The Network Watcher Agent virtual machine extension is a requirement for some of Azure Network Watcher features that capture network traffic to diagnose and monitor Azure virtual machines (VMs). For more information, see What is Azure Network Watcher?
In this article, you learn how to install and uninstall Network Watcher Agent for Windows and Linux. Installation of the agent doesn't disrupt, or require a reboot of the virtual machine. If the virtual machine is deployed by an Azure service, check the documentation of the service to determine whether the service permits installing extensions in the virtual machine.
Note
Network Watcher Agent extension isn't supported on AKS clusters.
Prerequisites
An Azure virtual machine (VM) running a supported operating system. For more information, see Supported operating systems.
Outbound TCP connectivity to 169.254.169.254 over port 80 and 168.63.129.16 over port 8037. The agent uses these IP addresses to communicate with the Azure platform.
Internet connectivity: Network Watcher Agent requires internet connectivity for some features to properly work. For example, it requires connectivity to your storage account to upload packet captures.
An Azure virtual machine (VM) running a supported operating system. For more information, see Supported operating systems.
Outbound TCP connectivity to 169.254.169.254 over port 80 and 168.63.129.16 over port 8037. The agent uses these IP addresses to communicate with the Azure platform.
Internet connectivity: Network Watcher Agent requires internet connectivity for some features to properly work. For example, it requires connectivity to your storage account to upload packet captures.
Azure Cloud Shell or Azure PowerShell.
The steps in this article run the Azure PowerShell cmdlets interactively in Azure Cloud Shell. To run the commands in the Cloud Shell, select Open Cloud Shell at the upper-right corner of a code block. Select Copy to copy the code and then paste it into Cloud Shell to run it. You can also run the Cloud Shell from within the Azure portal.
You can also install Azure PowerShell locally to run the cmdlets. If you run PowerShell locally, sign in to Azure using the Connect-AzAccount cmdlet.
An Azure virtual machine (VM) running a supported operating system. For more information, see Supported operating systems.
Outbound TCP connectivity to 169.254.169.254 over port 80 and 168.63.129.16 over port 8037. The agent uses these IP addresses to communicate with the Azure platform.
Internet connectivity: Network Watcher Agent requires internet connectivity for some features to properly work. For example, it requires connectivity to your storage account to upload packet captures.
Azure Cloud Shell or Azure CLI.
The steps in this article run the Azure CLI commands interactively in Azure Cloud Shell. To run the commands in the Cloud Shell, select Open Cloud Shell at the upper-right corner of a code block. Select Copy to copy the code, and paste it into Cloud Shell to run it. You can also run the Cloud Shell from within the Azure portal.
You can also install Azure CLI locally to run the commands. If you run Azure CLI locally, sign in to Azure using the az login command.
An Azure virtual machine (VM) running a supported operating system. For more information, see Supported operating systems.
Outbound TCP connectivity to 169.254.169.254 over port 80 and 168.63.129.16 over port 8037. The agent uses these IP addresses to communicate with the Azure platform.
Internet connectivity: Network Watcher Agent requires internet connectivity for some features to properly work. For example, it requires connectivity to your storage account to upload packet captures.
Azure PowerShell or Azure CLI installed locally to deploy the template.
Supported operating systems
Network Watcher Agent extension for Windows can be installed on:
- Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 releases.
- Windows 10 and 11 releases.
Note
Currently, Nano Server isn't supported.
You can install the Network Watcher Agent extension for Linux on the following Linux distributions:
| Distribution |
Version |
| AlmaLinux |
9.2 |
| Azure Linux |
2.0 |
| CentOS 1 |
6.10 and 7 |
| Debian |
7 and 8 |
| openSUSE Leap |
42.3+ |
| Oracle Linux |
6.10 2, 7, 8, and 9+ |
| Red Hat Enterprise Linux (RHEL) |
6.10 3, 7, 8, and 9.2 |
| Rocky Linux |
9.1 |
| SUSE Linux Enterprise Server (SLES) |
12 and 15 (SP2, SP3, and SP4) |
| Ubuntu |
16+ |
1 CentOS Linux reached its end of life (EOL) on June 30, 2024. For more information, see the CentOS End Of Life guidance.
