Network Monitoring and Diagnostics

When traffic doesn’t flow, you need tools to find out why. Azure Network Watcher and Azure Monitor provide a comprehensive diagnostic toolkit. The exam frequently tests which tool to use for which problem.

🎬 Video coming soon

~12:00

Simple explanation

Network monitoring is your CCTV system for cloud traffic. Without it, you’re blind when a VM can’t reach a database or a VPN tunnel drops. Azure gives you two toolkits: Network Watcher for specific diagnostic tests and Azure Monitor for big-picture metrics, alerts, and dashboards.

Network Watcher Tools

Network Watcher is automatically enabled per region when you have networking resources. Here are the key diagnostic tools:

Tool	What It Does	When to Use
IP Flow Verify	Checks if a packet is allowed or denied between two points, showing which NSG rule is responsible	”Why can’t VM-A talk to VM-B on port 443?”
Next Hop	Shows which next hop Azure routing will use for a specific source/destination	”Where is traffic to 10.20.5.10 going?”
Connection Troubleshoot	Tests end-to-end connectivity (TCP/ICMP) between source and destination, showing latency and hops	”Is the path from VM to SQL working?”
Packet Capture	Captures network packets on a VM NIC for deep analysis (saves to .cap file)	“I need to see exactly what traffic a VM is sending/receiving”
VPN Troubleshoot	Diagnoses VPN gateway connection issues, checks config, shows logs	”Why is my S2S VPN tunnel down?”
Effective Security Rules	Shows all NSG rules applied to a NIC (combined from subnet and NIC NSGs)	“What’s the effective ruleset on this VM?”

IP Flow Verify in Action

🏢 Ravi’s scenario: A developer reports that a VM in the Finance spoke (10.20.1.10) can’t reach a web server in the hub (10.10.10.20) on port 443.

Ravi runs IP Flow Verify:

Source: 10.20.1.10 (Finance VM)
Destination: 10.10.10.20 (Hub web server)
Port: 443
Protocol: TCP
Direction: Outbound

Result: “Access denied — NSG rule DenyAllOutbound at priority 4096 on subnet nsg-finance”

Ravi checks the NSG on the Finance subnet and finds there’s no explicit allow rule for port 443 to the hub. He adds the rule, and connectivity is restored.

Connection Monitor

Connection Monitor provides continuous monitoring of connectivity between Azure resources, on-premises machines, and external endpoints.

🏪 Sam’s scenario: Harbour Retail needs to continuously monitor the connection between Azure VMs and their payment provider’s API endpoint. Sam sets up Connection Monitor:

Test group: AzureVMs-to-PaymentAPI
Sources: VMs in the backend subnet (requires Network Watcher extension)
Destinations: payment.provider.com on port 443
Test configuration: TCP, check every 30 seconds
Alerts: Notify if failure rate exceeds 10% in a 5-minute window

Connection Monitor tracks:

Connectivity success/failure over time
Round-trip latency trends
Hop-by-hop path analysis
Alerts on degradation or failures

Exam Tip: Connection Monitor replaces the older “Network Performance Monitor” and “Connection Monitor (classic).” The exam references the current version.

Traffic Analytics

Traffic Analytics processes NSG flow logs and VNet flow logs to show visual, query-ready insights about your network traffic patterns.

What it reveals:

Which VMs communicate the most
Top talkers and bandwidth usage
Allowed vs denied traffic flows
Geographic traffic distribution
Malicious traffic detection (if integrated with Threat Intelligence)

Exam Tip — Flow Log Types: Azure has two flow log types:

NSG flow logs — the original, captures per-NSG rule decisions

VNet flow logs — the modern replacement, captures all traffic in a VNet regardless of NSG. VNet flow logs are simpler to manage and provide better coverage. The exam may test that VNet flow logs are the recommended approach.

Both flow log types write to a Storage Account. Traffic Analytics reads from storage, processes with a Log Analytics workspace, and presents dashboards.

