Azure Network Watcher

Network Watcher provides a built-in packet capture tool that allows you to record traffic directly from an active Azure Virtual Machine without logging into the OS. You must create a Network Watcher instance in the specific Azure region where your resources are deployed. The resulting capture file can be automatically saved to an Azure Storage account for deep security analysis in tools like Wireshark.

The Connection Troubleshoot feature within Network Watcher is specifically designed to diagnose connectivity issues across hybrid architectures. It provides topology visualization and checks the routing rules, security groups, and border gateway protocol status between an on-premises IP and an Azure VM. This allows network administrators to pinpoint exactly where a packet is being dropped along the connection.

To utilize advanced diagnostics like packet capture or specific deep network troubleshooting, you must have the Network Watcher Agent virtual machine extension installed. This lightweight extension runs silently in the background of your Windows or Linux VMs. Basic features, like topology visualization of your Virtual Networks, do not require the agent as they analyze the Azure backbone directly.