Skip to content

Commit 35776a6

Browse files
JamesJBarnettJamesJBarnett
authored
Merge pull request #251173 from halkazwini/nw-ct
Update response table and other tweaks
2 parents 332d9c5 + fcc7b4d commit 35776a6

File tree

1 file changed

+67
-41
lines changed

1 file changed

+67
-41
lines changed

‎articles/network-watcher/network-watcher-connectivity-overview.md

Lines changed: 67 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,13 @@
11
---
22
title: Connection troubleshoot overview
33
titleSuffix: Azure Network Watcher
4-
description: Learn about Azure Network Watcher connection troubleshoot capability.
5-
services: network-watcher
4+
description: Learn about Azure Network Watcher connection troubleshoot tool, the issues it can detect, and the responses it gives.
65
author: halkazwini
7-
ms.service: network-watcher
8-
ms.topic: conceptual
9-
ms.workload: infrastructure-services
10-
ms.date: 03/22/2023
116
ms.author: halkazwini
12-
ms.custom: template-concept, engagement-fy23
7+
ms.service: network-watcher
8+
ms.topic: concept-article
9+
ms.date: 09/13/2023
10+
#CustomerIntent: As an Azure administrator, I want to learn what connectivity problems I can use Connection Troubleshoot to diagnose so I can resolve those problems.
1311
---
1412

1513
# Connection troubleshoot overview
@@ -67,29 +65,55 @@ Connection troubleshoot can detect the following types of issues that can impact
6765

