Root cause analysis / Investigation

copilot.com

Reference RCA-F658BB5180786AF4

Microsoft Chat website

Measurement point: Stealth NYC, 32 Avenue of the Americas.

Published investigation. Updates run automatically.

01 / Network path

Network path.

Endpoint measurements / ICMP IPv4

Latency over time.

Successful endpoint RTT recordings from up to one hour before and after the event. Points are sampled from the retained history.

Enter time range

Times use the selected timezone; choices include recorded samples and intervals across the available chart.

Use the recordings table below to view latency values.

Successful RTT recording Event interval

04 Nov 2026 18:45 – 04 Nov 2026 23:04 UTC. Hover or tap to inspect; drag across the chart to zoom. On touchscreens, first choose Select time range. Escape or Reset zoom restores the full range. Missing recordings are gaps; this is not an application availability or packet-loss chart.

Select a recording to explore nearby path observations.

View recorded values
Successful ICMP IPv4 RTT recordings; displayed points are a sample of the retained records.
Recorded at (UTC)RTT
6.370 ms
6.388 ms
6.410 ms
6.373 ms
6.405 ms
6.395 ms
6.395 ms
6.454 ms
6.399 ms
6.393 ms
6.405 ms
6.422 ms
6.451 ms
6.401 ms
6.447 ms
6.410 ms
6.410 ms
6.384 ms
6.258 ms
22.824 ms
22.816 ms
22.877 ms
22.916 ms
22.843 ms
22.841 ms
22.875 ms
22.918 ms
22.877 ms
22.829 ms
22.866 ms
22.878 ms
22.837 ms
22.854 ms
22.861 ms
23.081 ms
22.915 ms
22.852 ms
22.882 ms
23.653 ms
22.879 ms
22.862 ms
22.843 ms
22.795 ms
22.845 ms
22.901 ms
22.836 ms
22.840 ms
22.798 ms
22.870 ms
22.850 ms
22.844 ms
22.834 ms
22.885 ms
22.853 ms
6.261 ms
6.269 ms
6.307 ms
6.260 ms
6.284 ms
6.317 ms
6.334 ms
6.292 ms
6.255 ms
6.273 ms
6.282 ms
6.276 ms
6.286 ms
6.305 ms
6.274 ms
6.281 ms
6.263 ms
6.254 ms
6.278 ms
6.290 ms
6.295 ms
6.291 ms
6.264 ms
6.260 ms
6.303 ms
6.691 ms
6.315 ms
6.260 ms
6.295 ms
6.246 ms
6.332 ms
6.358 ms
6.272 ms
6.271 ms
6.269 ms
6.268 ms
6.242 ms
6.245 ms
6.245 ms
6.278 ms
6.266 ms
6.262 ms
6.261 ms
6.275 ms
6.274 ms
6.307 ms
6.267 ms
6.284 ms
6.252 ms
6.265 ms
6.291 ms
6.250 ms
6.250 ms
6.341 ms
6.373 ms
6.281 ms
6.355 ms
6.268 ms
6.277 ms
6.281 ms
6.262 ms
6.283 ms
6.248 ms
6.275 ms
6.282 ms
6.254 ms
6.270 ms
6.266 ms
