Root cause analysis / Investigation

copilot.com

Reference RCA-390E95AFBF636216

Microsoft Chat website

Measurement point: Stealth NYC, 32 Avenue of the Americas.

Published investigation. Updates run automatically.

01 / Network path

Network path.

Endpoint measurements / ICMP IPv4

Latency over time.

Successful endpoint RTT recordings from up to one hour before and after the event.

Enter time range

Times use the selected timezone; choices include recorded samples and intervals across the available chart.

Use the recordings table below to view latency values.

Successful RTT recording Event interval

03 Nov 2026 15:30 – 03 Nov 2026 18:04 UTC. Hover or tap to inspect; drag across the chart to zoom. On touchscreens, first choose Select time range. Escape or Reset zoom restores the full range. Missing recordings are gaps; this is not an application availability or packet-loss chart.

Select a recording to explore nearby path observations.

View recorded values
Successful ICMP IPv4 RTT recordings.
Recorded at (UTC)RTT
6.412 ms
6.389 ms
6.389 ms
6.394 ms
6.410 ms
6.396 ms
6.433 ms
6.397 ms
6.382 ms
6.400 ms
6.427 ms
6.426 ms
6.482 ms
6.422 ms
6.439 ms
6.432 ms
6.547 ms
6.401 ms
6.386 ms
6.399 ms
6.739 ms
6.672 ms
6.668 ms
6.672 ms
6.646 ms
6.682 ms
6.660 ms
6.709 ms
6.697 ms
6.654 ms
6.680 ms
6.674 ms
6.665 ms
6.661 ms
6.666 ms
6.708 ms
6.657 ms
6.672 ms
6.696 ms
6.739 ms
6.660 ms
6.823 ms
6.711 ms
6.669 ms
6.705 ms
6.695 ms
6.690 ms
6.662 ms
6.697 ms
6.691 ms
6.704 ms
6.661 ms
6.684 ms
6.723 ms
6.655 ms
6.712 ms
6.664 ms
6.659 ms
6.683 ms
6.696 ms
6.683 ms
6.665 ms
6.685 ms
6.682 ms
6.652 ms
6.699 ms
6.658 ms
6.708 ms
6.721 ms
6.677 ms
6.665 ms
6.687 ms
6.660 ms
6.646 ms
6.695 ms
6.669 ms
6.665 ms
6.658 ms
6.712 ms
6.713 ms
6.685 ms
6.731 ms
6.702 ms
6.676 ms
6.705 ms
6.663 ms
6.703 ms
6.320 ms
6.251 ms
6.308 ms
6.259 ms
6.299 ms
6.272 ms
6.261 ms
6.276 ms
6.249 ms
6.295 ms
6.314 ms
6.259 ms
6.251 ms
6.257 ms
6.320 ms
6.284 ms
6.384 ms
6.421 ms
6.398 ms
6.370 ms
6.372 ms
6.419 ms
6.408 ms
6.436 ms
6.394 ms
6.428 ms
6.386 ms
6.396 ms
6.372 ms
6.489 ms
6.404 ms
6.383 ms
6.435 ms
6.438 ms
6.408 ms
6.390 ms
6.405 ms
6.420 ms
6.408 ms
17.413 ms
17.454 ms
17.412 ms
17.403 ms
17.469 ms
17.367 ms
17.404 ms
17.379 ms
22.858 ms
22.886 ms
22.890 ms
22.867 ms
22.863 ms
22.894 ms
22.827 ms
22.862 ms
22.824 ms
22.888 ms
22.894 ms
22.877 ms
22.820 ms
22.801 ms
22.951 ms
22.889 ms
22.800 ms
22.839 ms
22.836 ms
22.856 ms
22.885 ms
22.833 ms
22.873 ms
22.807 ms
22.847 ms
6.240 ms
6.601 ms
6.280 ms
6.294 ms
6.258 ms
6.263 ms
6.272 ms
6.269 ms
6.314 ms
6.267 ms
6.256 ms
6.284 ms
6.284 ms
6.250 ms
6.283 ms
6.290 ms
6.318 ms
6.243 ms
6.337 ms
6.275 ms
6.268 ms
6.248 ms
6.269 ms
6.240 ms
6.253 ms
6.259 ms
6.242 ms
6.286 ms
6.273 ms
6.254 ms
6.256 ms
6.250 ms
6.336 ms
6.266 ms
6.263 ms
6.270 ms
6.256 ms
6.245 ms
6.275 ms
6.294 ms
6.298 ms
6.257 ms
6.274 ms
6.253 ms
6.319 ms
6.294 ms
6.265 ms
6.268 ms
6.260 ms
6.258 ms
6.235 ms
6.252 ms
6.298 ms
6.277 ms
6.269 ms
6.272 ms
6.330 ms
6.235 ms
6.258 ms
6.317 ms
6.422 ms
6.402 ms
6.562 ms
6.394 ms
6.398 ms
6.393 ms
6.391 ms
6.395 ms
6.380 ms
6.396 ms
6.469 ms
6.400 ms
6.388 ms
6.466 ms
6.467 ms
6.392 ms
6.397 ms
6.405 ms
6.394 ms
6.395 ms
6.480 ms
6.448 ms
6.383 ms
6.462 ms
6.444 ms
6.400 ms
6.401 ms
6.388 ms
6.552 ms
6.382 ms
6.415 ms
6.458 ms
6.406 ms
6.389 ms
6.478 ms
6.444 ms
6.395 ms
6.385 ms
6.508 ms
6.411 ms
6.509 ms
6.496 ms
6.414 ms
6.397 ms
6.392 ms
6.422 ms
6.406 ms
6.397 ms
6.394 ms
6.413 ms
6.596 ms
6.406 ms
6.409 ms
6.411 ms
6.450 ms
6.387 ms
6.398 ms
7.411 ms
6.399 ms
6.393 ms
6.431 ms
6.399 ms
6.409 ms
6.413 ms
6.470 ms
6.401 ms
6.403 ms
6.488 ms
6.430 ms
6.394 ms
6.496 ms
6.482 ms
6.479 ms
6.589 ms
6.376 ms
6.846 ms
6.417 ms
6.402 ms
6.388 ms
6.611 ms
6.386 ms
6.384 ms
6.380 ms
6.481 ms
6.396 ms
6.410 ms
6.405 ms
6.438 ms
6.677 ms
Network path / recorded observations

