DevOps Peach

Azure Basics · Azure Monitor – Metrics, Logs, Alerts, Log Analytics, Network Watcher · Lesson 5 of 5

Network Watcher — Network Diagnostics

Network Watcher is a regional service with IP Flow Verify (which NSG rule blocks a packet), Next Hop (where a route goes), Connection troubleshoot, VPN diagnostics, flow logs and Topology.

Practice interactively →

Network Watcher provides monitoring and diagnostic tools for IaaS resources in a VNet. It is a regional service: it must be on in the VNet's region (usually created automatically in NetworkWatcherRG).

Tool Question it answers Result
IP Flow Verify Is a packet to/from the VM allowed or denied? Allow/Deny + the NSG rule name
Next Hop Where does traffic from the VM go next? Next hop type (Internet, VnetLocal, VirtualAppliance, VirtualNetworkGateway, None) + IP + route table
Connection troubleshoot Can a source VM reach a destination (IP/FQDN:port)? Reachable, latency, failing hop
VPN diagnostics What is wrong with a VPN gateway/connection? Health report
Flow logs Which IPs flow where? Logs in storage; VNet flow logs replace NSG flow logs (being retired)
Topology Which resources are in a VNet, and how are they linked? Diagram 
flowchart LR
  VM["vm-web<br/>10.10.1.4"] --> IPF{"IP Flow Verify<br/>TCP 22 from 203.0.113.10"}
  IPF --> NSG["Allow — rule SSH"]
  VM --> NH{"Next Hop<br/>to 10.10.2.4"}
  NH --> RT["VnetLocal — System Route"]
  VM --> CT["Connection troubleshoot<br/>to example.com:443"]

Traps: using Next Hop to check an NSG (wrong tool); forgetting Network Watcher is regional; new NSG flow logs can no longer be created, so use VNet flow logs.

Command Meaning
az network watcher configure -g NetworkWatcherRG -l southeastasia --enabled true Turn on per region
az network watcher test-ip-flow -g rg-devops-lab --vm vm-web --direction Inbound --protocol TCP --local 10.10.1.4:22 --remote 203.0.113.10:50000 IP Flow Verify
az network watcher show-next-hop -g rg-devops-lab --vm vm-web --source-ip 10.10.1.4 --dest-ip 10.10.2.4 Next Hop

Continuous checks with Connection Monitor

Connection troubleshoot answers one question once; Connection Monitor runs the same kind of test continuously between sources (VMs, scale sets, on-premises machines with the Azure Monitor Agent) and destinations (IPs, URLs, ports). It records latency and packet loss over time, draws the path hop by hop, and can alert when checks fail. It suits monitoring the link from an office to Azure or between two regions.

Packet capture

When rule and route checks look correct but traffic still misbehaves, packet capture records real packets on a VM's NIC:

az network watcher packet-capture create -g rg-devops-lab --vm vm-web -n cap-web --storage-account stdevopslab01 --time-limit 300

It uses the Network Watcher VM extension and stores a .cap file you open in Wireshark. Filters on IP and port keep files small.

Traffic Analytics

Traffic Analytics processes VNet flow logs in a Log Analytics workspace and shows which hosts talk to which, top talkers, traffic from malicious IPs, and open ports that receive internet traffic. It turns raw flow records into answers for security reviews.

Related views

Effective security rules and effective routes on a NIC show the combined NSGs and routes actually applied, and NSG diagnostics checks a flow against every NSG on the path. Network insights in Azure Monitor gives a dashboard of network resource health across subscriptions.

A troubleshooting order

Step Tool
1. Does the name resolve correctly? nslookup from the VM
2. Is the packet allowed? IP Flow Verify, NSG diagnostics
3. Is the route right? Next Hop, effective routes
4. Is the port reachable end to end? Connection troubleshoot
5. What is really on the wire? Packet capture

Working through the layers in order avoids changing NSGs when the real problem is DNS or a route.

Practice interactively →