6.245 ms
18.110 ms
17.978 ms
18.019 ms
17.573 ms
17.606 ms
17.591 ms
17.591 ms
17.667 ms
17.591 ms
17.554 ms
17.566 ms
6.727 ms
6.718 ms
22.855 ms
22.907 ms
22.841 ms
22.844 ms
22.856 ms
22.830 ms
22.908 ms
22.852 ms
22.823 ms
22.842 ms
22.826 ms
22.823 ms
22.843 ms
22.838 ms
22.885 ms
22.877 ms
22.842 ms
22.815 ms
22.911 ms
22.810 ms
22.851 ms
22.826 ms
22.873 ms
22.886 ms
22.844 ms
22.797 ms
22.838 ms
22.874 ms
22.839 ms
22.830 ms
22.827 ms
23.210 ms
22.816 ms
22.926 ms
22.849 ms
22.904 ms
22.853 ms
23.032 ms
22.833 ms
22.858 ms
22.879 ms
22.835 ms
6.389 ms
6.393 ms
6.421 ms
6.417 ms
6.397 ms
6.398 ms
6.394 ms
6.496 ms
6.444 ms
22.790 ms
22.890 ms
22.882 ms
22.888 ms
22.873 ms
22.848 ms
22.953 ms
22.838 ms
22.843 ms
23.064 ms
22.863 ms
22.843 ms
22.882 ms
22.964 ms
22.862 ms
22.841 ms
22.814 ms
22.888 ms
22.916 ms
22.865 ms
22.907 ms
22.825 ms
22.801 ms
22.871 ms
22.790 ms
22.890 ms
22.918 ms
23.408 ms
22.806 ms
22.853 ms
22.877 ms
22.840 ms
22.903 ms
22.836 ms
22.792 ms
22.818 ms
22.860 ms
22.830 ms
22.873 ms
22.866 ms
6.771 ms
6.753 ms
6.696 ms
6.809 ms
6.729 ms
6.761 ms
6.718 ms
6.746 ms
6.720 ms
6.710 ms
6.707 ms
6.760 ms
6.802 ms
6.730 ms
6.734 ms
6.751 ms
6.777 ms
6.736 ms
6.724 ms
6.699 ms
6.728 ms
6.715 ms
6.779 ms
6.755 ms
6.722 ms
6.739 ms
6.727 ms
6.730 ms
6.739 ms
6.739 ms
6.716 ms
6.779 ms
6.713 ms
6.726 ms
6.710 ms
6.719 ms
6.747 ms
6.775 ms
6.753 ms
6.725 ms
6.710 ms
6.630 ms
6.667 ms
6.645 ms
6.640 ms
6.631 ms
6.633 ms
6.643 ms
6.681 ms
6.643 ms
6.627 ms
6.655 ms
6.636 ms
6.665 ms
6.667 ms
6.643 ms
6.669 ms
6.633 ms
6.676 ms
6.636 ms
6.651 ms
6.670 ms
6.649 ms
6.669 ms
6.672 ms
6.661 ms
6.644 ms
6.633 ms
6.637 ms
6.631 ms
6.633 ms
6.658 ms
6.649 ms
6.653 ms
6.653 ms
6.680 ms
6.669 ms
6.661 ms
6.652 ms
6.693 ms
6.643 ms
6.708 ms
6.695 ms
6.745 ms
6.714 ms
6.752 ms
6.720 ms
6.655 ms
6.688 ms
6.692 ms
6.671 ms
6.660 ms
6.690 ms
6.648 ms
6.665 ms
6.692 ms
6.669 ms
6.666 ms
6.751 ms
6.686 ms
6.709 ms
6.669 ms
6.694 ms
6.657 ms
6.723 ms
6.691 ms
6.705 ms
6.677 ms
6.685 ms
6.714 ms
6.719 ms
6.633 ms
6.697 ms
6.673 ms
6.672 ms
6.641 ms
6.700 ms
6.653 ms
6.663 ms
6.664 ms
6.731 ms
6.662 ms
6.665 ms
6.681 ms
6.752 ms
6.724 ms
6.665 ms
6.730 ms
6.647 ms
6.658 ms
6.659 ms
6.666 ms
Network path / recorded observations