Network path observations.

16 observations

Choose a measurement type to see the closest of the available sampled observations to the selected chart point. Each probe is separate and may follow a different path.

Before

ICMP traceroute · Recorded address 2

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.117 msReply RTT AS8002 · Stealth
Before

TCP traceroute / 443 · Recorded address 2

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.140 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hopNo replyNo comparable RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hop7.313 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hopNo replyNo comparable RTT ASN unavailable
  7. TTL 7 Probe hop8.181 msReply RTT AS8075 · Microsoft
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Probe hopNo replyNo comparable RTT ASN unavailable
  12. TTL 12 Destination6.532 msReply RTT AS8075 · Microsoft
Before

ICMP traceroute · Recorded address 1

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.155 msReply RTT AS8002 · Stealth
Before

TCP traceroute / 443 · Recorded address 1

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.135 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.851 msReply RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hop7.108 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop68.656 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hop8.259 msReply RTT AS8075 · Microsoft
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Probe hopNo replyNo comparable RTT ASN unavailable
  12. TTL 12 Destination6.389 msReply RTT AS8075 · Microsoft
During

ICMP traceroute · Recorded address 2

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.126 msReply RTT AS8002 · Stealth
During

TCP traceroute / 443 · Recorded address 2

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.206 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.749 msReply RTT AS8075 · Microsoft
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hop6.704 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop6.044 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination6.420 msReply RTT AS8075 · Microsoft
During

ICMP traceroute · Recorded address 4

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.122 msReply RTT AS8002 · Stealth
During

TCP traceroute / 443 · Recorded address 4

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.146 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hopNo replyNo comparable RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hop23.707 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hop23.662 msReply RTT AS8075 · Microsoft
  6. TTL 6 Probe hop24.808 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hop23.697 msReply RTT AS8075 · Microsoft
  8. TTL 8 Probe hop23.227 msReply RTT AS8075 · Microsoft
  9. TTL 9 Probe hop23.457 msReply RTT AS8075 · Microsoft
  10. TTL 10 Probe hop41.781 msReply RTT AS8075 · Microsoft
  11. TTL 11 Probe hop22.998 msReply RTT AS8075 · Microsoft
  12. TTL 12 Probe hopNo replyNo comparable RTT ASN unavailable
  13. TTL 13 Destination22.898 msReply RTT AS8075 · Microsoft
During

ICMP traceroute · Recorded address 1

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.181 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop4.997 msReply RTT ASN unavailable
During

TCP traceroute / 443 · Recorded address 1

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.151 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop37.575 msReply RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hop78.971 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop8.116 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination6.668 msReply RTT AS8075 · Microsoft
After

ICMP traceroute · Recorded address 1

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.132 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.957 msReply RTT ASN unavailable
After

TCP traceroute / 443 · Recorded address 1

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.154 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hopNo replyNo comparable RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop7.537 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination6.555 msReply RTT AS8075 · Microsoft
After

ICMP traceroute · Recorded address 3

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.165 msReply RTT AS8002 · Stealth
After

TCP traceroute / 443 · Recorded address 3

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.146 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop3.467 msReply RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop7.939 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination6.920 msReply RTT AS8075 · Microsoft
After

ICMP traceroute · Recorded address 3

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.112 msReply RTT AS8002 · Stealth
After

TCP traceroute / 443 · Recorded address 3

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.161 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hopNo replyNo comparable RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hop6.841 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hopNo replyNo comparable RTT ASN unavailable
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination6.757 msReply RTT AS8075 · Microsoft

RTT is the round trip to each responding hop, not the delay of the preceding link. TTL order may omit routers and does not prove direct links. A missing reply is not proof of packet loss. ASN labels are dated address associations; they do not establish the forwarding path or the operator at the event time. Up to three recorded traces per method and period are selected across the archive. Where no individual trace is available, a comparison may summarize a window; MTR observations aggregate multiple probes. Address aliases are independent across measurement types.

