How to List Available Wi-Fi Networks in Batch Script

Before you can connect to a network, you need to know what is available around you. Whether you are troubleshooting a hidden SSID or trying to find the strongest signal in a crowded office, having a list of visible Wi-Fi networks is the first step. While the Windows system tray provides a visual list, a Batch script can capture this data into a text file or variable. This allows you to build automation that, for example, only attempts to connect to a network if its signal strength is above a threshold, or logs all unrecognized access points in a high-security environment.

This guide will explain how to scan for Wi-Fi networks using netsh.

Method 1: Displaying All Visible Networks

The simplest way to see what is in the air is to run netsh wlan show networks. This lists every SSID your wireless adapter can detect, along with basic details like authentication type.

@echo off
setlocal

echo [SCAN] Searching for available Wi-Fi networks...
echo.

rem --- Verify the Wireless AutoConfig service is running ---
sc query WlanSvc 2>nul | findstr /i /c:"RUNNING" >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] The Wireless AutoConfig service is not running.
    echo [INFO] Start it with: net start WlanSvc
    echo [INFO] If this machine has no Wi-Fi adapter, this command is not available.
    endlocal
    pause
    exit /b 1
)

rem --- Show all visible networks ---
netsh wlan show networks

endlocal
pause

Why check WlanSvc first: If the Wireless AutoConfig service is stopped or the machine has no Wi-Fi adapter, netsh wlan show networks returns an error message. Checking the service first gives the user a clear explanation instead of a cryptic netsh error.

Method 2: Extracting SSID Names Only

If you want a clean list of network names, to feed into a connection script or compare against a whitelist, you need to filter out all the metadata and keep only the SSID values.

@echo off
setlocal enabledelayedexpansion

echo [NET] Visible Network Names:
echo ----------------------------------------

set "Count=0"

rem --- The basic "show networks" output contains lines like: ---
rem ---   SSID 1 : MyNetwork                                  ---
rem --- "SSID" is an industry acronym and does not change      ---
rem --- across Windows display languages.                      ---
rem --- BSSID lines do NOT appear in basic mode (no mode=bssid) ---

for /f "tokens=1,* delims=:" %%a in (
    'netsh wlan show networks 2^>nul ^| findstr /c:"SSID"'
) do (
    rem --- %%b contains everything after the first colon ---
    rem --- This preserves SSIDs that contain colons      ---
    set "Name=%%b"

    if defined Name (
        rem --- Trim the leading space after the colon ---
        set "Name=!Name:~1!"

        if defined Name (
            set /a Count+=1
            echo   !Count!. !Name!
        ) else (
            rem --- Empty name means a hidden network ---
            set /a Count+=1
            echo   !Count!. [Hidden Network]
        )
    ) else (
        set /a Count+=1
        echo   !Count!. [Hidden Network]
    )
)

echo ----------------------------------------

if !Count! equ 0 (
    echo [INFO] No networks found. Wi-Fi may be disabled.
) else (
    echo [INFO] !Count! network^(s^) detected.
)

endlocal
pause

Method 3: Deep Scan with Signal Strength and Channels

When troubleshooting interference or evaluating access point placement, you need the mode=bssid output, which shows signal percentages, radio types, and channel numbers for every detected access point.

Basic Deep Scan

@echo off
setlocal

echo [AUDIT] Capturing detailed Wi-Fi metadata...
echo.

rem --- Verify Wi-Fi service is available ---
sc query WlanSvc 2>nul | findstr /i /c:"RUNNING" >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Wireless AutoConfig service is not running.
    endlocal
    pause
    exit /b 1
)

rem --- "mode=bssid" shows signal strength, channel, and radio type ---
rem --- for every individual access point (not just per SSID)        ---
netsh wlan show networks mode=bssid

endlocal
pause

Extracting SSIDs from Deep Scan (Excluding BSSID)

When using mode=bssid, the output contains both SSID and BSSID lines. You must explicitly exclude BSSID to avoid capturing MAC addresses instead of network names.

@echo off
setlocal enabledelayedexpansion

echo [NET] SSIDs from deep scan (excluding BSSIDs^):
echo ------------------------------------------------

set "Count=0"

for /f "tokens=1,* delims=:" %%a in (
    'netsh wlan show networks mode^=bssid 2^>nul ^| findstr /c:"SSID"'
) do (
    rem --- Exclude lines where the label contains "BSSID" ---
    echo %%a | findstr /i /c:"BSSID" >nul
    if !errorlevel! neq 0 (
        set "Name=%%b"
        if defined Name (
            set "Name=!Name:~1!"
            if defined Name (
                set /a Count+=1
                echo   !Count!. !Name!
            ) else (
                set /a Count+=1
                echo   !Count!. [Hidden Network]
            )
        ) else (
            set /a Count+=1
            echo   !Count!. [Hidden Network]
        )
    )
)

echo ------------------------------------------------
echo [INFO] !Count! network^(s^) detected.

endlocal
pause

Method 4: Saving a Scan Report to File

For security audits and rogue access point detection, save the full scan results with a timestamp.

@echo off
setlocal

rem --- Build a timestamped filename ---
set "Timestamp=%date:~-4%%date:~-7,2%%date:~-10,2%_%time:~0,2%%time:~3,2%%time:~6,2%"
set "Timestamp=%Timestamp: =0%"
set "OutputFile=%~dp0wifi_scan_%Timestamp%.txt"

rem --- Verify Wi-Fi service ---
sc query WlanSvc 2>nul | findstr /i /c:"RUNNING" >nul 2>&1
if %errorlevel% neq 0 (
    echo [ERROR] Wireless AutoConfig service is not running.
    endlocal
    pause
    exit /b 1
)

echo [AUDIT] Saving Wi-Fi scan report...

