Reference Sheet
CLI Commands Cheat Sheet
OS & Networking · Windows CMD / PowerShell & Linux Bash
In Chrome: choose "Save as PDF" as the destination. Portrait orientation recommended.
WIN Windows CMDLIN Linux / macOS BashBOTH Works on both (or close equivalent)
Network Diagnostics
| Command | What it does |
|---|---|
| ipconfig WIN | Show IP address, subnet mask, and default gateway for all adapters |
| ipconfig /all WIN | Full details — MAC address, DHCP server, DNS servers, lease times |
| ipconfig /release WIN ipconfig /renew | Drop and re-request a DHCP lease — fixes "wrong IP" problems |
| ipconfig /flushdns WIN | Clear the DNS resolver cache — forces fresh lookups on next request |
| ip addr LIN older: ifconfig | Show IP addresses and network interface details |
| ping <host> BOTH | Test basic reachability — sends ICMP echo requests. -t (Win) or -c N (Lin) to control count |
| tracert <host> WIN traceroute <host> (Lin) | Show each router hop to the destination — pinpoint where packets stop |
| pathping <host> WIN | Combines ping + tracert — shows packet loss at each hop over time |
| nslookup <domain> BOTH | Query DNS — check what IP a hostname resolves to, or which server answered |
| netstat -an BOTH | List all active connections and listening ports with addresses. -b (Win) adds the process name |
| ssh user@host BOTH | Open an encrypted remote shell session. Port 22. Win also has PuTTY (putty.exe -ssh user@ip) |
| scp file user@host:/path LIN | Securely copy a file over SSH. Windows equivalent: pscp.exe (PuTTY SCP) |
Process Management
| Command | What it does |
|---|---|
| tasklist WIN | List all running processes with PID, memory usage, and session name |
| taskkill /PID <id> WIN | Terminate a process by PID. Add /F to force-kill without cleanup |
| Get-Process WIN PowerShell | List processes in PowerShell. Pipe to Stop-Process -Id <id> to kill |
| ps LIN | Snapshot of current processes. -ef shows all processes with full details including hidden ones |
| ps -ef | grep <name> LIN | Find a specific process by name in the full process list |
| top LIN | Live view of top CPU/memory consuming processes — %CPU and %MEM are key columns |
| kill <PID> LIN | Send SIGTERM — lets the process clean up before exiting |
| kill -KILL <PID> LIN | Send SIGKILL — instant forced termination, no cleanup. Last resort |
| kill -TSTP <PID> LIN | Suspend (pause) a process. Resume it with kill -CONT <PID> |
| lsof LIN | List open files and which processes hold them — useful when a file "can't be deleted" |
| uptime LIN | Show how long the system has been running + average CPU load over 1/5/15 min |
File System Navigation & Operations
| Command | What it does |
|---|---|
| dir WIN ls -la (Lin) | List directory contents. -la shows hidden files and permissions |
| cd <path> BOTH | Change directory. cd .. goes up one level. cd / (Lin) or cd \ (Win) goes to root |
| mkdir <name> BOTH | Create a new directory |
| del <file> WIN rm <file> (Lin) | Delete a file. Linux: -r deletes a directory recursively, -f skips confirmation |
| copy / xcopy WIN cp (Lin) | Copy files. xcopy handles directories. robocopy is the modern Win equivalent with resume support |
| move WIN mv (Lin) | Move or rename a file or directory |
| type <file> WIN cat <file> (Lin) | Print a file's contents to the terminal |
| grep <pattern> <file> LIN | Search for a text pattern in files. -r searches recursively in directories |
| find <path> -name "*.txt" LIN | Find files by name, type, or other attributes |
| tail -f <file> LIN | Stream the end of a file in real time — essential for watching live log output |
| chmod <mode> <file> LIN | Set file permissions. chmod 755 = owner rwx, group/other rx. chmod +x makes executable |
| chown user:group <file> LIN | Change file owner and group. Usually run with sudo |
| attrib WIN | View or set file attributes (Read-only, Hidden, System, Archive). attrib +h file hides a file |
System Information & Configuration
| Command | What it does |
|---|---|
| systeminfo WIN | Detailed system info — OS version, RAM, hotfixes, network config, domain |
| uname -a LIN | Kernel version, hostname, architecture, OS name all in one line |
| hostname BOTH | Print the computer's hostname |
| whoami BOTH | Print the current logged-in username (and domain on Windows) |
