Skip to content

Commit 383fd3e

Browse files
halkazwinihalkazwini
committed
add errors table
1 parent afedddd commit 383fd3e

2 files changed

Lines changed: 118 additions & 1 deletion

File tree

‎articles/network-watcher/connection-troubleshoot-overview.md‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: halkazwini
66
ms.author: halkazwini
77
ms.service: azure-network-watcher
88
ms.topic: concept-article
9-
ms.date: 11/18/2025
9+
ms.date: 04/08/2026
1010

1111
# Customer intent: As an Azure administrator, I want to understand the capabilities of the Connection troubleshoot tool so that I can effectively diagnose and resolve network connectivity issues in my cloud infrastructure.
1212
---
@@ -141,6 +141,67 @@ The following example shows an issue found on a hop.
141141
]
142142
```
143143

144+
## Errors
145+
146+
Connection troubleshoot returns the following error messages.
147+
148+
| IssueType | Description |
149+
|----|----|
150+
| AgentStopped | The Network Watcher agent on the source VM has stopped or is unresponsive. |
151+
| **GuestFirewall** | Traffic is being blocked by the guest OS firewall on the source or destination VM. |
152+
| **DNSResolution** | The DNS lookup for the destination hostname failed on the source agent. |
153+
| **SocketError** | The source agent failed to bind or listen on the required local socket (e.g., **SocketBindFailed** or **ListenFailed**). |
154+
| **NetworkSecurityRule** | An NSG rule is denying inbound or outbound traffic between the source and destination. |
155+
| **UserDefinedRoute** | A UserDefinedRoute was found that routes traffic to a ‘None’ next hop, creating a blackhole routing. |
156+
| **Platform** | An Azure platform-level issue is affecting connectivity. |
157+
| **NetworkError** | A generic network failure occurred (e.g., connection timed out, connect failed, no response, or send/receive failure). |
158+
| **CPU** | CPU usage on the source or destination VM exceeded threshold. |
159+
| **Memory** | Memory usage on the source or destination VM exceeded threshold. |
160+
| **ARPMissing** | The ARP table on the Microsoft Edge (ExpressRoute) hop is missing or has an incomplete entry for the customer/Microsoft edge IP. |
161+
| **RouteMissing** | Raised when no valid route to the destination can be found at a hop. |
162+
| **VMRebooting** | The source or destination VM is currently in a rebooting state. |
163+
| **VMNotAllocated** | VM is not allocated (deallocated/stopped). |
164+
| **NoListenerOnDestination** | The destination connectivity check confirmed that no process is listening on the specified port. |
165+
| **DIPProbeDown** | The SLB health probe reports the backend DIP (destination IP) as "Down". |
166+
| **NoRouteLearned** | The SLB or Virtual Hub found no effective route to the destination. |
167+
| **PeeringInfoNotFound** | The peering information between two VNets could not be retrieved. |
168+
| **VMStarting** | The destination VM is in a starting state and is not yet ready to accept traffic. |
169+
| **VMStopped** | The destination VM is stopped (but still allocated), so it cannot accept network traffic. |
170+
| **VMStopping** | The destination VM is in the process of stopping and is not reliably accepting traffic. |
171+
| **VMDeallocating** | The destination VM is being deallocated and is in the process of releasing its resources, making it temporarily unreachable. |
172+
| **VMDeallocated** | The destination VM has been fully deallocated. |
173+
| **SystemError** | An internal system or infrastructure error occurred. |
174+
| **UDRLoop** | User Defined Route found. This results in a routing loop, as the next hop IP matches the current hop IP. |
175+
| **IPForwardingNotEnabled** | The NVA (virtual appliance) VM that traffic is routed through does not have IP forwarding enabled on its NIC. |
176+
| **VnetAccessNotAllowed** | The VNet peering link has <u>AllowVNetAccess</u> set to **false**, blocking traffic from crossing the peering boundary. |
177+
| **AllowGatewayTransitNotEnabled** | The peering on the hub/gateway side does not have <u>AllowGatewayTransit</u> enabled. |
178+
| **MultiNICsInSameSubnet** | Multiple NICs on the VM are in the same subnet, which can cause asymmetric routing and unpredictable traffic behavior. |
179+
| **StandardILBOutboundInternetNotAllowed** | Raised when a VM in the backend pool of a Standard Internal Load Balancer attempts to reach the internet — Standard ILB backends have no default outbound internet access, unlike Basic ILB. |
180+
| **MultiNICsInSameSubnetWithWeakHostSendEnabled** | Multiple NICs are in the same subnet and weak host send is enabled, which can cause traffic to egress from an unexpected interface. |
181+
| **MultiNICsInSameSubnetWithWeakHostEnabled** | Multiple NICs are in the same subnet and weak host (send/receive) is enabled on the VM, which may route packets through unintended interfaces. |
182+
