Presets	Built-in service aliases (e.g., -CommonTCPPort SMB, RDP, HTTP).	Requires remembering specific port numbers manually.
Integrated Trace Routing	Optional parameter (-TraceRoute) executed alongside latency testing.	Requires launching separate tracert or pathping sessions.
Host Name Resolution	Displays full DNS lookup results alongside IPv4 and IPv6 target arrays.	Basic IP resolution only.

Basic Network Reachability and Ping Testing

To perform a rapid connectivity test against a remote server or domain name, open PowerShell or Windows Terminal and run:

Test-NetConnection -ComputerName "digitash.com"

PowerShell performs a DNS lookup, initiates an ICMP echo request, and outputs the diagnostic summary:

ComputerName           : digitash.com
RemoteAddress          : 172.67.182.201
InterfaceAlias         : Wi-Fi
SourceAddress          : 192.168.1.120
PingSucceeded          : True
PingReplyDetails (RTT) : 18 ms

In addition to confirming that PingSucceeded is True, the cmdlet reveals your local egress interface (InterfaceAlias), your assigned local IP (SourceAddress), and the exact round-trip latency (18 ms).

Testing Specific Remote TCP Ports

Many enterprise firewalls, cloud security groups, and perimeter routers block ICMP echo requests entirely, causing standard ping commands to time out even when the web application or database server is completely healthy. Test-NetConnection bypasses this limitation by initiating a legitimate TCP three-way handshake (SYN, SYN-ACK, ACK) against a specified port:

Test-NetConnection -ComputerName "digitash.com" -Port 443

If the port is open and listening, the console returns:

ComputerName     : digitash.com
RemoteAddress    : 172.67.182.201
RemotePort       : 443
InterfaceAlias   : Wi-Fi
SourceAddress    : 192.168.1.120
TcpTestSucceeded : True

The TcpTestSucceeded : True property provides definitive proof that intermediate firewalls permit outbound traffic and the remote service is actively accepting connections.

Using Built-in Common TCP Port Presets

For standard network administration services, you do not need to memorize numeric port identifiers. Test-NetConnection provides the -CommonTCPPort parameter with built-in presets:

• SMB: Tests Server Message Block file-sharing ports (Port 445).
• RDP: Tests Remote Desktop Protocol (Port 3389).
• HTTP: Tests unencrypted web services (Port 80).
• WINRM: Tests Windows Remote Management (Port 5985).

For example, to verify whether an internal file server or domain controller is accessible over SMB:

Test-NetConnection -ComputerName "192.168.1.50" -CommonTCPPort SMB

Tracing Network Hops and Measuring Path Latency

When packet loss occurs or latency spikes unpredictably, appending the -TraceRoute switch instructs the cmdlet to trace each routing hop along the network path:

Test-NetConnection -ComputerName "1.1.1.1" -TraceRoute

To inspect every underlying metric—including MTU sizes and detailed interface configurations—add the -InformationLevel Detailed switch:

Test-NetConnection -ComputerName "digitash.com" -Port 443 -InformationLevel Detailed

This outputs network interface GUIDs, matching route table entries, and socket binding states.

Automating Port Audits Across Multiple Servers

Because Test-NetConnection returns native PowerShell custom objects, you can automate port compliance audits across an array of endpoints in a single pipeline:

$Servers = @("192.168.1.10", "192.168.1.20", "192.168.1.30")
$Results = foreach ($Server in $Servers) {
    Test-NetConnection -ComputerName $Server -Port 3389 -WarningAction SilentlyContinue |
        Select-Object ComputerName, RemoteAddress, RemotePort, TcpTestSucceeded
}
$Results | Format-Table -AutoSize

This generates an instant administrative report identifying which servers have Remote Desktop ports exposed or firewalled.

Troubleshooting Common Test-NetConnection Issues

Keep these operational nuances in mind during network diagnostics:

• TCP Handshake Timeout Latency: When probing a stealthily dropped port (where a firewall silently drops SYN packets rather than sending a TCP RST), the cmdlet will wait approximately 20 seconds before timing out and returning TcpTestSucceeded : False.
• DNS Caching Discrepancies: If Test-NetConnection targets an obsolete IP address following a DNS record change, flush the local client resolver cache using Clear-DnsClientCache before re-running the test.
• Non-Administrative Execution: Standard unprivileged users can execute TCP port checks and basic ping queries; however, performing full route tracing and querying detailed network adapter properties may require launching PowerShell as Administrator.

By leveraging Test-NetConnection in Windows 11, IT professionals can streamline network diagnostics, verify firewall rule compliance, and isolate server communication failures with scriptable precision.