NetSh Static IPv4 Address Mysteries

Using NetSh to set static IP address I’ve come what seemed to be some strange behaviour. Searching the net this seems to be a re-occurring problem for many people. To demonstrate the problem we will use our “Local Area Connection” network adapter, which at this point is disconnected from the LAN and set to use DHCP. in this case I’m using WIndows 7 Enterprise x64.

And apologies if all this is blindingly obvious to you. For me it was a mystery.

First we’ll check the current network configuration using command:

netsh interface ipv4 show address “Local Area Connection”

image

And verified via the GUI:

image

and ipconfig /all

image

So now I try to set a static IP address using netsh interface ipv4 set address “Local Area connection” static 10.0.0.9 255.0.0.0 10.0.0.1 1

Immediately after IP set address we check the IP address with netsh. DHCP still shows as enabled. The strange thing is the default Gateway shows as set, and that’s it.

image

Ipconfig /all shows same as before:

image

Using ProcMon we can confirm NetSh.exe set the relevant registry settings:

image

The relevant registry keys set below highlighted in red. Note however the DHCP registry keys

– EnableDHCP is set to 1

– DisableDhcpOnConnect is set to 1

image

Now we check how the IP Address appears in GUI. In the GUI it matches what we set with NetSh

image

Using Procmon I find as soon as clicked “OK” the “EnableDHCP” value got set to 0

image

So now NetSh no longer shows DHCP as enabled for the connection, but still we don’t see IP address or Subnet, only the gateway.

image

 

This time I set my procmon filter to

  • Path Contains {33DE527D-1097-49F1-B2C3-F5F2025AB17E} (which is the GUID of my local area connection)
  • Operation is RegQueryvalue
  • Process Name is netsh.exe

image

In this case the IPAddress properties are not read at all when running netsh interface ipv4 show address “Local Area Connection”

image

Now as soon as I plug in a LAN cable we get the correct static information:

image

Finally, I disconnected my network adapter.

image

Now that I’ve disconnected the netsh continues to show the correct static IP address information. But if I change my IP address…

image

I’ve then used a ProcMon on netsh to identify what Windows APIs it was using to get the IP address. It seems to be using GetAdaptersAddresses in IPHLPAPI.DLL

image

Now the GUI also seems to call GetAdaptersAddresses so I checked out MSDN and compiled their example, and ran it (Example here http://msdn.microsoft.com/en-us/library/aa365915(v=vs.85).aspx  Great sample code by the way).

 

image

 

However despite two static IP addresses set for the disconnected network adapter GetAdaptersAddresses returns no any cast addresses. Now as far as I can tell using ProcMon the GUI is not reading the reg keys.

I also tried the GetIPAddrTable example here http://msdn.microsoft.com/en-us/library/aa365949(v=vs.85).aspx, which again only showed me IPs for my active adapters.

 

image

Unfortunately by this time I’m sick of trying to find out a “proper way” to find the static IP address of an offline network adapter, so as a last resort I have to use the reg keys. Maybe another day when I have more hours to waste I will look for a better way to do this. So at the moment this is the best method I found to get offline static IP address

  • Get the GUID of relevant interface (in C#.NET I’m using the NetworkInterface.Id) Or you can use  WMI query select GUID from Win32_NetworkAdapter WHERE NetConnectionID=’Local Area Connection’
  • Look up the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{GUID}
  • If DisableDhcpOnConnect is 1 or EnableDHCP is 0 then address is static
  • For static address value is REG_MULTI_SZ value IPAddress
  • For DHCP assigned address value is a REG_SZ value DhcpIPAddress

Now maybe there is a good reason for this, maybe there is not. Personally I would hope with NetSh used for network configuration it would display the actual adapter settings, to match with the GUI.

But what we learn from this:

1) Don’t believe NetSh / Ipconfig DHCP settings when no cable is connected to a LAN adapter

2) NetSh “show address” is not consistent with the Windows GUI –> the Windows GUI showing you a static IP address even when offline, whereas NetSh doesn’t initially

3) The DHCP configuration of a disconnected network adapter may display incorrectly in NetSh / IpConfig until viewed in the “GUI” and clicked “OK” or network cable connected

4) You will find the same thing when using NetworkInterface in .NET or GetAdaptersAddresses or GetIPAddrTable in Win32 –> It will report the same info as the NetSh tool

5) Probably most of the time this is a good thing, not sending an IP to your app when there is no network. Really annoying though when you need this info, or if you’re trying to double check static settings you’ve made offline and are unaware of this behaviour

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in Command Line, Network, Windows 7 and tagged . Bookmark the permalink.

2 Responses to NetSh Static IPv4 Address Mysteries

  1. Thanks for this. Was driving me crazy trying to find a solution to this. Really feels like the NetworkInterface in c#, should have a way to pull out the intended IP when it is disconnected.

  2. dd says:

    “Media sense” unloads the protocols from the disconnected adapter and that’s why the properties are unavailable.

    https://support.microsoft.com/en-us/kb/239924

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s