Azure Monitor for Networks

Azure Monitor provides Network Insights — a unified dashboard for all network resources:

Resource	Key Metrics to Monitor
VPN Gateway	Tunnel bandwidth, tunnel ingress/egress bytes, P2S connection count, BGP peer status
ExpressRoute	Circuit bandwidth utilisation, BGP availability, bits per second in/out
Load Balancer	Health probe status, SNAT connection count, data path availability, byte/packet counts
Application Gateway	Healthy/unhealthy host count, throughput, response status (2xx/4xx/5xx), backend response time
Azure Firewall	Throughput, rule hits, SNAT utilisation, latency, application/network rule processing time

Setting up network monitoring:

Diagnostic settings — route resource logs to Log Analytics, Storage, or Event Hub
Metrics — available automatically; create alerts on thresholds
Network Insights — pre-built dashboards in Azure Monitor

Network Watcher vs Azure Monitor for Networks
Aspect	Network Watcher	Azure Monitor for Networks
Primary purpose	Diagnostic and troubleshooting tools for specific issues	Unified monitoring dashboards, metrics, and alerting
Scope	Per-resource diagnostics (specific VM, NSG, VPN)	Cross-resource monitoring (all network resources)
Key tools	IP Flow Verify, Next Hop, Connection Troubleshoot, Packet Capture	Network Insights dashboards, metrics, log queries
Alerting	Connection Monitor alerts on connectivity degradation	Metric alerts, log alerts, and action groups
Flow analysis	NSG flow logs and VNet flow logs with Traffic Analytics	Log Analytics workspace queries on diagnostic logs
Cost	Free (except storage for flow logs and packet captures)	Log Analytics ingestion and retention costs

Building Network Alerts

Essential alerts for production networks:

VPN Gateway:

Tunnel connected state drops below 1 (tunnel down)
Tunnel bandwidth drops below threshold

ExpressRoute:

BGP availability drops below 100%
Circuit utilisation exceeds 80%

Load Balancer:

Health probe status drops below 100% (backend unhealthy)
SNAT connection count approaching limit

Azure Firewall:

Health state drops below 100%
SNAT utilisation exceeds 80%

Use Azure Monitor action groups to send alerts via email, SMS, webhook, or trigger Logic Apps for automated remediation.

Key Takeaways

IP Flow Verify tells you which NSG rule is blocking/allowing traffic
Next Hop shows routing decisions; Connection Troubleshoot tests end-to-end
Connection Monitor provides continuous connectivity monitoring with alerts
VNet flow logs are the modern replacement for NSG flow logs
Azure Monitor Network Insights gives a unified view across all network resources

Test Your Knowledge

Question

What's the difference between IP Flow Verify and Next Hop?

Click or press Enter to reveal answer

Answer

IP Flow Verify checks NSG rules — is the packet allowed or denied? Next Hop checks routing — where will Azure send the packet? Use IP Flow Verify for security issues, Next Hop for routing issues.

Click to flip back

Question

What are VNet flow logs and how do they differ from NSG flow logs?

Click or press Enter to reveal answer

Answer

VNet flow logs capture all traffic flowing through a VNet regardless of NSG rules. NSG flow logs only capture traffic evaluated by a specific NSG. VNet flow logs are the modern, recommended approach — simpler to manage and better coverage.

Click to flip back

Question

What does Connection Monitor do?

Click or press Enter to reveal answer

Answer

Continuously monitors connectivity between sources (Azure VMs, on-prem machines) and destinations (Azure resources, external endpoints). Tracks success/failure, latency, and path. Supports alerting on degradation.

Click to flip back

Question

Which Network Watcher tool helps diagnose VPN tunnel issues?

Click or press Enter to reveal answer

Answer

VPN Troubleshoot — it diagnoses VPN gateway and connection issues, checking configuration, certificate validity, and showing detailed logs. Connection Troubleshoot can also test end-to-end connectivity through the VPN.

Click to flip back

Knowledge Check

Ravi's VM can't reach a web server. He suspects an NSG is blocking the traffic. Which Network Watcher tool should he use first?

Knowledge Check

Sam needs to continuously monitor the connection between his Azure VMs and an external payment API, with alerts on failure. What should he configure?

Next up: DDoS Protection and Security Posture — Protect your networks from DDoS attacks and assess your security posture with Microsoft Defender for Cloud.