Azure Network Watcher

What is Network Watcher?

Network Watcher is automatically enabled in each region when you create a VNet. It provides monitoring, diagnostics, and logging capabilities for Azure IaaS networking. All tools are accessible from the Azure Portal under Network Watcher.

IP Flow Verify

IP Flow Verify tests whether traffic between a VM and a specific endpoint is allowed or denied by NSG rules — and which specific rule is responsible. The most useful first-step troubleshooting tool when connectivity fails.

What You Specify

• VM and its NIC
• Direction (inbound or outbound)
• Protocol (TCP or UDP)
• Local IP and port
• Remote IP and port

What You Get

Allowed or Denied — and the name of the specific NSG rule causing the allow/deny decision.

# Check if inbound TCP port 80 from internet is allowed
az network watcher test-ip-flow \
  --direction Inbound \
  --protocol TCP \
  --remote-ip 1.2.3.4 \
  --remote-port 80 \
  --local-ip 10.0.1.4 \
  --local-port 80 \
  --vm myVM \
  --resource-group myRG

Next Hop

Next Hop shows the routing path — where would a packet go from a VM to a destination IP? This reveals whether traffic is being routed correctly, going through Azure Firewall, or taking an unexpected route.

# Find next hop from VM to destination IP
az network watcher show-next-hop \
  --dest-ip 8.8.8.8 \
  --vm myVM \
  --source-ip 10.0.1.4 \
  --resource-group myRG

Packet Capture

Packet Capture records network packets flowing through a VM's NIC — similar to running Wireshark on the VM. Useful for deep-dive traffic analysis, performance issues, or security investigations.

How It Works

• Requires the Network Watcher agent extension on the VM
• Captures to a Storage Account blob or local VM file
• You can filter by protocol, local/remote IP, port
• Stops automatically after a time limit or file size limit

# Start packet capture (saves to storage account)
az network watcher packet-capture create \
  --name myCapture \
  --resource-group myRG \
  --vm myVM \
  --storage-account mystorageaccount2026 \
  --time-limit 60 \
  --filters '[{"protocol":"TCP","remotePort":"443"}]'

NSG Flow Logs

NSG Flow Logs record information about IP traffic flowing through an NSG. Every connection attempt — allowed or denied — is logged with: source/destination IP, port, protocol, direction, and allow/deny decision.

Flow Log Versions

• Version 1 — Basic flow information
• Version 2 — Adds bytes and packets transferred per flow

Traffic Analytics

Process NSG Flow Logs through Traffic Analytics (requires Log Analytics workspace) for visualisations, anomaly detection, and query-based investigation across your entire network.

# Enable flow logs on an NSG
az network watcher flow-log create \
  --name myFlowLog \
  --nsg myNSG \
  --resource-group myRG \
  --storage-account mystorageaccount2026 \
  --enabled true \
  --format JSON \
  --log-version 2 \
  --retention 30

Connection Monitor

Connection Monitor provides continuous end-to-end monitoring of network connections. Unlike IP Flow Verify (one-time test), Connection Monitor runs periodically and alerts you when connectivity degrades or fails.

What It Monitors

• Latency between source and destination
• Packet loss percentage
• Pass/fail of connectivity checks
• Hop-by-hop path analysis

Sources can be Azure VMs or on-premises servers (with monitoring agent). Destinations can be Azure resources, internet endpoints, or on-premises resources.

VPN Diagnostics

Diagnose issues with VPN Gateway connections — tests the health of a VPN connection and generates a detailed diagnostic report about the gateway, tunnels, and traffic flows. Useful when S2S VPN connections fail or have intermittent issues.

Network Topology

Generates a visual map of your network resources — VNets, subnets, VMs, NICs, NSGs, public IPs, and their relationships. Gives a bird's-eye view of your entire network architecture without having to manually trace relationships.

# Export topology for a resource group
az network watcher show-topology \
  --resource-group myRG \
  --location centralindia