(
    echo ============================================
    echo  Wi-Fi Scan Report
    echo  Date: %date%  Time: %time%
    echo  Computer: %COMPUTERNAME%
    echo  User: %USERNAME%
    echo ============================================
    echo.
    netsh wlan show networks mode=bssid
) > "%OutputFile%"

if exist "%OutputFile%" (
    echo [SUCCESS] Scan saved to:
    echo          %OutputFile%
) else (
    echo [ERROR] Failed to save scan report.
)

endlocal
pause

How to Avoid Common Errors

Wrong Way: Assuming Hidden Networks Are Invisible

If a router is configured to hide its SSID, it still appears in the scan, just with an empty name. A script that skips empty values will miss these entries entirely.

rem *** BAD: silently skips hidden networks ***
for /f "tokens=2 delims=:" %%a in ('netsh wlan show networks ^| findstr "SSID"') do echo %%a

Correct Way: Check for empty values explicitly and label them as hidden networks, as shown in Method 2.

Wrong Way: Using `tokens=2 delims=:` for SSID Extraction

SSID names can legally contain colon characters. Using tokens=2 captures only the text between the first and second colon, truncating the name.

rem *** BAD: truncates SSIDs containing colons ***
for /f "tokens=2 delims=:" %%a in (...) do set "SSID=%%a"

Correct Way: Use tokens=1,* delims=: so that %%b captures everything after the first colon, preserving the full SSID regardless of its content.

Wrong Way: Using `findstr /c:"SSID"` with `mode=bssid`

When you use netsh wlan show networks mode=bssid, the output includes both SSID and BSSID lines. A simple findstr /c:"SSID" matches both because BSSID contains the substring SSID.

rem *** BAD with mode=bssid - captures BSSID (MAC addresses) too ***
netsh wlan show networks mode=bssid | findstr /c:"SSID"

Correct Way: Either use the basic show networks command (which has no BSSID lines) or add a secondary filter to exclude BSSID matches, as shown in Method 3.

Problem: No Networks Found

If netsh returns no results, the Wi-Fi adapter might be disabled, the physical radio switch might be off, or the Wireless AutoConfig service (WlanSvc) might be stopped.

Solution: Check the service status before scanning and provide a clear diagnostic message.

Best Practices and Rules

1. The `SSID` Label Is Language-Independent

Unlike most netsh output labels (which are translated to the Windows display language), SSID and BSSID are industry-standard acronyms that remain the same in every language. This makes SSID extraction scripts inherently multilanguage-safe. However, labels like "Signal", "Channel", "Authentication", and "Network type" are translated. If you need to extract those fields across languages, match by value pattern rather than label text.

2. Basic Mode vs. `mode=bssid`

Use the basic netsh wlan show networks when you only need SSID names. It is simpler and avoids the BSSID confusion. Use mode=bssid when you need signal strength, channel, and radio type details for each individual access point.

3. Detect Rogue Access Points

In high-security environments, schedule a scan every hour and compare the results against a known whitelist. If an unrecognized SSID appears (like "Free_Public_WiFi"), it could indicate a phishing or evil-twin attack.

4. Understand Channel Crowding

In the mode=bssid output, the Channel field shows which frequency each access point uses. If many networks share the same channel (commonly 1, 6, or 11 on 2.4 GHz), performance suffers. Use this data to choose a less congested channel for your own router.

5. Scan Results Are Cached

The netsh wlan show networks command returns results from the adapter's most recent scan, not a live real-time sweep. The Windows wireless service scans periodically in the background. Results may be a few seconds old, and very briefly visible networks might not appear.

6. Use `setlocal` / `endlocal`

Always wrap scripts in setlocal and endlocal to prevent variables from leaking into the calling environment.

Conclusions

Listing available Wi-Fi networks via Batch script provides a data-driven view of your wireless environment. The key to reliable scripts is using tokens=1,* to preserve full SSID names, handling hidden networks gracefully, and understanding the difference between basic mode (clean SSID list) and mode=bssid (detailed per-access-point data including signal and channel). Since the SSID label is language-independent, these scripts work across all Windows display languages without modification. Whether you are building a connection automation tool, a security auditing system, or a simple diagnostic utility, these techniques give you reliable access to the wireless landscape around your machine.

Method 1: Displaying All Visible Networks​

Method 2: Extracting SSID Names Only​

Method 3: Deep Scan with Signal Strength and Channels​

Basic Deep Scan​

Extracting SSIDs from Deep Scan (Excluding BSSID)​

Method 4: Saving a Scan Report to File​

How to Avoid Common Errors​

Wrong Way: Assuming Hidden Networks Are Invisible​

Wrong Way: Using tokens=2 delims=: for SSID Extraction​

Wrong Way: Using findstr /c:"SSID" with mode=bssid​

Problem: No Networks Found​

Best Practices and Rules​

1. The SSID Label Is Language-Independent​

2. Basic Mode vs. mode=bssid​

3. Detect Rogue Access Points​

4. Understand Channel Crowding​

5. Scan Results Are Cached​

6. Use setlocal / endlocal​

Conclusions​

Table of Contents