What does it do exactly if I click in the window of cmd?

Once you click into the Command Prompt window, the console host will no longer allow output to be written. The application itself keeps running, but nothing is written to the screen.

Of course, as long as there is only a single thread, this is basically the same thing as having your process frozen. As the single thread tries to write some output before doing more work.

If I run ping -t localhost and click into the command prompt window, I can then inspect the call stack of the main ping.exe thread with Process Explorer.

enter image description here

We can see that ping.exe tried to write some output. It called write() in the C runtime library. That function, at some point, calls GetConsoleMode. As it seems, that function will check if the user is currently in mark mode and block execution if needed.

Further Analysis

We can further proof this behavior by examining the behavior of ping with Wireshark

When running ping -t superuser.com we see the following output in Wireshark:
enter image description here

Now, let's mark a box in the command prompt.
enter image description here
Suddenly, no more pings are logged in Wireshark. ping is no longer sending any packets.

But we already knew that...

Right, let's see if the output is actually the issue here! Let's direct the output to the NUL device:

enter image description here

Now, there is no longer any ouput. We can now mark text in the box all day long, packets will be logged in Wireshark.

enter image description here


When you select some text in the cmd.exe window, the process will carry on in the background until the next time it writes to Standard Output (or STDOUT, the data stream which is shown in the cmd.exe window).

When you exit the selection mode, the process will resume as normal.

You can test this by typing ping www.google.com -t into your cmd.exe window, and selecting some area of the output. You'll see it pause, and when you deselect the output will resume.

Edit: As per Fran's comment, you can use a tool such as Wireshark to see that activity does still happen after the point when you made the selection, and then stops.


That is because the window has entered Mark mode. When you press enter, it copies the selected text to the clipboard. To my knowledge, there is no setting for this, so I'm not sure why it's doing that when you just click into the window. Normally you have to right click and hit "Mark". Check to make sure no keys are stuck on your keyboard.