Network path observations.

16 observations

Choose a measurement type to see the closest of the available sampled observations to the selected chart point. Each probe is separate and may follow a different path.

Before

ICMP traceroute · Recorded address 3

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.149 msReply RTT AS8002 · Stealth
Before

TCP traceroute / 443 · Recorded address 3

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.160 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.801 msReply RTT AS8075 · Microsoft
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop7.259 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination6.825 msReply RTT AS8075 · Microsoft
Before

ICMP traceroute · Recorded address 2

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.162 msReply RTT AS8002 · Stealth
Before

TCP traceroute / 443 · Recorded address 2

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.159 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hopNo replyNo comparable RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop5.944 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination7.613 msReply RTT AS8075 · Microsoft
During

ICMP traceroute · Recorded address 2

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.133 msReply RTT AS8002 · Stealth
During

TCP traceroute / 443 · Recorded address 2

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.161 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hopNo replyNo comparable RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hop7.354 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop8.720 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Probe hopNo replyNo comparable RTT ASN unavailable
  12. TTL 12 Destination6.543 msReply RTT AS8075 · Microsoft
During

ICMP traceroute · Recorded address 3

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.125 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop1.098 msReply RTT AS8075 · Microsoft
During

TCP traceroute / 443 · Recorded address 3

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.140 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hopNo replyNo comparable RTT ASN unavailable
  3. TTL 3 Probe hop0.933 msReply RTT AS8075 · Microsoft
  4. TTL 4 Probe hopNo replyNo comparable RTT ASN unavailable
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop8.257 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination6.715 msReply RTT AS8075 · Microsoft
During

ICMP traceroute · Recorded address 5

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.140 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.944 msReply RTT AS8075 · Microsoft
During

TCP traceroute / 443 · Recorded address 5

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.178 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop0.944 msReply RTT AS8075 · Microsoft
  3. TTL 3 Probe hop1.026 msReply RTT AS8075 · Microsoft
  4. TTL 4 Probe hop33.055 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop8.816 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hop8.249 msReply RTT AS8075 · Microsoft
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Probe hopNo replyNo comparable RTT ASN unavailable
  12. TTL 12 Destination7.266 msReply RTT AS8075 · Microsoft
After

ICMP traceroute · Recorded address 5

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.149 msReply RTT AS8002 · Stealth
After

TCP traceroute / 443 · Recorded address 5

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.139 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hopNo replyNo comparable RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hop7.213 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hopNo replyNo comparable RTT ASN unavailable
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination7.034 msReply RTT AS8075 · Microsoft
After

ICMP traceroute · Recorded address 4

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.168 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop74.777 msReply RTT AS8075 · Microsoft
  3. TTL 3 Probe hop5.556 msReply RTT AS8075 · Microsoft
After

TCP traceroute / 443 · Recorded address 4

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.141 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop8.105 msReply RTT AS8075 · Microsoft
  3. TTL 3 Probe hop1.781 msReply RTT AS8075 · Microsoft
  4. TTL 4 Probe hop6.926 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop8.418 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hopNo replyNo comparable RTT ASN unavailable
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Destination6.819 msReply RTT AS8075 · Microsoft
After

ICMP traceroute · Recorded address 1

Recorded trace · destination not reached by this trace


to UTC

  1. TTL 1 Probe hop0.140 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hop1.232 msReply RTT AS8075 · Microsoft
  3. TTL 3 Probe hop4.618 msReply RTT AS8075 · Microsoft
  4. TTL 4 Probe hop7.405 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hop8.682 msReply RTT AS8075 · Microsoft
  6. TTL 6 Probe hop7.950 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hop8.687 msReply RTT AS8075 · Microsoft
After

TCP traceroute / 443 · Recorded address 1

Recorded trace · destination replied


to UTC

  1. TTL 1 Probe hop0.173 msReply RTT AS8002 · Stealth
  2. TTL 2 Probe hopNo replyNo comparable RTT ASN unavailable
  3. TTL 3 Probe hopNo replyNo comparable RTT ASN unavailable
  4. TTL 4 Probe hop7.536 msReply RTT AS8075 · Microsoft
  5. TTL 5 Probe hopNo replyNo comparable RTT ASN unavailable
  6. TTL 6 Probe hop8.147 msReply RTT AS8075 · Microsoft
  7. TTL 7 Probe hop7.740 msReply RTT AS8075 · Microsoft
  8. TTL 8 Probe hopNo replyNo comparable RTT ASN unavailable
  9. TTL 9 Probe hopNo replyNo comparable RTT ASN unavailable
  10. TTL 10 Probe hopNo replyNo comparable RTT ASN unavailable
  11. TTL 11 Probe hopNo replyNo comparable RTT ASN unavailable
  12. TTL 12 Destination6.644 msReply RTT AS8075 · Microsoft

RTT is the round trip to each responding hop, not the delay of the preceding link. TTL order may omit routers and does not prove direct links. A missing reply is not proof of packet loss. ASN labels are dated address associations; they do not establish the forwarding path or the operator at the event time. Up to three recorded traces per method and period are selected across the archive. Where no individual trace is available, a comparison may summarize a window; MTR observations aggregate multiple probes. Address aliases are independent across measurement types.

Same method / same recorded address

Compare the traces.

Compare one selected trace from before the event with one during it. Values are individual replies, not a statistical comparison.

