PopwerShell Testing Network Connections

Network connectivity verification in PowerShell is handled by two complementary cmdlets: Test-Connection for Layer 3 ICMP ping verification and Test-NetConnection for Layer 4 TCP port probing, route tracing, and service diagnostics. Together they replace the legacy ping.exe and tracert.exe utilities with structured, object-based alternatives.

ICMP Verification with Test-Connection

The Test-Connection cmdlet sends ICMP echo requests (pings) to one or more remote targets and returns structured Microsoft.PowerShell.Commands.PingHost (PowerShell 7+) or Win32_PingStatus (Windows PowerShell 5.1) objects.

Test-Connection -ComputerName "google.com"

Source        Destination     IPV4Address      Bytes    Time(ms)
------        -----------     -----------      -----    --------
DESKTOP-01    google.com      142.250.72.14    32       14
DESKTOP-01    google.com      142.250.72.14    32       13
DESKTOP-01    google.com      142.250.72.14    32       15
DESKTOP-01    google.com      142.250.72.14    32       14

where -ComputerName is the target hostname or IP address to ping (in Windows PowerShell 5.1, use -ComputerName; in PowerShell 7+, -TargetName is preferred).

Formatting Output with Select-Object

Test-Connection -TargetName "1.1.1.1" -Count 2 | 
    Select-Object -Property Destination, Status, Latency, BufferSize

where:

• Test-Connection is the core cmdlet executing ICMP echo requests.
• -TargetName specifies the hostname or IPv4/IPv6 address of the remote endpoint.
• -Count defines the number of ping attempt packets to transmit (defaults to 4).
• Select-Object extracts primary metrics such as round-trip Latency (in milliseconds) and transmission Status.

pwsh ./test-ping.ps1

Destination Status  Latency BufferSize
----------- ------  ------- ----------
1.1.1.1     Success       8         32
1.1.1.1     Success       7         32

Controlling Ping Count with -Count

Test-Connection -ComputerName "google.com" -Count 2

where -Count is the number of echo requests to send.

Getting a Simple True/False Result with -Quiet

For scripting scenarios where you only need to know if a host is reachable, -Quiet suppresses detailed output and returns a boolean.

Test-Connection -ComputerName "google.com" -Count 2 -Quiet

True

$isOnline = Test-Connection -ComputerName "192.168.1.1" -Count 2 -Quiet

if ($isOnline) {
    Write-Output "Host is reachable."
} else {
    Write-Output "Host is unreachable."
}

./check-host-online.ps1

Host is reachable.

TCP Port Testing with Test-NetConnection

While Test-Connection only confirms whether a server's operating system responds to network-layer pings, it cannot confirm whether a specific application or service is listening. The Test-NetConnection cmdlet (aliased as tnc) performs Layer 4 TCP handshake tests, verifies DNS resolution, and traces packet routes.

Test-NetConnection -ComputerName "google.com" -Port 443

ComputerName     : google.com
RemoteAddress    : 142.250.72.14
RemotePort       : 443
InterfaceAlias   : Ethernet
SourceAddress    : 192.168.1.42
TcpTestSucceeded : True

where:

• -ComputerName is the target hostname or IP address.
• -Port is the TCP port to test for connectivity.

Detailed Diagnostic Output

Use -InformationLevel Detailed to get full route and adapter diagnostic information, similar to combining ping and tracert.

Test-NetConnection -ComputerName "github.com" -Port 443 -InformationLevel Detailed

where:

• Test-NetConnection is the network diagnostic cmdlet included with the NetTCPIP module.
• -ComputerName is the target DNS hostname or IP address.
• -Port is the destination TCP port number to validate.
• -InformationLevel Detailed directs the cmdlet to output full diagnostic details, including DNS resolution results, interface matching, and route traversal.

./test-port.ps1

ComputerName            : github.com
RemoteAddress           : 140.82.112.4
RemotePort              : 443
NameResolutionResults   : 140.82.112.4
MatchingIPInterface     : Ethernet0
SourceAddress           : 192.168.1.150
NetAdapterName          : Ethernet0
TcpTestSucceeded        : True

Testing Common Services with -CommonTCPPort

Test-NetConnection includes shortcuts for frequently tested services via -CommonTCPPort, eliminating the need to memorize standard port numbers.