6866
The following table shows the properties returned after running connection troubleshoot.
6967

70-
|**Property** |**Description** |
71-
|---------|---------|
72-
|ConnectionStatus | The status of the connectivity check. Possible results are **Reachable** and **Unreachable**. |
73-
|AvgLatencyInMs | Average latency during the connectivity check, in milliseconds. (Only shown if check status is reachable) |
74-
|MinLatencyInMs | Minimum latency during the connectivity check, in milliseconds. (Only shown if check status is reachable) |
75-
|MaxLatencyInMs | Maximum latency during the connectivity check, in milliseconds. (Only shown if check status is reachable) |
76-
|ProbesSent | Number of probes sent during the check. Max value is 100. |
77-
|ProbesFailed | Number of probes that failed during the check. Max value is 100. |
78-
|Hops | Hop by hop path from source to destination. |
79-
|Hops[].Type | Type of resource. Possible values are **Source**, **VirtualAppliance**, **VnetLocal**, and **Internet**. |
80-
|Hops[].Id | Unique identifier of the hop.|
81-
|Hops[].Address | IP address of the hop.|
82-
|Hops[].ResourceId | ResourceID of the hop if the hop is an Azure resource. If it's an internet resource, ResourceID is **Internet**. |
83-
|Hops[].NextHopIds | The unique identifier of the next hop taken.|
84-
|Hops[].Issues | A collection of issues that were encountered during the check at that hop. If there were no issues, the value is blank.|
85-
|Hops[].Issues[].Origin | At the current hop, where issue occurred. Possible values are:<br/> **Inbound** - Issue is on the link from the previous hop to the current hop<br/>**Outbound** - Issue is on the link from the current hop to the next hop<br/>**Local** - Issue is on the current hop.|
86-
|Hops[].Issues[].Severity | The severity of the issue detected. Possible values are **Error** and **Warning**. |
87-
|Hops[].Issues[].Type |The type of issue found. Possible values are: <br/>**CPU**<br/>**Memory**<br/>**GuestFirewall**<br/>**DnsResolution**<br/>**NetworkSecurityRule**<br/>**UserDefinedRoute** |
88-
|Hops[].Issues[].Context |Details regarding the issue found.|
89-
|Hops[].Issues[].Context[].key |Key of the key value pair returned.|
90-
|Hops[].Issues[].Context[].value |Value of the key value pair returned.|
91-
92-
The following is an example of an issue found on a hop.
68+
| Property | Description |
69+
| -------- | ----------- |
70+
| ConnectionStatus | The status of the connectivity check. Possible results are **Reachable** and **Unreachable**. |
71+
| AvgLatencyInMs | Average latency during the connectivity check, in milliseconds. (Only shown if check status is reachable). |
72+
| MinLatencyInMs | Minimum latency during the connectivity check, in milliseconds. (Only shown if check status is reachable). |
73+
| MaxLatencyInMs | Maximum latency during the connectivity check, in milliseconds. (Only shown if check status is reachable). |
74+
| ProbesSent | Number of probes sent during the check. Maximum value is 100. |
75+
| ProbesFailed | Number of probes that failed during the check. Maximum value is 100. |
76+
| Hops | Hop by hop path from source to destination. |
77+
| Hops[].Type | Type of resource. Possible values are: **Source**, **VirtualAppliance**, **VnetLocal**, and **Internet**. |
78+
| Hops[].Id | Unique identifier of the hop. |
79+
| Hops[].Address | IP address of the hop. |
80+
| Hops[].ResourceId | Resource ID of the hop if the hop is an Azure resource. If it's an internet resource, ResourceID is **Internet**. |
81+
| Hops[].NextHopIds | The unique identifier of the next hop taken. |
82+
| Hops[].Issues | A collection of issues that were encountered during the check of the hop. If there were no issues, the value is blank. |
83+
| Hops[].Issues[].Origin | At the current hop, where issue occurred. Possible values are: <br>**Inbound** - Issue is on the link from the previous hop to the current hop. <br>**Outbound** - Issue is on the link from the current hop to the next hop. <br>**Local** - Issue is on the current hop. |
84+
| Hops[].Issues[].Severity | The severity of the detected issue. Possible values are: **Error** and **Warning**. |
85+
| Hops[].Issues[].Type | The type of the detected issue. Possible values are: <br>**CPU** <br>**Memory** <br>**GuestFirewall** <br>**DnsResolution** <br>**NetworkSecurityRule** <br>**UserDefinedRoute** |
86+
| Hops[].Issues[].Context | Details regarding the detected issue. |
87+
| Hops[].Issues[].Context[].key | Key of the key value pair returned. |
88+
| Hops[].Issues[].Context[].value | Value of the key value pair returned. |
89+
| NextHopAnalysis.NextHopType | The type of next hop. Possible values are: <br>**HyperNetGateway** <br>**Internet** <br>**None** <br>**VirtualAppliance** <br>**VirtualNetworkGateway** <br>**VnetLocal** |
90+
| NextHopAnalysis.NextHopIpAddress | IP address of next hop. |
91+
| | The resource identifier of the route table associated with the route being returned. If the returned route doesn't correspond to any user created routes, then this field will be the string **System Route**. |
92+
| SourceSecurityRuleAnalysis.Results[].Profile | Network configuration diagnostic profile. |
93+
| SourceSecurityRuleAnalysis.Results[].Profile.Source | Traffic source. Possible values are: *, **IP Address/CIDR**, and **Service Tag**. |
94+
| SourceSecurityRuleAnalysis.Results[].Profile.Destination | Traffic destination. Possible values are: *, **IP Address/CIDR**, and **Service Tag**. |
95+
| SourceSecurityRuleAnalysis.Results[].Profile.DestinationPort | Traffic destination port. Possible values are: * and a single port in the (0 - 65535) range. |
96+
| SourceSecurityRuleAnalysis.Results[].Profile.Protocol | Protocol to be verified. Possible values are: *, **TCP** and **UDP**. |
97+
| SourceSecurityRuleAnalysis.Results[].Profile.Direction | The direction of the traffic. Possible values are: **Outbound** and **Inbound**. |
98+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult | Network security group result. |
99+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.EvaluatedSecurityGroups[] | List of results network security groups diagnostic. |
100+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.SecurityRuleAccessResult | The network traffic is allowed or denied. Possible values are: **Allow** and **Deny**. |
101+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.EvaluatedSecurityGroups[].AppliedTo | Resource ID of the NIC or subnet to which network security group is applied. |
102+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.EvaluatedSecurityGroups[].MatchedRule | Matched network security rule. |
103+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.EvaluatedSecurityGroups[].MatchedRule.Action | The network traffic is allowed or denied. Possible values are: **Allow** and **Deny**. |
104+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.EvaluatedSecurityGroups[].MatchedRule.RuleName | Name of the matched network security rule. |
105+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.EvaluatedSecurityGroups[].NetworkSecurityGroupId | Network security group ID. |
106+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.RulesEvaluationResult[] | List of network security rules evaluation results. |
107+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.RulesEvaluationResult[].DestinationMatched | Value indicates if destination is matched. Boolean values. |
108+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.RulesEvaluationResult[].DestinationPortMatched | Value indicates if destination port is matched. Boolean values. |
109+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.RulesEvaluationResult[].Name | Name of the network security rule. |
110+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.RulesEvaluationResult[].ProtocolMatched | Value indicates if protocol is matched. Boolean values. |
111+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.RulesEvaluationResult[].SourceMatched | Value indicates if source is matched. Boolean values. |
112+
| SourceSecurityRuleAnalysis.Results[].NetworkSecurityGroupResult.RulesEvaluationResult[].SourcePortMatched | Value indicates if source port is matched. Boolean values. |
113+
| SourcePortStatus | Determines whether the port at source is reachable or not. Possible Values are: <br>**Unknown** <br>**Reachable** <br>**Unstable** <br>**NoConnection** <br>**Timeout** |
114+
| DestinationPortStatus | Determines whether the port at destination is reachable or not. Possible Values are: <br>**Unknown** <br>**Reachable** <br>**Unstable** <br>**NoConnection** <br>**Timeout** |
115+
116+
The following example shows an issue found on a hop.
93117