| msconfig WIN | System Configuration — manage startup programs, boot options, and services (GUI) |
| regedit WIN | Registry Editor GUI — view and edit Windows registry keys. Use with caution |
| eventvwr.msc WIN | Event Viewer — browse Windows logs (Application, System, Security) |
| devmgmt.msc WIN | Device Manager — view hardware, update/rollback drivers, disable devices |
| services.msc WIN | Services panel — start, stop, and set startup type for Windows services |
| gpupdate /force WIN | Force an immediate Group Policy refresh — apply new GPO settings without reboot |
| shutdown /r /t 0 WIN | Restart immediately. /s shuts down, /t N sets delay in seconds |
| systemctl status <svc> LIN | Check whether a service is running. Replace status with start, stop, or enable |
| journalctl -u <svc> LIN | View systemd logs for a specific service. -f follows in real time |
Disk & Storage
| Command | What it does |
|---|---|
| chkdsk C: /f WIN | Check and fix filesystem errors on a drive. /r also locates bad sectors (requires reboot on system drive) |
| sfc /scannow WIN | System File Checker — scan for and restore corrupted Windows system files. Run as admin |
| diskpart WIN | Interactive disk partitioning tool. Type list disk, select disk N, list partition inside it |
| df -h LIN | Show disk space usage for all mounted filesystems in human-readable sizes |
| du -sh <path> LIN | Show total size of a directory. Useful for finding what's eating disk space |
| free -h LIN | Show total/used/free RAM and swap in human-readable form |
| dd if=<src> of=<dst> LIN | Low-level disk clone / image tool. Copies block-for-block — can clone drives or create ISOs |
User & Permission Management
| Command | What it does |
|---|---|
| net user WIN | List all local user accounts. net user <name> shows details for one user |
| net user <name> <pass> /add WIN | Create a new local user account |
| net localgroup administrators <name> /add WIN | Add a user to the local Administrators group |
| sudo <command> LIN | Run a command as root (superuser). Required for system-level operations |
| su <user> LIN | Switch to another user account in the current terminal session |
| useradd <name> LIN | Create a new user account. Use -m to create a home directory |
| passwd <user> LIN | Set or change a user's password |
| userdel <name> LIN | Delete a user account. Add -r to also remove the home directory |
Package & Software Management
| Command | What it does |
|---|---|
| apt update LIN apt upgrade | Refresh package list, then install all pending updates (Debian/Ubuntu) |
| apt install <pkg> LIN | Install a package. apt remove <pkg> removes it. Prefix with sudo |
| yum install <pkg> LIN | Install a package on RHEL/CentOS. Modern systems use dnf instead |
| winget install <id> WIN | Windows Package Manager — install apps from the command line (Windows 10+) |
Remote Access
| Command | What it does |
|---|---|
| mstsc WIN | Launch Remote Desktop Connection (RDP client, port 3389). mstsc /v:host connects directly |
| mstsc /admin WIN | Connect to the console session of a remote server (bypasses session limits) |
| ssh -L 8080:target:80 user@jump BOTH | SSH local port forwarding — tunnel traffic through a jump host |
Quick Tips & Exam Shortcuts
Windows .msc Shortcuts
- devmgmt.msc — Device Manager
- diskmgmt.msc — Disk Management
- eventvwr.msc — Event Viewer
- services.msc — Services
- compmgmt.msc — Computer Management
- lusrmgr.msc — Local Users & Groups
- gpedit.msc — Group Policy Editor
- taskmgr — Task Manager
- regedit — Registry Editor
- msconfig — System Configuration
- msinfo32 — System Information
Linux Log Locations
- /var/log/syslog — general system log (everything)
- /var/log/auth.log — logins, sudo, SSH auth
- /var/log/kern.log — kernel messages
- /var/log/dmesg — boot and hardware messages
- /var/log/apt/ — package install history
- journalctl -xe — systemd logs, most recent errors
Signal Quick-Ref
- SIGTERM — graceful quit (kill default)
- SIGKILL — instant terminate, no cleanup
- SIGINT — Ctrl+C interrupt
- SIGTSTP — Ctrl+Z suspend
- SIGCONT — resume a suspended process
Pipe ( | ) & Redirect ( > ) work on both platforms.
ps -ef | grep nginx — filter output through grep
ipconfig /all > info.txt — save output to a file
tasklist | findstr notepad — Windows equivalent of grep