az network watcher

Commands

az network watcher configure	Configure the Network Watcher service for different regions.
az network watcher connection-monitor	Manage connection monitoring between an Azure Virtual Machine and any IP resource.
az network watcher connection-monitor create	Create a connection monitor.
az network watcher connection-monitor delete	Delete a connection monitor for the given region.
az network watcher connection-monitor endpoint	Manage endpoint of a connection monitor.
az network watcher connection-monitor endpoint add	Add an endpoint to a connection monitor.
az network watcher connection-monitor endpoint list	List all endpoints form a connection monitor.
az network watcher connection-monitor endpoint remove	Remove an endpoint from a connection monitor.
az network watcher connection-monitor endpoint show	Show an endpoint from a connection monitor.
az network watcher connection-monitor list	List connection monitors for the given region.
az network watcher connection-monitor output	Manage output of connection monitor.
az network watcher connection-monitor output add	Add an output to a connection monitor.
az network watcher connection-monitor output list	List all output from a connection monitor.
az network watcher connection-monitor output remove	Remove all outputs from a connection monitor.
az network watcher connection-monitor query	Query a snapshot of the most recent connection state of a connection monitor.
az network watcher connection-monitor show	Shows a connection monitor by name.
az network watcher connection-monitor start	Start the specified connection monitor.
az network watcher connection-monitor stop	Stop the specified connection monitor.
az network watcher connection-monitor test-configuration	Manage test configuration of a connection monitor.
az network watcher connection-monitor test-configuration add	Add a test configuration to a connection monitor.
az network watcher connection-monitor test-configuration list	List all test configurations of a connection monitor.
az network watcher connection-monitor test-configuration remove	Remove a test configuration from a connection monitor.
az network watcher connection-monitor test-configuration show	Show a test configuration from a connection monitor.
az network watcher connection-monitor test-group	Manage a test group of a connection monitor.
az network watcher connection-monitor test-group add	Add a test group along with new-added/existing endpoint and test configuration to a connection monitor.
az network watcher connection-monitor test-group list	List all test groups of a connection monitor.
az network watcher connection-monitor test-group remove	Remove test group from a connection monitor.
az network watcher connection-monitor test-group show	Show a test group of a connection monitor.
az network watcher flow-log	Manage network security group flow logging.
az network watcher flow-log configure	Configure flow logging on a network security group.
az network watcher flow-log create	Create a flow log on a network security group.
az network watcher flow-log delete	Delete the specified flow log resource.
az network watcher flow-log list	List all flow log resources for the specified Network Watcher.
az network watcher flow-log show	Get the flow log configuration of a network security group.
az network watcher flow-log update	Update the flow log configuration of a network security group.
az network watcher list	List Network Watchers.
az network watcher packet-capture	Manage packet capture sessions on VMs.
az network watcher packet-capture create	Create and start a packet capture session.
az network watcher packet-capture delete	Delete a packet capture session.
az network watcher packet-capture list	List all packet capture sessions within a resource group.
az network watcher packet-capture show	Show details of a packet capture session.
az network watcher packet-capture show-status	Show the status of a packet capture session.
az network watcher packet-capture stop	Stop a running packet capture session.
az network watcher run-configuration-diagnostic	Run a configuration diagnostic on a target resource.
az network watcher show-next-hop	Get information on the 'next hop' of a VM.
az network watcher show-security-group-view	Get detailed security information on a VM for the currently configured network security group.
az network watcher show-topology	Get the network topology of a resource group, virtual network or subnet.
az network watcher test-connectivity	Test if a connection can be established between a Virtual Machine and a given endpoint.
az network watcher test-ip-flow	Test IP flow to/from a VM given the currently configured network security group rules.
az network watcher troubleshooting	Manage Network Watcher troubleshooting sessions.
az network watcher troubleshooting show	Get the results of the last troubleshooting operation.
az network watcher troubleshooting start	Troubleshoot issues with VPN connections or gateway connectivity.

Configure the Network Watcher service for different regions.

az network watcher configure --locations
                             [--enabled {false, true}]
                             [--resource-group]
                             [--subscription]
                             [--tags]

Examples

Configure Network Watcher for the West US region.

az network watcher configure -g NetworkWatcherRG  -l westus --enabled true

Required Parameters

Optional Parameters

List Network Watchers.

az network watcher list [--query-examples]
                        [--subscription]

Examples

List all Network Watchers in a subscription.

az network watcher list

Optional Parameters

Run a configuration diagnostic on a target resource.