| **SourcePortInUse** | The source port selected by the agent is already in **TIME_WAIT** state (a lingering TCP socket), preventing a new connection from being established from that port. |
183+
| **InvalidResponseFromServer** | A DNS probe queried the server but received no matching records. |
184+
| **DNSResponseValidationFailed** | The DNS probe response failed a configured validation rule (e.g., wrong record count, wrong recursion support, wrong RCode, or wrong authority flag). |
185+
| **UnsupportedSystem** | The agent is running on an OS or system configuration that does not support the requested probe type. |
186+
| **IncompleteTopology** | Service could not build a complete hop path to the destination. |
187+
| **DestinationUnreachable** | Agent on the source machine was unable to reach the destination. |
188+
| **TraceRouteUnavailable** | The agent did not return a traceroute result (no paths), so cannot determine the connectivity status between source and destination. |
189+
| **DestinationPartiallyReachable** | Some but not all traceroute paths from the agent successfully reached the destination. |
190+
| **GatewayNotProvisioned** | The VPN/ExpressRoute gateway returned a **GatewayNotProvisioned** error. |
191+
| **ResourceHealthUnavailable** | Azure Resource Health reports the hop resource (VM, gateway, firewall, etc.) as **Unavailable**. |
192+
| **ResourceHealthDegraded** | Azure Resource Health reports the hop resource as **Degraded**. |
193+
| **VirtualHubNotProvisioned** | The Virtual WAN Hub associated with the path is not in a <u>Succeeded</u> provisioning state. |
194+
| **StatusCodeValidationFailed** | The HTTP probe received a response but the returned HTTP status code did not match the expected value. |
195+
| **HeaderValidationFailed** | The HTTP probe received a response but one or more expected HTTP response headers were missing or did not match. |
196+
| **ContentValidationFailed** | The HTTP probe received a response but the response body content did not match the expected value. |
197+
| **NoConnectionConfigured** | No connection is configured between the source and destination endpoints in the connection monitor settings. |
198+
| **ConnectionStateDisconnected** | The monitored connection is in a disconnected state, indicating a break in the logical connection path. |
199+
| **BasicILBNotSupportedWithGlobalPeering** | A Basic Internal Load Balancer does not support Global VNet Peering. |
200+
| **BGPRoutePropogationDisabled** | BGP route propagation is disabled on the route table associated with the source subnet. |
201+
| **UseRemoteGatewaysNotEnabled** | The peering on the spoke side does not have UseRemoteGateways enabled. |
202+
| **UnexpectedVirtualNetworkGatewayConnection** | A virtual network gateway connection was found on the path that was not expected. |
203+
204+
144205
## Fault types
145206

146207
Connection troubleshoot returns fault types about the connection. The following table provides a list of the possible returned fault types.

‎articles/network-watcher/ct-errors.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
| | |
2+
|----|----|
3+
| IssueType | Description |
4+
| **AgentStopped** | The Network Watcher agent on the source VM has stopped or is unresponsive. |
5+
| **GuestFirewall** | Traffic is being blocked by the guest OS firewall on the source or destination VM. |
6+
| **DNSResolution** | The DNS lookup for the destination hostname failed on the source agent. |
7+
| **SocketError** | The source agent failed to bind or listen on the required local socket (e.g., **SocketBindFailed** or **ListenFailed**). |
8+
| **NetworkSecurityRule** | An NSG rule is denying inbound or outbound traffic between the source and destination. |
9+
| **UserDefinedRoute** | A UserDefinedRoute was found that routes traffic to a ‘None’ next hop, creating a blackhole routing. |
10+
| **Platform** | An Azure platform-level issue is affecting connectivity. |
11+
| **NetworkError** | A generic network failure occurred (e.g., connection timed out, connect failed, no response, or send/receive failure). |
12+
| **CPU** | CPU usage on the source or destination VM exceeded threshold. |
13+
| **Memory** | Memory usage on the source or destination VM exceeded threshold. |
14+
| **ARPMissing** | The ARP table on the Microsoft Edge (ExpressRoute) hop is missing or has an incomplete entry for the customer/Microsoft edge IP. |
15+
| **RouteMissing** | Raised when no valid route to the destination can be found at a hop. |
16+
| **VMRebooting** | The source or destination VM is currently in a rebooting state. |
17+
| **VMNotAllocated** | VM is not allocated (deallocated/stopped). |
18+
| **NoListenerOnDestination** | The destination connectivity check confirmed that no process is listening on the specified port. |
19+
| **DIPProbeDown** | The SLB health probe reports the backend DIP (destination IP) as "Down". |
20+
| **NoRouteLearned** | The SLB or Virtual Hub found no effective route to the destination. |
