AZ-104
Deep Dive
Azure Network Watcher is the hub for network diagnostics and monitoring. The AZ-104 evaluates its diagnostic tools: IP Flow Verify, Next Hop, NSG Flow Logs, and Connection Monitor for connectivity troubleshooting.
Contents
Azure Network Watcher is a regional service for monitoring, diagnosing, and visualizing network metrics in Azure. It is enabled automatically per region when network resources are created. It provides tools to diagnose connectivity issues, capture packets, view routes, and analyze traffic.
Connectivity diagnostics
Capture and analysis
Topology visualization
IP Flow Verify answers the question: "Why can't I connect from this VM to this IP on this port?". It evaluates the NSG rules applied to the VM's NIC and subnet, and tells you exactly which rule allows or blocks the traffic.
Required inputs
• VM and NIC: the source virtual machine
• Direction: Inbound or Outbound
• Protocol: TCP or UDP
• Local IP: the NIC's private IP
• Local port: source port
• Remote IP: destination IP of the traffic
• Remote port: destination port
Diagnostic output
Allow
Name of the NSG rule that allows the traffic. E.g.: AllowHTTPSFromInternet (priority 100)
Deny
Name of the NSG rule that blocks the traffic. E.g.: DenyAllInBound (priority 65500)
Only checks NSGs — does not check routing, Azure Firewall, or OS firewall.
Next Hop answers: "Where does traffic from this VM to this IP go out?". It evaluates the effective route table (system routes + UDRs) and shows the next hop — important for verifying that routing is as expected or for detecting incorrect routes.
Types of next hop it can show
When to use Next Hop
Connection Monitor runs continuous connectivity tests (not one-shot like IP Flow Verify) and records latency, packet loss, and availability metrics. Ideal for detecting intermittent network degradation.
Supported sources
Supported destinations
Metrics it provides
ChecksFailedPercent
% of checks that failed
RoundTripTimeMs
RTT latency in ms
ProbesFailedPercent
% of failed probes (legacy)
AvgRoundTripTimeMs
Average latency (legacy)
NSG Flow Logs record information about the IP traffic flowing through an NSG — including the 5-tuple (source IP, destination IP, source port, destination port, protocol), the action (Allow/Deny), and the connection state (TCP: Initiated, Established, Terminated).
Flow Log versions
Version 1
Records the basic 5-tuple + Allow/Deny. No throughput. For basic analysis.
Version 2
Everything from V1 + TCP connection state (INIT/SYN, SYN_ACK, FIN, RST) + bytes/packets per session. Recommended.
Storage and analysis
Packet Capture captures network packets from a specific VM without needing to connect to it. Packets are saved in PCAP format (compatible with Wireshark) in a Storage Account or directly on the VM.
Available filters
Requirements
Effective Security Rules
Shows all effective NSG rules (combination of subnet NSG + NIC NSG) for a specific NIC. Useful when you can't identify which NSG is blocking traffic.
Effective Routes
Shows the effective route table for a NIC: system routes + UDRs + propagated BGP routes. Complements Next Hop by showing the full table.
VPN Diagnostics
Runs diagnostics on a VPN Gateway or a specific VPN connection. Saves logs to a Storage Account for analysis. Identifies misconfigurations of IKE, PSK, etc.
Connection Troubleshoot
One-shot connectivity test between two endpoints. Shows whether there are NSG, routing, OS firewall issues, or whether the destination is unreachable. Different from Connection Monitor (which is continuous).
| Diagnostic question | Right tool |
|---|---|
| Which NSG rule is blocking this traffic? | IP Flow Verify |
| Where does this packet exit from this VM? | Next Hop |
| Is the connection between VM-A and VM-B losing packets? | Connection Monitor (continuous monitoring) |
| What combination of NSG rules applies to this NIC? | Effective Security Rules |
| What traffic has passed through this NSG in the last 30 minutes? | NSG Flow Logs + Traffic Analytics |
| What is this VM's full route table? | Effective Routes |
| I need to capture packets to analyze in Wireshark | Packet Capture |
| Why does the VPN tunnel between Azure and on-premises fail? | VPN Diagnostics |
Did you get this topic?
Test what you just learned
An administrator needs to know why a VM in Azure cannot connect to an on-premises IP on port 443. The VM has an NSG on both the subnet and the NIC. Which Network Watcher tool directly answers whether it is an NSG issue?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.