Network Management

NetPath graph issues: basic troubleshooting in NPM

If NetPath graphs are empty, ensure that ICMP type 11 traffic is allowed on all firewalls, TCP port 443 is open for creating a connection to the endpoint, find out what type of probing NetPath currently uses, and troubleshoot the standard based probing mode with the traceTCP tool.

First published date

10/19/2018 6:51 PM

Last published date

10/24/2025 9:16 PM

Overview

If your NetPath graphs are not displayed, follow the steps to determine whether you can resolve the issue by adjusting your environment.

Product section

Network Performance Monitor

Resolution

Complete the following troubleshooting steps to find out whether you can resolve your issue by adjusting settings in your environment:


Step 1: Make sure that ICMP type 11 traffic is allowed on all firewalls 

NetPath uses ICMP Type 11 packets.

Even though your Windows tracert provides successful results, you might not have ICMP type 11 traffic allowed. This is because Windows tracert sends ICMP Type 8 and expects ICMP Type 0 in response.

To verify that ICMP Type 11 traffic is allowed, follow the steps in these articles:


Step 2: Verify that TCP port 443 is open for creating a connection to the endpoint. 

  1. Download the PsPing tool from https://docs.microsoft.com/en-us/sysinternals/downloads/psping. 
  2. Extract the file and run psping in the command line with the following parameters: 
     psping -n 10 -4 www.google.com:443

    The app checks whether TCP port 443 is open for endpoint service www.google.com.


Test was successful 

The ping test should not time out and there should be no lost packets. If this test is successful, find out what type of probing NetPath uses, per Step 3.

The following output is an example of a successful test.

PsPing v2.10 - PsPing - ping, latency, bandwidth measurement utility
Copyright (C) 2012-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

TCP connect to 172.217.20.68:443:
11 iterations (warmup 1) ping test:
Connecting to 172.217.20.68:443 (warmup): from 10.140.106.202:62373: 24.26ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62374: 22.15ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62375: 23.90ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62376: 24.15ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62377: 22.31ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62378: 22.31ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62379: 22.33ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62380: 22.45ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62381: 22.77ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62382: 22.98ms
Connecting to 172.217.20.68:443: from 10.140.106.202:62383: 23.34ms

TCP connect statistics for 172.217.20.68:443:
Sent = 10, Received = 10, Lost = 0 (0% loss),
Minimum = 22.15ms, Maximum = 24.15ms, Average = 22.87ms

Test failed 

If the tool output returns with errors, such as timeout period expired, or if sent packets are lost, review the following options:

  • If you are using virtual machines, or a technology such as VMware or Citrix, make sure that the port is open in your network adapter settings.
  • Verify the next hop after the probe. If it is a firewall, check the firewall logs for NetPath probe-related logging and adjust the firewall rules if necessary. See NetPath graph issue: All timeout nodes from an intermediate node to endpoint .
  • To find out whether TCP port 443 is blocked on a Windows firewall, run the command with the parameter -f. If the ping is successful, open the port on the Windows firewall. 
    psping -n 10 -f -4 www.google.com:443



Step 3: Find out what type of probing is currently used (NetPath Debugger) 

Before you run this test, make sure TCP port 443 is open.

By default, NetPath uses connection-based probing. If this fails, NetPath switches to standard-based probing.

Verify that NetPath is using standard-based probing:

  1. From the NetPath services page, open the service with issues.

  2. Add ?debug to the graph URL and hit enter.
    N-central does not support the ?debug parameter, because the graph is not displayed in a separate window, so you cannot access the graph URL.

  3. Scroll down to the Debugger, and click the Traces tab, and click Load Traces.

  4. Click Show Hops for and review the Mode.


What Mode is there? 

  • If the Mode is Connection Based, you have the port open, and still cannot see the path graph, open a ticket with SolarWinds support.
  • If you see Standard Based as the mode, run the Tracetcp  tool, as described next.


Step 4: Troubleshoot standard-based polling with the TraceTCP tool 

The TraceTCP tool checks whether gateways along the path respond to TCP syn packets with TTL=1.

  1. Download the tool from https://github.com/0xcafed00d/tracetcp/releases

Extract the file and run tracetcp.exe in the command line with the following parameters:

tracetcp.exe www.google.com:443

Test was successful 

A successful test means that the destination was reached, the connection established and that no packets were lost:

C:\Users\Administrator\Downloads\tracetcp_v1.0.3>tracetcp.exe www.google.com:443
Tracing route to 172.217.17.68 [ams16s30-in-f4.1e100.net] on port 443
Over a maximum of 30 hops.
1 3 ms 3 ms 5 ms 10.140.106.1
2 2 ms 1 ms 1 ms 10.140.117.1
 ...
10 17 ms 23 ms 30 ms 209.85.245.30
11 24 ms 27 ms 24 ms 108.170.234.10
12 31 ms 25 ms 24 ms 216.239.42.171
13 23 ms 23 ms 23 ms 108.170.241.193
14 24 ms 24 ms 23 ms 108.170.236.141
15 Destination Reached in 24 ms. Connection established to 172.217.17.68
Trace Complete.

Test failed 

  • If responses time out starting from a certain hop,  this indicates there is a firewall blocking the traffic in the hop. Make sure the port is open.
C:\Users\Administrator\Downloads\tracetcp_v1.0.3>tracetcp.exe www.google.com:443
Tracing route to 172.217.17.68 on port 443
Over a maximum of 30 hops.
1 3 ms 1 ms 1 ms 10.94.102.1
2 2 ms 2 ms 1 ms 10.94.101.1
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 Destination Reached in 56 ms. Connection established to 162.248.127.113 Trace Complete.
  • If you cannot see all expected hops, but the trace is complete, it indicates that you have a proxy or a WAN optimizer hiding a part of the path. To see the whole path, you need to reconfigure the proxy or WAN optimizer.
C:\Users\Administrator\Downloads\tracetcp_v1.0.3\tracetcp_v1.0.3>tracetcp.exe www.google.com:443Tracing route to 172.217.17.68 [ams16s30-in-f4.1e100.net] on port 443
Over a maximum of 30 hops.
1 3 ms 3 ms 5 ms 10.140.106.1
2 2 ms 1 ms 1 ms 10.140.117.1
3 4 ms 4 ms 6 ms 108.170.236.141
4 Destination Reached in 4 ms. Connection established to 172.217.17.68
Trace Complete.
  • If you cannot see any hops in the trace, make sure the gateway is accessible and you have open TCP port 443  on your network adapter.
C:\Users\Administrator\Downloads\tracetcp_v1.0.3\tracetcp_v1.0.3>tracetcp.exe www.google.com:443Tracing route to 172.217.4.36 on port 443Over a maximum of 30 hops.
1 * * * Request timed out.
2 * * * Request timed out.
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 Destination Reached in 20 ms. Connection established to 172.217.4.36Trace Complete.

 

See further NetPath graph issues