Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.

2.4.1. Azure Network Watcher

Network Watcher is your primary diagnostics toolkit for Azure networking. It's automatically enabled per region when you deploy networking resources.

Key Tools:
ToolPurposeUse Case
IP flow verifyTest if traffic is allowed/denied"Why can't VM A reach VM B?"
Next hopDetermine routing path"Where does traffic to 10.0.0.1 go?"
Connection troubleshootEnd-to-end connectivity test"Is the path to SQL Server healthy?"
Packet captureCapture packets on VMsDeep troubleshooting
NSG flow logsLog traffic through NSGsSecurity auditing
VNet flow logsLog traffic in VNetsCompliance, analysis
Traffic analyticsVisualize flow dataTrend analysis, anomaly detection
TopologyVisual network mapDocumentation, understanding
IP Flow Verify Example:

Test if VM can reach port 443 on 10.1.0.5:

Input: 
  - Source VM: VM1
  - Direction: Outbound
  - Protocol: TCP
  - Source IP: 10.0.1.4
  - Source Port: 60000
  - Destination IP: 10.1.0.5
  - Destination Port: 443

Output:
  - Access: Denied
  - Rule: DefaultDenyAllOutbound
  - NSG: vm1-nsg
Alvin Varughese
Written byAlvin Varughese
Founder•15 professional certifications