Network Connectivity Status Indicator

This page's changes and edits · All guidance changes

Microsoft's edit · 26 Apr 2023 23:56 UTC

Applied feedback from PM/Eng

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit bbbf06b · +20 ~~−12~~ lines · also on GitHub

11 ---

22 title: Network Connectivity Status Indicator Overview

3 −description: 'The Network Connectivity Status Indicator (NCSI) helps troubleshoot connectivity issues via network probing methods.'

3 +description: The Network Connectivity Status Indicator (NCSI) helps troubleshoot connectivity issues via network probing methods.

44 ms.topic: article

5 −ms.date: 04/06/2023

5 +ms.date: 04/26/2023

66 ms.author: alalve

77 author: rnitsch

88 ---

1010 # NCSI overview

1111

12 −Network Connectivity Status Indicator (NCSI) is a departure from traditional workflows in that it attempts to do a lot more than just teach how to troubleshoot the affected component. This overview explains how NCSI functions when probing the network for internet connectivity.

12 +The Network Connectivity Status Indicator (NCSI) is a feature that provides a visual display of the current network connection status, including network adapter details and their configurations.

1313

1414 ## NCSI functionality

1515

16 −NCSI uses network probes that are network requests sent to an endpoint followed by a response. There are many different types of probes including active, passive, corporate, proxy, default gateway, and others. In addition, some probes are performed via HTTP, DNS, or both.

16 +NCSI uses network probes that are network requests sent to an endpoint followed by a response. NCSI’s probe, referred to as an “active probe”, is a HTTP request/response. It also uses passive polling, referred to as a “passive probe”, although not a true function of a probe.

1717

1818 ### What is the purpose of NCSI in Windows?

1919

2020 NCSI is the component responsible for determining network connectivity exists and if it's Internet or local-only. The reason NCSI was developed to save applications the complex task of determining network configuration on its own. Every attempt to perform a task over the network would require constant attention to whether the network was still accessible. In a network outage, even intermittently, the application would time out the operation and tests the network continuously until the connection is stable.

2121

22 −This seems trivial until you consider that it must perform checks for a multitude of environmental factors such as being behind a proxy or hotspot/captive portal. NCSI must know if the network it detects is one that can satisfy its requests. Does it need full internet or private corporate access? Users must wait for their actions to either complete or time out while the application makes this determination when deciding how to handle restrictive or no network connectivity scenarios.

22 +This seems trivial until you consider that it must perform checks for a multitude of environmental factors such as being behind a proxy, hotspot, or captive portal. NCSI must know if the network it detects is one that can satisfy its requests. Does it need full internet or private corporate access? Users must wait for their actions to either complete or time out while the application makes this determination when deciding how to handle restrictive or no network connectivity scenarios.

2323

2424 ### Active probing

2525

26 −An active probe can either be a request sent to a web probe server or a DNS lookup for a specific NCSI address. The server is hosted by Microsoft on the internet but can also be an enterprise’s own private probe server, which is a more uncommon scenario. When NCSI sends the probe and receives a valid response, it considers the client machine to have internet connectivity. If a user connects to a new wireless network that has no internet connectivity NCSI shouldn't wait for a passive probe to trend received packets during a network change event and triggers an active probe.

26 +An active probe can either be a request sent to a web probe server or a DNS lookup for a specific NCSI address. The server is hosted by Microsoft on the internet but can also be an enterprise’s own private probe server, which is a more uncommon scenario. When NCSI sends the probe and receives a valid response, it considers the client device to have internet connectivity.

2727

28 −When NCSI doesn’t detect internet connectivity, it doesn’t necessarily mean that there's an issue with active probing. It's more likely that the probe isn't completing due to the device, network configuration, or other environmental issue.

28 +When NCSI doesn’t detect internet connectivity, it's either that the probe is not completing, or the probe is completing with failure. Some reasons for not completing can be device, network configuration, or other environmental issues. An example of completing with a failure is receiving an **HTTP 403 Forbidden** response, usually indicating a proxy blocked the outbound probe.

2929

3030 > [!WARNING]

3131 > Do not disable active probing as a resolution to a NCSI issue as passive probing alone is unable to determine all network connectivity issues.

3232

33 −The HTTP probe hosts and contents are predefined and found in the following registry path: "**HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet**".

33 +The HTTP probe hosts and contents are predefined and found in the following registry path:

3434

35 −NCSI sends separate IPv4 and IPv6 active probes in parallel. During network connectivity, it's rare that the IPv6 probe is of concern. It's primarily the IPv4 probe that needs to succeed, although it's true that an IPv4 probe can fail and the IPv6 succeeds resulting in internet connectivity.

35 +```registry

36 +HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet

37 +```

3638

39 +NCSI sends separate IPv4 and IPv6 active probes in parallel. If either probe succeeds, NCSI determines that the device has network connectivity.

40 +

3741 ### Passive probing

3842

3943 Similar to active probing, passive probing uses learned information from received packets to determine network status. Both probing methods complement one another as they determine intermittent network conditions differently. Certain conditions prevent active probes from functioning correctly, such as, a temporary router having intermittent connectivity issue where a client machine doesn't experience any change in the interface state. No additional active probes are sent until the client machine changes to passive probing which can determine the connectivity status due to lack of inbound packets from the internet.

⋯ 14 unchanged lines

5458

5559 The most common problems with active probes not leaving enterprise network spaces to the internet are due to proxies:

5660

57 −- A proxy exists but isn't yet discovered by NCSI.

61 +- A proxy exists but isn't yet discovered.

5862 - A proxy was discovered by NCSI but the client machine can't reach it at the time of the probe.

5963 - The Proxy Auto-Config (PAC) file is misconfigured and hasn't mapped `www.msftconnecttest.com` to the correct proxy.

6064 - The proxy is misconfigured.

6165

62 −NCSI will detect a manually provisioned proxy address from the following registry path: "**HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\ManualProxies**".

66 +NCSI will detect a manually provisioned proxy address from the following registry path:

6367

68 +```registry

69 +HKLM\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet\ManualProxies

70 +```

71 +

6472 NCSI performs an active probe if the above fails including if there aren't any stored proxy information. To learn about additional reasons for proxy failures, see [when are proxy detection requests triggered?](ncsi-frequently-asked-questions.md#when-are-proxy-detection-requests-triggered) and [how are proxies detected?](ncsi-frequently-asked-questions.md#how-are-proxies-detected).

6573

6674 > [!TIP]

⋯ 3 unchanged lines

7078

7179 In the same way that NCSI detects proxies inside an enterprise in order to successfully navigate a probe to the internet, it also determines hindrances outside of an enterprise environment for consumers on mobile devices. Hotspots and captive portals are largely found in public environments such as airports, hospitals, coffee shops, etc. but can also be gateways in satellite extensions of enterprise networks.

7280

73 −Because most captive portals send an HTTP redirect in response to the probe instead of allowing it through to the internet, this is how NCSI is able to determine if it’s behind a hotspot as long as the conditions below are true:

81 +Captive portals may send an HTTP redirect or an empty response to the probe instead of allowing it through to the internet. This is how NCSI is able to determine if it’s behind a hotspot as long as the conditions below are true:

7482

7583 - An active HTTP probe was sent but not via a known proxy.

7684 - The probe got a response.

⋯ 8 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:22 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.