94118
```json
95119
"Issues": [
@@ -106,20 +130,22 @@ The following is an example of an issue found on a hop.
106130
}
107131
]
108132
```
133+
109134
## Fault types
110135

111-
Connection troubleshoot returns fault types about the connection. The following table provides a list of the current fault types returned.
136+
Connection troubleshoot returns fault types about the connection. The following table provides a list of the possible returned fault types.
112137

113-
|**Type** |**Description** |
114-
|---------|---------|
115-
|CPU | High CPU utilization. |
116-
|Memory | High Memory utilization. |
117-
|GuestFirewall | Traffic is blocked due to a virtual machine firewall configuration. <br><br> A TCP ping is a unique use case in which, if there's no allowed rule, the firewall itself responds to the client's TCP ping request even though the TCP ping doesn't reach the target IP address/FQDN. This event isn't logged. If there's a network rule that allows access to the target IP address/FQDN, the ping request reaches the target server and its response is relayed back to the client. This event is logged in the Network rules log. |
118-
|DNSResolution | DNS resolution failed for the destination address. |
119-
|NetworkSecurityRule | Traffic is blocked by a network security group rule (security rule is returned) |
120-
|UserDefinedRoute|Traffic is dropped due to a user defined or system route. |
138+
| Type | Description |
139+
| ---- | ----------- |
140+
| CPU | High CPU utilization. |
141+
| Memory | High Memory utilization. |
142+
| GuestFirewall | Traffic is blocked due to a virtual machine firewall configuration. <br><br> A TCP ping is a unique use case in which, if there's no allowed rule, the firewall itself responds to the client's TCP ping request even though the TCP ping doesn't reach the target IP address/FQDN. This event isn't logged. If there's a network rule that allows access to the target IP address/FQDN, the ping request reaches the target server and its response is relayed back to the client. This event is logged in the network rules log. |
143+
| DNSResolution | DNS resolution failed for the destination address. |
144+
| NetworkSecurityRule | Traffic is blocked by a network security group rule (security rule is returned). |
145+
| UserDefinedRoute | Traffic is dropped due to a user defined or system route. |
121146

122147
### Next steps
123148

124-
- To learn how to use connection troubleshoot to test and troubleshoot connections, see [Troubleshoot connections with Azure Network Watcher using the Azure portal](network-watcher-connectivity-portal.md).
125-
- To learn more about Network Watcher and its other capabilities, see [What is Azure Network Watcher?](network-watcher-monitoring-overview.md).
149+
To learn how to use connection troubleshoot to test and troubleshoot connections, continue to:
150+
> [!div class="nextstepaction"]
151+
> [Troubleshoot connections using the Azure portal](network-watcher-connectivity-portal.md)

0 commit comments

Comments
 (0)