2 Extended life cycle (ELS) support for Oracle Linux version 6.X ended on July 1, 2024.
3 Extended life cycle (ELS) support for Red Hat Enterprise Linux 6.X ended on June 30, 2024.
Note
Internet Control Message Protocol (ICMP) monitoring isn't currently supported in the Network Watcher Agent on Oracle Linux due to known kernel-level limitations specific to the distro.
Extension schema
The following JSON shows the schema for the Network Watcher Agent extension. The extension doesn't require, or support, any user-supplied settings, and relies on its default configuration.
{
"name": "[concat(parameters('vmName'), '/AzureNetworkWatcherExtension')]",
"type": "Microsoft.Compute/virtualMachines/extensions",
"apiVersion": "2023-03-01",
"location": "[resourceGroup().location]",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"properties": {
"autoUpgradeMinorVersion": true,
"publisher": "Microsoft.Azure.NetworkWatcher",
"type": "NetworkWatcherAgentWindows",
"typeHandlerVersion": "1.4"
}
}
{
"name": "[concat(parameters('vmName'), '/AzureNetworkWatcherExtension')]",
"type": "Microsoft.Compute/virtualMachines/extensions",
"apiVersion": "2023-03-01",
"location": "[resourceGroup().location]",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"properties": {
"autoUpgradeMinorVersion": true,
"publisher": "Microsoft.Azure.NetworkWatcher",
"type": "NetworkWatcherAgentLinux",
"typeHandlerVersion": "1.4"
}
}
List installed extensions
From the virtual machine page in the Azure portal, you can view the installed extensions by following these steps:
Under Settings, select Extensions + applications.
In the Extensions tab, you can see all installed extensions on the virtual machine. If the list is long, you can use the search box to filter the list.
Use Get-AzVMExtension cmdlet to list all installed extensions on the virtual machine:
# List the installed extensions on the virtual machine.
Get-AzVMExtension -ResourceGroupName 'myResourceGroup' -VMName 'myVM' | format-table Name, Publisher, ExtensionType, AutoUpgradeMinorVersion, EnableAutomaticUpgrade
The output of the cmdlet lists the installed extensions:
Name Publisher ExtensionType AutoUpgradeMinorVersion EnableAutomaticUpgrade
---- --------- ------------- ----------------------- ----------------------
AzureNetworkWatcherExtension Microsoft.Azure.NetworkWatcher NetworkWatcherAgentWindows True True
Name Publisher ExtensionType AutoUpgradeMinorVersion EnableAutomaticUpgrade
---- --------- ------------- ----------------------- ----------------------
AzureNetworkWatcherExtension Microsoft.Azure.NetworkWatcher NetworkWatcherAgentLinux True True
Use az vm extension list command to list all installed extensions on the virtual machine:
# List the installed extensions on the virtual machine.
az vm extension list --resource-group 'myResourceGroup' --vm-name 'myVM' --out table
The output of the command lists the installed extensions:
Name ProvisioningState Publisher Version AutoUpgradeMinorVersion
---------------------------- ------------------- ------------------------------ --------- -------------------------
AzureNetworkWatcherExtension Succeeded Microsoft.Azure.NetworkWatcher 1.4 True
Install Network Watcher Agent VM extension
From the virtual machine page in the Azure portal, you can install the Network Watcher Agent VM extension by following these steps:
Under Settings, select Extensions + applications.
Select + Add and search for Network Watcher Agent and install it. If the extension is already installed, you can see it in the list of extensions.
In the search box of Install an Extension, enter Network Watcher Agent, select the matching extension for your operating system from the list, and then select Next.
Select Review + create and then select Create.
Use Set-AzVMExtension cmdlet to install Network Watcher Agent VM extension on the virtual machine:
# Install Network Watcher Agent for Windows on the virtual machine.
Set-AzVMExtension -Name 'AzureNetworkWatcherExtension' -Publisher 'Microsoft.Azure.NetworkWatcher' -ExtensionType 'NetworkWatcherAgentWindows' -EnableAutomaticUpgrade 1 -TypeHandlerVersion '1.4' -ResourceGroupName 'myResourceGroup' -VMName 'myVM'