Requires that Network Watcher is enabled for the region in which the target is located.

az network watcher run-configuration-diagnostic --resource
                                                [--destination]
                                                [--direction {Inbound, Outbound}]
                                                [--parent]
                                                [--port]
                                                [--protocol {Http, Https, Icmp, Tcp}]
                                                [--queries]
                                                [--resource-group]
                                                [--resource-type {applicationGateways, networkInterfaces, virtualMachines}]
                                                [--source]
                                                [--subscription]

Examples

Run configuration diagnostic on a VM with a single query.

az network watcher run-configuration-diagnostic --resource {VM_ID}
   --direction Inbound --protocol TCP --source 12.11.12.14 --destination 10.1.1.4 --port 12100

Run configuration diagnostic on a VM with multiple queries.

az network watcher run-configuration-diagnostic --resource {VM_ID}
    --queries '[
    {
        "direction": "Inbound", "protocol": "TCP", "source": "12.11.12.14",
        "destination": "10.1.1.4", "destinationPort": "12100"
    },
    {
        "direction": "Inbound", "protocol": "TCP", "source": "12.11.12.0/32",
        "destination": "10.1.1.4", "destinationPort": "12100"
    },
    {
        "direction": "Outbound", "protocol": "TCP", "source": "12.11.12.14",
        "destination": "10.1.1.4", "destinationPort": "12100"
    }]'

Required Parameters

Optional Parameters

Get information on the 'next hop' of a VM.

Requires that Network Watcher is enabled for the region in which the VM is located. For more information about show-next-hop visit https://docs.microsoft.com/azure/network-watcher/network-watcher-check-next-hop-cli.

az network watcher show-next-hop --dest-ip
                                 --resource-group
                                 --source-ip
                                 --vm
                                 [--nic]
                                 [--subscription]

Examples

Get the next hop from a VMs assigned IP address to a destination at 10.1.0.4.

az network watcher show-next-hop -g MyResourceGroup --vm MyVm --source-ip 10.0.0.4 --dest-ip 10.1.0.4

Required Parameters

Optional Parameters

Get detailed security information on a VM for the currently configured network security group.

For more information on using security group view visit https://docs.microsoft.com/azure/network-watcher/network-watcher-security-group-view-cli.

az network watcher show-security-group-view --resource-group
                                            --vm
                                            [--subscription]

Examples

Get the network security group information for the specified VM.

az network watcher show-security-group-view -g MyResourceGroup --vm MyVm

Required Parameters

Optional Parameters

Get the network topology of a resource group, virtual network or subnet.

For more information about using network topology visit https://docs.microsoft.com/azure/network-watcher/network-watcher-topology-cli.

az network watcher show-topology [--location]
                                 [--resource-group]
                                 [--subnet]
                                 [--subscription]
                                 [--vnet]

Examples

Use show-topology to get the topology of resources within a resource group.

az network watcher show-topology -g MyResourceGroup

Optional Parameters

Test if a connection can be established between a Virtual Machine and a given endpoint.

To check connectivity between two VMs in different regions, use the VM ids instead of the VM names for the source and destination resource arguments. To register for this feature or see additional examples visit https://docs.microsoft.com/azure/network-watcher/network-watcher-connectivity-cli.

az network watcher test-connectivity --source-resource
                                     [--dest-address]
                                     [--dest-port]
                                     [--dest-resource]
                                     [--headers]
                                     [--method {Get}]
                                     [--protocol {Http, Https, Icmp, Tcp}]
                                     [--resource-group]
                                     [--source-port]
                                     [--subscription]
                                     [--valid-status-codes]

Examples

Check connectivity between two virtual machines in the same resource group over port 80.

az network watcher test-connectivity -g MyResourceGroup --source-resource MyVmName1 --dest-resource MyVmName2 --dest-port 80

Check connectivity between two virtual machines in the same subscription in two different resource groups over port 80.

az network watcher test-connectivity --source-resource MyVmId1 --dest-resource MyVmId2 --dest-port 80

Required Parameters

Optional Parameters

Test IP flow to/from a VM given the currently configured network security group rules.

Requires that Network Watcher is enabled for the region in which the VM is located. For more information visit https://docs.microsoft.com/azure/network-watcher/network-watcher-check-ip-flow-verify-cli.

az network watcher test-ip-flow --direction {Inbound, Outbound}
                                --local
                                --protocol {Http, Https, Icmp, Tcp}
                                --remote
                                --vm
                                [--nic]
                                [--resource-group]
                                [--subscription]

Examples

Run test-ip-flow verify to test logical connectivity from a VM to the specified destination IPv4 address and port.

az network watcher test-ip-flow -g MyResourceGroup --direction Outbound \
    --protocol TCP --local 10.0.0.4:* --remote 10.1.0.4:80 --vm MyVm

Required Parameters

Optional Parameters