Azure Network Watcher Troubleshooting Complete Guide: Connection Troubleshoot, IP Flow Verify, Packet Capture

Azure Network Watcher is a Microsoft managed service that unifies monitoring, diagnostics, and troubleshooting for Azure networking. One instance is automatically created per region (you must enable Network Watcher in the target region within a subscription). Key capabilities: 1) Connection Troubleshoot (connectivity diagnostics between any two resources); 2) IP Flow Verify (NSG rule evaluation simulation); 3) Next Hop (routing decision check); 4) NSG Diagnostic (detailed NSG evaluation results); 5) Packet Capture (VM packet capture); 6) NSG Flow Logs (full NSG traffic logs); 7) Connection Monitor (continuous connectivity monitoring); 8) Traffic Analytics (flow aggregation and visualization); 9) Topology (auto-generated network diagrams); 10) Effective Routes / Security Rules (effective route and security rule display). It is the core of Azure network troubleshooting and is tested in depth on AZ-700.

Connection Troubleshoot diagnoses connectivity between two Azure resources (VM to VM, VM to Storage, VM to App Service, VM to FQDN). Flow: 1) Specify a source resource (VM); 2) Specify a destination (IP / FQDN / Azure resource); 3) Specify the port (e.g., 443); 4) Run the test - it shows results and latency per hop; 5) On failure it pinpoints the root cause (NSG deny, UDR misconfiguration, NIC configuration, firewall block). You can run it from the Azure Portal GUI, Azure CLI (az network watcher connectivity), PowerShell (Test-AzNetworkWatcherConnectivity), or the REST API. In production, when you hit issues like 'VM A cannot reach VM B' or 'App Service cannot connect to SQL DB', running Connection Troubleshoot first to isolate the cause is the standard playbook.

IP Flow Verify simulates whether a specific packet (source IP, source port, destination IP, destination port, protocol) will be allowed or denied by NSG rules. It evaluates NSG rules without actually sending packets. Typical use cases: 1) Impact assessment before changing NSG rules (validate without affecting production); 2) Isolating NSGs as the cause of connectivity issues; 3) Compliance auditing (proving certain traffic is blocked). Flow: 1) Specify the source/destination NIC or IP; 2) Specify the protocol (TCP / UDP); 3) Specify source/destination ports; 4) Specify direction (Inbound / Outbound); 5) Run it - it shows Allow/Deny plus the name of the applied rule. Unlike Connection Troubleshoot which is traffic-based, IP Flow Verify is a static simulation that returns results instantly. It is an essential tool for validating NSG changes before production rollout.

Packet Capture directly captures network packets inside a VM (.cap format that Wireshark can open). The VM Extension (Network Watcher Agent) must be installed (Windows / Linux both supported). Setup: 1) Specify a Storage Account (where capture files are saved); 2) Filter (narrow targets by source IP, destination IP, protocol, port); 3) Maximum Bytes per Packet / Maximum Bytes per Session / Time Limit; 4) Start - capture runs automatically. Typical use cases: 1) Header/Payload analysis of inter-app communication; 2) Root-causing TLS handshake failures; 3) Investigating DNS resolution issues; 4) Performance issues (re-transmission, window size); 5) Forensic investigation of security attacks. In production, watch out for Storage Account egress costs (large data writes) - the standard pattern is to narrow the scope with a filter before capturing.

Connection Monitor periodically runs connectivity tests on a continuous basis to monitor availability and latency. Whereas Connection Troubleshoot is a one-shot execution, Connection Monitor performs continuous tests from a source agent (VM) to a destination (Azure resource or external endpoint) at intervals from 30 seconds to 30 minutes. Typical monitoring scenarios: 1) Continuous monitoring of DB connectivity from each region of a multi-region web app; 2) Long-term latency tracking of on-prem-to-Azure VPN connections; 3) Connectivity monitoring against external APIs (Stripe, SendGrid); 4) Capturing latency baselines for AKS pod-to-pod traffic. Integrated with Azure Monitor Alert to notify SOC on connectivity degradation, and visualized via Workbooks. In production, this is an important capability used continuously as an SLA/SLO indicator - combine it with Application Insights for end-to-end observability.

Traffic Analytics aggregates NSG Flow Logs into Log Analytics and provides visualization and insight. NSG Flow Logs (raw logs) are voluminous and hard to analyze, but Traffic Analytics ships pre-aggregated, pre-visualized dashboards out of the box. Typical reports: 1) Top Talker (source/destination IPs with the highest traffic); 2) Geo Map (traffic by country); 3) Blocked Traffic (aggregation of denied traffic); 4) Application Port (traffic by TCP 443, 80, etc.); 5) VNet-to-VNet traffic; 6) VM to public internet traffic volume. Use monthly reports to visualize organizational network usage and drive cost optimization and security anomaly detection. Cost: only the additional Log Analytics workspace capacity (Traffic Analytics itself is free). In production, integration with Microsoft Sentinel for SOC-driven anomaly traffic detection is the standard pattern.

Standard isolation flow: 1) Issue report (e.g., VM A cannot reach VM B); 2) Run actual connectivity test with Connection Troubleshoot - pinpoint the failing hop; 3) Verify NSG rule evaluation with IP Flow Verify (static simulation); 4) Verify UDR routing with Next Hop (e.g., is it going via the Hub Firewall in a Hub-Spoke topology); 5) Confirm effective configuration via Effective Routes / Security Rules; 6) For DNS issues, verify FQDN resolution with Connection Troubleshoot or use Network Watcher's DNS Diagnostic; 7) If packet-level analysis is needed, capture via Packet Capture and analyze in Wireshark; 8) For persistent issues, use Connection Monitor for long-term trend analysis. In most cases the root cause is identified at Steps 2-3 (NSG misconfiguration, UDR misconfiguration, FQDN resolution failure), so starting with Connection Troubleshoot is the most efficient approach.

AZ-700 (Network Engineer Associate) tests Network Watcher in depth and is the flagship certification for this area (all features: Connection Troubleshoot, IP Flow Verify, Next Hop, Packet Capture, Connection Monitor). AZ-104 (Administrator) covers the basics in Domain 4, AZ-305 (Solutions Architect Expert) addresses architect-level monitoring design, SC-100 (Cybersecurity Architect Expert) covers SOC-side troubleshooting, and SC-200 (Security Operations Analyst) covers sending NSG Flow Logs to Microsoft Sentinel for anomaly detection. Understanding Network Watcher is essential skill for Azure network engineers, SREs, and SOC analysts.