# Install Network Watcher Agent for Linux on the virtual machine.
Set-AzVMExtension -Name 'AzureNetworkWatcherExtension' -Publisher 'Microsoft.Azure.NetworkWatcher' -ExtensionType 'NetworkWatcherAgentLinux' -EnableAutomaticUpgrade 1 -TypeHandlerVersion '1.4' -ResourceGroupName 'myResourceGroup' -VMName 'myVM'
Once the installation is successfully completed, you see the following output:
RequestId IsSuccessStatusCode StatusCode ReasonPhrase
--------- ------------------- ---------- ------------
True OK
Use az vm extension set command to install Network Watcher Agent VM extension on the virtual machine:
# Install Network Watcher Agent for Windows on the virtual machine.
az vm extension set --name 'NetworkWatcherAgentWindows' --extension-instance-name 'AzureNetworkWatcherExtension' --publisher 'Microsoft.Azure.NetworkWatcher' --enable-auto-upgrade 'true' --version '1.4' --resource-group 'myResourceGroup' --vm-name 'myVM'
# Install Network Watcher Agent for Linux on the virtual machine.
az vm extension set --name 'NetworkWatcherAgentLinux' --extension-instance-name 'AzureNetworkWatcherExtension' --publisher 'Microsoft.Azure.NetworkWatcher' --enable-auto-upgrade 'true' --version '1.4' --resource-group 'myResourceGroup' --vm-name 'myVM'
Use the following Azure Resource Manager template (ARM template) to install the Network Watcher Agent VM extension on a virtual machine:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string"
}
},
"variables": {},
"resources": [
{
"name": "[parameters('vmName')]",
"type": "Microsoft.Compute/virtualMachines",
"apiVersion": "2023-03-01",
"location": "[resourceGroup().location]",
"properties": {
}
},
{
"name": "[concat(parameters('vmName'), '/AzureNetworkWatcherExtension')]",
"type": "Microsoft.Compute/virtualMachines/extensions",
"apiVersion": "2023-03-01",
"location": "[resourceGroup().location]",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"properties": {
"autoUpgradeMinorVersion": true,
"publisher": "Microsoft.Azure.NetworkWatcher",
"type": "NetworkWatcherAgentWindows",
"typeHandlerVersion": "1.4"
}
}
],
"outputs": {}
}
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"vmName": {
"type": "string"
}
},
"variables": {},
"resources": [
{
"name": "[parameters('vmName')]",
"type": "Microsoft.Compute/virtualMachines",
"apiVersion": "2023-03-01",
"location": "[resourceGroup().location]",
"properties": {
}
},
{
"name": "[concat(parameters('vmName'), '/AzureNetworkWatcherExtension')]",
"type": "Microsoft.Compute/virtualMachines/extensions",
"apiVersion": "2023-03-01",
"location": "[resourceGroup().location]",
"dependsOn": [
"[concat('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"properties": {
"autoUpgradeMinorVersion": true,
"publisher": "Microsoft.Azure.NetworkWatcher",
"type": "NetworkWatcherAgentLinux",
"typeHandlerVersion": "1.4"
}
}
],
"outputs": {}
}
You can use either Azure PowerShell or Azure CLI to deploy the Resource Manager template:
# Deploy the JSON template file using Azure PowerShell.
New-AzResourceGroupDeployment -ResourceGroupName 'myResourceGroup' -TemplateFile 'agent.json'
# Deploy the JSON template file using the Azure CLI.
az deployment group create --resource-group 'myResourceGroup' --template-file 'agent.json'
Uninstall Network Watcher Agent VM extension
From the virtual machine page in the Azure portal, you can uninstall the Network Watcher Agent VM extension by following these steps:
Under Settings, select Extensions + applications.
Select AzureNetworkWatcherExtension from the list of extensions, and then select Uninstall.
Note
You might see Network Watcher Agent VM extension named differently than AzureNetworkWatcherExtension.
Use Remove-AzVMExtension cmdlet to remove Network Watcher Agent VM extension from the virtual machine:
# Uninstall Network Watcher Agent VM extension.
Remove-AzVMExtension -Name 'AzureNetworkWatcherExtension' -ResourceGroupName 'myResourceGroup' -VMName 'myVM'
Use az vm extension delete command to remove Network Watcher Agent VM extension from the virtual machine:
# Uninstall Network Watcher Agent VM extension.
az vm extension delete --name 'AzureNetworkWatcherExtension' --resource-group 'myResourceGroup' --vm-name 'myVM'
Frequently asked questions (FAQ)
To get answers to most frequently asked questions about Network Watcher Agent, see Network Watcher Agent FAQ.
Related content