21+
| **PeeringInfoNotFound** | The peering information between two VNets could not be retrieved. |
22+
| **VMStarting** | The destination VM is in a starting state and is not yet ready to accept traffic. |
23+
| **VMStopped** | The destination VM is stopped (but still allocated), so it cannot accept network traffic. |
24+
| **VMStopping** | The destination VM is in the process of stopping and is not reliably accepting traffic. |
25+
| **VMDeallocating** | The destination VM is being deallocated and is in the process of releasing its resources, making it temporarily unreachable. |
26+
| **VMDeallocated** | The destination VM has been fully deallocated. |
27+
| **SystemError** | An internal system or infrastructure error occurred. |
28+
| **UDRLoop** | User Defined Route found. This results in a routing loop, as the next hop IP matches the current hop IP. |
29+
| **IPForwardingNotEnabled** | The NVA (virtual appliance) VM that traffic is routed through does not have IP forwarding enabled on its NIC. |
30+
| **VnetAccessNotAllowed** | The VNet peering link has <u>AllowVNetAccess</u> set to **false**, blocking traffic from crossing the peering boundary. |
31+
| **AllowGatewayTransitNotEnabled** | The peering on the hub/gateway side does not have <u>AllowGatewayTransit</u> enabled. |
32+
| **MultiNICsInSameSubnet** | Multiple NICs on the VM are in the same subnet, which can cause asymmetric routing and unpredictable traffic behavior. |
33+
| **StandardILBOutboundInternetNotAllowed** | Raised when a VM in the backend pool of a Standard Internal Load Balancer attempts to reach the internet — Standard ILB backends have no default outbound internet access, unlike Basic ILB. |
34+
| **MultiNICsInSameSubnetWithWeakHostSendEnabled** | Multiple NICs are in the same subnet and weak host send is enabled, which can cause traffic to egress from an unexpected interface. |
35+
| **MultiNICsInSameSubnetWithWeakHostEnabled** | Multiple NICs are in the same subnet and weak host (send/receive) is enabled on the VM, which may route packets through unintended interfaces. |
36+
| **SourcePortInUse** | The source port selected by the agent is already in **TIME_WAIT** state (a lingering TCP socket), preventing a new connection from being established from that port. |
37+
| **InvalidResponseFromServer** | A DNS probe queried the server but received no matching records. |
38+
| **DNSResponseValidationFailed** | The DNS probe response failed a configured validation rule (e.g., wrong record count, wrong recursion support, wrong RCode, or wrong authority flag). |
39+
| **UnsupportedSystem** | The agent is running on an OS or system configuration that does not support the requested probe type. |
40+
| **IncompleteTopology** | Service could not build a complete hop path to the destination. |
41+
| **DestinationUnreachable** | Agent on the source machine was unable to reach the destination. |
42+
| **TraceRouteUnavailable** | The agent did not return a traceroute result (no paths), so cannot determine the connectivity status between source and destination. |
43+
| **DestinationPartiallyReachable** | Some but not all traceroute paths from the agent successfully reached the destination. |
44+
| **GatewayNotProvisioned** | The VPN/ExpressRoute gateway returned a **GatewayNotProvisioned** error. |
45+
| **ResourceHealthUnavailable** | Azure Resource Health reports the hop resource (VM, gateway, firewall, etc.) as **Unavailable**. |
46+
| **ResourceHealthDegraded** | Azure Resource Health reports the hop resource as **Degraded**. |
47+
| **VirtualHubNotProvisioned** | The Virtual WAN Hub associated with the path is not in a <u>Succeeded</u> provisioning state. |
48+
| **StatusCodeValidationFailed** | The HTTP probe received a response but the returned HTTP status code did not match the expected value. |
49+
| **HeaderValidationFailed** | The HTTP probe received a response but one or more expected HTTP response headers were missing or did not match. |
50+
| **ContentValidationFailed** | The HTTP probe received a response but the response body content did not match the expected value. |
51+
| **NoConnectionConfigured** | No connection is configured between the source and destination endpoints in the connection monitor settings. |
52+
| **ConnectionStateDisconnected** | The monitored connection is in a disconnected state, indicating a break in the logical connection path. |
53+
| **BasicILBNotSupportedWithGlobalPeering** | A Basic Internal Load Balancer does not support Global VNet Peering. |
54+
| **BGPRoutePropogationDisabled** | BGP route propagation is disabled on the route table associated with the source subnet. |
55+
| **UseRemoteGatewaysNotEnabled** | The peering on the spoke side does not have UseRemoteGateways enabled. |
56+
| **UnexpectedVirtualNetworkGatewayConnection** | A virtual network gateway connection was found on the path that was not expected. |

0 commit comments

Comments
 (0)