# Check next-hop selection before troubleshooting the appliance application path

> Use the selected route to identify where a VM's traffic is being sent.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:17+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Use the selected route to identify where a VM's traffic is being sent.

## Potentially affected

Apply the diagnostic approach to an approved VM-to-destination investigation. Identify the actual source interface and destination address, and compare them with the intended routing design. Do not reproduce the tutorial's intentionally broken route on a production subnet.

## DSE recommendation

DSE recommends capturing route-selection evidence before editing an appliance or application.

## Article

## Source facts

Microsoft’s routing tutorial uses Network Watcher next hop to report the selected next-hop type, address and route-table identifier. Its example deliberately sends traffic to an appliance VM that has not been configured to forward it, causing the application request to fail. The route-selection result and the appliance’s forwarding capability are therefore separate observations in the tutorial. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-vm-network-routing-problem).

## Applicability

Apply the diagnostic approach to an approved VM-to-destination investigation. Identify the actual source interface and destination address, and compare them with the intended routing design. Do not reproduce the tutorial’s intentionally broken route on a production subnet.

## DSE recommendation

DSE recommends capturing route-selection evidence before editing an appliance or application. Ask the network owner whether the observed next hop is intentional. If it is, investigate forwarding and subsequent policy at that appliance; if it is not, review the route and subnet association. Keep each proposed correction scoped to the observed fault.

## Verification

Run next hop for the exact source and destination, inspect the relevant effective route, and correlate the result with an authorized connectivity test. After a correction, repeat the same observations. Record the selected route and the application outcome separately so a correct route alone is not mistaken for successful end-to-end communication.

## Official references

[Microsoft Learn: Tutorial: Diagnose a VM Network Routing Problem – Azure Portal](https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-vm-network-routing-problem).

## Primary reference

- Name: Tutorial: Diagnose a VM Network Routing Problem - Azure Portal - Azure Network Watcher | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-vm-network-routing-problem
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check next-hop selection before troubleshooting the appliance application path,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-103-check-next-hop-selection-before-troubleshooting-the-appliance-application-path/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.