Same method / same recorded address

Compare the traces.

Compare one selected trace from before the event with one during it. Values are individual replies, not a statistical comparison.

ICMP traceroute · Recorded address 1

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.155 msAS8002 · Stealth0.181 msAS8002 · StealthSame responder
2Not recorded4.997 msNot established
ICMP traceroute · Recorded address 2

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.117 msAS8002 · Stealth0.126 msAS8002 · StealthSame responder
TCP traceroute / 443 · Recorded address 1

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.135 msAS8002 · Stealth0.151 msAS8002 · StealthSame responder
20.851 ms37.575 msSame responder
3No replyNo replyNot established
47.108 msAS8075 · Microsoft78.971 msAS8075 · MicrosoftDifferent responders
5No replyNo replyNot established
668.656 msAS8075 · Microsoft8.116 msAS8075 · MicrosoftDifferent responders
78.259 msAS8075 · MicrosoftNo replyNot established
8No replyNo replyNot established
9No replyNo replyNot established
10No replyNo replyNot established
11No reply6.668 msAS8075 · MicrosoftNot established
126.389 msAS8075 · MicrosoftNot recordedNot established
TCP traceroute / 443 · Recorded address 2

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.140 msAS8002 · Stealth0.206 msAS8002 · StealthSame responder
2No reply0.749 msAS8075 · MicrosoftNot established
3No replyNo replyNot established
47.313 msAS8075 · Microsoft6.704 msAS8075 · MicrosoftSame responder
5No replyNo replyNot established
6No reply6.044 msAS8075 · MicrosoftNot established
78.181 msAS8075 · MicrosoftNo replyNot established
8No replyNo replyNot established
9No replyNo replyNot established
10No replyNo replyNot established
11No reply6.420 msAS8075 · MicrosoftNot established
126.532 msAS8075 · MicrosoftNot recordedNot established

RTTs include the return path. Different responders, missing replies and independent probe flows limit what a change can localize. MTR snapshots remain separate in the replay.

Event timeline.

Possible SLA event. Times shown are UTC.

Event opened
UTC
Last event observation
UTC
Recovery observed
UTC

Recorded recovery describes this event, not current reachability.

02 / Assessment

Assessment.

Investigation stateRecovered
Path assessment

Elevated latency observed.

Endpoint round-trip time was elevated during part of the event. The available path observations do not identify where the increase occurred.

What we observed

  • A sustained increase in measured round trip time was observed.
  • Stored traces were compared using matching source and destination addresses.
  • The measured destination address changed across the comparison period.

Recording counts describe collected measurements, not application availability or packet loss. Exact packet paths and the return path remain unverified.

Measurements at a glance.

Baseline RTT6.728 msUsual round trip before the event
Last recorded event RTT6.256 msLast successful event recording
Event p95 RTT22.889 ms95th percentile of successful recordings
Change from baseline-0.473 msLast event RTT compared with the baseline
Successful / expected recordings70 / 70Recorded endpoint samples during the event

RTT is round trip time; p95 describes the upper range of successful recordings. Endpoint measurements differ from individual trace replies and are not an uptime percentage.

Record sources and timestamps
Analysis updated
UTC
Public snapshot published
UTC
Public observation window
– UTC

Event and source timestamps are UTC. The latency chart uses its selected timezone. Page refresh times are separate from measurement timestamps.

03 / Method and limits

Method and limits.

How to interpret the sampled path and its limits

Corroborating the path.

Comparisons use matching destinations before and during the event. ICMP traces use echo probes. TCP/443 traces send SYN probes to port 443 only; they do not complete a TCP handshake or perform a TLS or HTTP exchange.

The Stealth gNMI interface verifies the active route-table choice and maps its primary next hop to the Stealth logical interface, configured attachment and, where applicable, the known LAG member set at each snapshot. Stable Stealth replies, together with mapped interface evidence showing no corresponding errors or sustained capacity pressure, reduce the likelihood of a Stealth forwarding issue. An 80% load warning warrants investigation; it does not prove congestion. Lower interval averages can conceal bursts or queue pressure. Optical readings assess the physical link, not congestion.

What remains unseen.

Probe reply handling can differ from packet forwarding. A slow intermediate reply that disappears at later hops does not locate a forwarding problem. A destination that does not respond to a trace is not thereby shown to be unavailable.

Stealth does not use ECMP in this monitored scope. The route snapshot does not identify which physical LAG member carried a particular independent probe, attest line-card forwarding at that packet instant, prove the exact application packet flow or observe the return path. RTT includes the return path, which may differ. No remote reverse traceroute is available. Tunnels and silent routers may hide parts of the path. Address registration alone does not establish the forwarding operator or responsibility.

References: ICMP reply handling / RFC 1812 · Round trip measurements / RFC 2681 · Full methodology