Network Shell http commands

netsh http is used to query and configure HTTP.sys settings and parameters.

netsh http commands

List of netsh http commands: add iplisten add sslcert add timeout add urlacl delete cache delete iplisten delete sslcert delete timeout delete urlacl flush logbuffer show cachestate show iplisten show servicestate show sslcert show timeout show urlacl

add iplisten

Adds a new IP address to the IP listen list, excluding the port number.

Syntax

add iplisten [ ipaddress= ] IPAddress

Parameters

ipaddress The IPv4 or IPv6 address to be added to the IP listen list. The IP listen list is used to scope the list of addresses to which the HTTP service binds. "0.0.0.0" means any IPv4 address and "::" means any IPv6 address.Required

add sslcert

Adds a new SSL server certificate binding and corresponding client certificate policies for an IP address and port.

Syntax

add sslcert [ ipport= ] IPAddress:port [ certhash= ] CertHash [ appid= ] GUID [ [ certstorename= ] CertStoreName [ verifyclientcertrevocation= ] enable | disable [verifyrevocationwithcachedclientcertonly= ] enable | disable [ usagecheck= ] enable | disable [ revocationfreshnesstime= ] U-Int [ urlretrievaltimeout= ] U-Int [sslctlidentifier= ] SSLCTIdentifier [ sslctlstorename= ] SLCtStoreName [ dsmapperusage= ] enable | disable [ clientcertnegotiation= ] enable | disable ] ]

Parameters

ipport Specifies the IP address and port for the binding. A colon character (:) is used as a delimiter between the IP address and the port number. Required certhash Specifies the SHA hash of the certificate. This hash is 20 bytes long and is specified as a hexadecimal string. Required appid Specifies the GUID to identify the owning application. Required certstorename Specifies the store name for the certificate. Defaults to MY. Certificate must be stored in the local machine context. Optional verifyclientcertrevocation Specifies the Turns on/off verification of revocation of client certificates. Optional verifyrevocationwithcachedclientcertonly Specifies whether the usage of only cached client certificate for revocation checking is enabled or disabled. Optional usagecheck Specifies whether the usage check is enabled or disabled. Default is enabled. Optional revocationfreshnesstime Specifies the time interval, in seconds, to check for an updated certificate revocation list (CRL). If this value is zero, then the new CRL is updated only if the previous one expires. Optional urlretrievaltimeout Specifies the timeout interval (in milliseconds) after the attempt to retrieve the certificate revocation list for the remote URL. Optional sslctlidentifier Specifies the list of the certificate issuers that can be trusted. This list can be a subset of the certificate issuers that are trusted by the computer. Optional sslctlstorename Specifies the certificate store name under LOCAL_MACHINE where SslCtlIdentifier is stored. Optional dsmapperusage Specifies whether DS mappers is enabled or disabled. Default is disabled. Optional clientcertnegotiation Specifies whether the negotiation of certificate is enabled or disabled. Default is disabled. Optional

add timeout

Adds a global timeout to the service.

Syntax

add timeout [ timeouttype= ] IdleConnectionTimeout | HeaderWaitTimeout [ value=] U-Short

Parameters

timeouttype Type of timeout for setting. value Value of the timeout (in seconds). If the value is in hexadecimal notation, then add the prefix 0x.

add urlacl

Adds a Uniform Resource Locator (URL) reservation entry. This command reserves the URL for non-administrator users and accounts. The DACL can be specified by using an NT account name with the listen and delegate parameters or by using an SDDL string.

Syntax

add urlacl [ url= ] URL [ [user=] User [ [ listen= ] yes | no [ delegate= ] yes | no ] | [ sddl= ] SDDL ]

Parameters

url Specifies the fully qualified Uniform Resource Locator (URL). Required user Specifies the user or user-group name Required listen Specifies one of the following values: yes: Allow the user to register URLs. This is the default value. no: Deny the user from registering URLs. Optional delegate Specifies one of the following values: yes: Allow the user to delegate URLs no: Deny the user from delegating URLs. This is the default value. Optional sddl Specifies an SDDL string that describes the DACL. Optional

delete cache

Deletes all the entries, or a specified entry, from the HTTP service kernel URI cache.

Syntax

delete cache [ [ url= ] URL [ [recursive= ] yes | no ]

Parameters

url Specifies the fully qualified Uniform Resource Locator (URL) that you want to delete. Optional recursive Specifies whether all entries under the url cache get removed. yes: remove all entries no: do not remove all entries Optional

delete iplisten

Deletes an IP address from the IP listen list. The IP listen list is used to scope the list of addresses to which the HTTP service binds.

Syntax

delete iplisten [ ipaddress= ] IPAddress

Parameters

ipaddress The IPv4 or IPv6 address to be deleted from the IP listen list. The IP listen list is used to scope the list of addresses to which the HTTP service binds. "0.0.0.0" means any IPv4 address and "::" means any IPv6 address. This does not include the port number. Required

delete sslcert

Deletes SSL server certificate bindings and corresponding client certificate policies for an IP address and port.

Syntax

delete sslcert [ ipport= ] IPAddress:port

Parameters

ipport Specifies the IPv4 or IPv6 address and port for which the SSL certificate bindings get deleted. A colon character (:) is used as a delimiter between the IP address and the port number. Required

delete timeout

Deletes a global timeout and makes the service revert to default values.

Syntax

delete timeout [ timeouttype= ] idleconnectiontimeout | headerwaittimeout

Parameters

timeouttype Specifies the type of timeout setting. Required

delete urlacl

Deletes URL reservations.

Syntax

delete urlacl [ url= ] URL

Parameters

url Specifies the fully qualified Uniform Resource Locator (URL) that you want to delete. Required

flush logbuffer

Flushes the internal buffers for the logfiles.

Syntax

flush logbuffer

show cachestate

Lists cached URI resources and their associated properties. This command lists all resources and their associated properties that are cached in HTTP response cache or displays a single resource and its associated properties.

Syntax

show cachestate [ [url= ] URL]

Parameters

url Specifies the fully qualified URL that you want to display. If not specified, display all URLs. The URL could also be a prefix to registered URLs. Optional

show iplisten

Displays all IP addresses in the IP listen list. The IP listen list is used to scope the list of addresses to which the HTTP service binds. "0.0.0.0" means any IPv4 address and "::" means any IPv6 address.

Syntax

show iplisten

show servicestate

Displays a snapshot of the HTTP service.

Syntax

show servicestate [ [ view= ] session | requestq ] [ [ verbose= ] yes | no ]

Parameters

View Specifies whether to view a snapshot of the HTTP service state based on the server session or on the request queues. Optional Verbose Specifies whether to display verbose information that also shows property information. Optional

show sslcert

Displays Secure Sockets Layer (SSL) server certificate bindings and corresponding client certificate policies for an IP address and port.

Syntax

show sslcert [ ipport= ] IPAddress:port

Parameters

ipport Specifies the IPv4 or IPv6 address and port for which the SSL certificate bindings display. A colon character (:) is used as a delimiter between the IP address and the port number. If you do not specify ipport, all bindings are displayed. Required

show timeout

Displays, in seconds, the timeout values of the HTTP service.

Syntax

show timeout

show urlacl

Displays discretionary access control lists (DACLs) for the specified reserved URL or all reserved URLs.

Syntax

show urlacl [ [url= ] URL]

Parameters

url Specifies the fully qualified URL that you want to display. If not specfied, display all URLs. Optional

Resources and References

• https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh
• https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts
• https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-wins
• https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-http
• https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-interface-portproxy
• https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-mbn