Test-NetConnection -ComputerName "mailserver.local" -CommonTCPPort SMTP

where -CommonTCPPort accepts predefined service names like HTTP (Port 80), RDP (Port 3389), SMB (Port 445), SMTP (Port 25), or WINRM (Port 5985), automatically mapping to the correct port number.

ComputerName     : mailserver.local
RemotePort       : 25
TcpTestSucceeded : True

Network Path Tracing with -TraceRoute

Test-NetConnection also includes traceroute capability, replacing the legacy tracert utility while emitting structured hop data.

$trace = Test-NetConnection -ComputerName "1.1.1.1" -TraceRoute

$trace.TraceRoute

where:

• -TraceRoute directs the cmdlet to discover and record every router hop between the local machine and the destination host.
• $trace.TraceRoute accesses the string array property containing the IP addresses of the intermediary routers.

./test-traceroute.ps1

192.168.1.1
10.20.0.1
172.16.32.1
1.1.1.1

Test-Connection vs Test-NetConnection

Practical Usage

Verifying a Web Server Before Deployment

A common pre-deployment check is confirming both that a server is reachable and that the expected web port is open.

param(
    [string]$ComputerName,
    [int]$Port = 443
)

$pingResult = Test-Connection -ComputerName $ComputerName -Count 2 -Quiet
$portResult = Test-NetConnection -ComputerName $ComputerName -Port $Port -InformationLevel Quiet

if ($pingResult -and $portResult) {
    Write-Output "$ComputerName is online and port $Port is open. Ready for deployment."
} else {
    Write-Output "$ComputerName failed pre-deployment checks (Ping: $pingResult, Port $Port : $portResult)."
}

where:

• $pingResult stores the boolean result of the ICMP reachability check.
• $portResult stores the boolean result of the TCP port check.
• -InformationLevel Quiet keeps Test-NetConnection output minimal for use in the conditional.

./verify-server-ready.ps1 -ComputerName "webserver01" -Port 443

webserver01 is online and port 443 is open. Ready for deployment.

Multi-Port Pre-Deployment Verification

Before configuring or deploying applications to a server, administrators should verify that both the base host and all required service ports (e.g., Web, SSH, Remote Management) are accessible through local and perimeter firewalls.

$targetHost = "web-node01.corp.internal"
$targetPorts = @(80, 443, 3389, 5985)

$pingStatus = Test-Connection -TargetName $targetHost -Count 1 -Quiet

if (-not $pingStatus) {
    Write-Warning "Target host $targetHost is unreachable via ICMP. Verifying TCP ports directly..."
}

$report = foreach ($port in $targetPorts) {
    $result = Test-NetConnection -ComputerName $targetHost -Port $port -WarningAction SilentlyContinue
    
    [PSCustomObject]@{
        TargetHost    = $targetHost
        Port          = $port
        ResolvedIP    = $result.RemoteAddress
        PortOpen      = $result.TcpTestSucceeded
        RoundTripMS   = $result.PingReplyDetails.RoundtripTime
    }
}

$report | Format-Table -AutoSize

where:

• $targetPorts is an array of port numbers to audit sequentially.
• -WarningAction SilentlyContinue suppresses warning output when a connection attempt times out on a closed or blocked port.
• [PSCustomObject] builds a custom object to display aggregated port results in a formatted table.
• TcpTestSucceeded is a boolean value confirming whether the TCP handshake completed.

./audit-server-ports.ps1

TargetHost               Port ResolvedIP  PortOpen RoundTripMS
----------               ---- ----------  -------- -----------
web-node01.corp.internal   80 10.10.12.50     True           2
web-node01.corp.internal  443 10.10.12.50     True           2
web-node01.corp.internal 3389 10.10.12.50    False            
web-node01.corp.internal 5985 10.10.12.50     True           3