A VM cannot reach an on-premises server. An engineer suspects a user-defined route is sending traffic to the wrong place. Which Network Watcher tool should be used first to show the next hop Azure selects for a packet from that VM to the on-premises address?
Show answer and explanation
Answer: B
The Next hop tool in Network Watcher reports the next hop type and IP address that Azure would use for a given source VM and destination IP. It evaluates effective routes, including system routes, user-defined routes, and BGP routes, so it shows whether a UDR is redirecting traffic. Connection troubleshoot tests end-to-end reachability, packet capture records packets, and NSG flow logs record allowed and denied flows. Those are useful later, but they do not directly report the route Azure selected.
Why the other options are wrong
- A. Connection troubleshoot runs a connectivity test and reports whether the path succeeds and where it fails. It is useful later, but it does not isolate the next hop that the route table assigns to the destination address.
- C. NSG flow logs record flows that were allowed or denied by security rules. They show traffic outcomes rather than the route Azure selected, so they do not reveal a misconfigured user-defined route.
- D. Packet capture records packets on a VM's network interface for later analysis. It can confirm what arrives, but it requires capturing traffic first and does not directly report the configured next hop.