ICMP traceroute · Recorded address 2

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.162 msAS8002 · Stealth0.133 msAS8002 · StealthSame responder
ICMP traceroute · Recorded address 3

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.149 msAS8002 · Stealth0.125 msAS8002 · StealthSame responder
2Not recorded1.098 msAS8075 · MicrosoftNot established
TCP traceroute / 443 · Recorded address 2

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.159 msAS8002 · Stealth0.161 msAS8002 · StealthSame responder
2No replyNo replyNot established
3No replyNo replyNot established
4No reply7.354 msAS8075 · MicrosoftNot established
5No replyNo replyNot established
65.944 msAS8075 · Microsoft8.720 msAS8075 · MicrosoftDifferent responders
7No replyNo replyNot established
8No replyNo replyNot established
9No replyNo replyNot established
10No replyNo replyNot established
117.613 msAS8075 · MicrosoftNo replyNot established
12Not recorded6.543 msAS8075 · MicrosoftNot established
TCP traceroute / 443 · Recorded address 3

Before: UTC · During: UTC

Same destination address and probe method. A matching TTL does not establish the same forwarding path.
TTLBefore RTTDuring RTTResponding address
10.160 msAS8002 · Stealth0.140 msAS8002 · StealthSame responder
20.801 msAS8075 · MicrosoftNo replyNot established
3No reply0.933 msAS8075 · MicrosoftNot established
4No replyNo replyNot established
5No replyNo replyNot established
67.259 msAS8075 · Microsoft8.257 msAS8075 · MicrosoftDifferent responders
7No replyNo replyNot established
8No replyNo replyNot established
9No replyNo replyNot established
10No replyNo replyNot established
116.825 msAS8075 · Microsoft6.715 msAS8075 · MicrosoftSame responder

RTTs include the return path. Different responders, missing replies and independent probe flows limit what a change can localize. MTR snapshots remain separate in the replay.

Event timeline.

Possible SLA event. Times shown are UTC.

Event opened
UTC
Last event observation
UTC
Recovery observed
UTC

Recorded recovery describes this event, not current reachability.

02 / Assessment

Assessment.

Investigation stateRecovered
Path assessment

Elevated latency observed.

Endpoint round-trip time was elevated during part of the event. The available path observations do not identify where the increase occurred.

What we observed

  • A sustained increase in measured round trip time was observed.
  • The measured destination address changed across the comparison period.

Recording counts describe collected measurements, not application availability or packet loss. Exact packet paths and the return path remain unverified.

Measurements at a glance.

Baseline RTT6.723 msUsual round trip before the event
Last recorded event RTT6.802 msLast successful event recording
Event p95 RTT22.916 ms95th percentile of successful recordings
Change from baseline+0.079 msLast event RTT compared with the baseline
Successful / expected recordings280 / 280Recorded endpoint samples during the event

RTT is round trip time; p95 describes the upper range of successful recordings. Endpoint measurements differ from individual trace replies and are not an uptime percentage.

Record sources and timestamps
Analysis updated
UTC
Public snapshot published
UTC
Public observation window
– UTC

Event and source timestamps are UTC. The latency chart uses its selected timezone. Page refresh times are separate from measurement timestamps.

03 / Method and limits

Method and limits.

How to interpret the sampled path and its limits

Corroborating the path.

Comparisons use matching destinations before and during the event. ICMP traces use echo probes. TCP/443 traces send SYN probes to port 443 only; they do not complete a TCP handshake or perform a TLS or HTTP exchange.

The Stealth gNMI interface verifies the active route-table choice and maps its primary next hop to the Stealth logical interface, configured attachment and, where applicable, the known LAG member set at each snapshot. Stable Stealth replies, together with mapped interface evidence showing no corresponding errors or sustained capacity pressure, reduce the likelihood of a Stealth forwarding issue. An 80% load warning warrants investigation; it does not prove congestion. Lower interval averages can conceal bursts or queue pressure. Optical readings assess the physical link, not congestion.

What remains unseen.

Probe reply handling can differ from packet forwarding. A slow intermediate reply that disappears at later hops does not locate a forwarding problem. A destination that does not respond to a trace is not thereby shown to be unavailable.

Stealth does not use ECMP in this monitored scope. The route snapshot does not identify which physical LAG member carried a particular independent probe, attest line-card forwarding at that packet instant, prove the exact application packet flow or observe the return path. RTT includes the return path, which may differ. No remote reverse traceroute is available. Tunnels and silent routers may hide parts of the path. Address registration alone does not establish the forwarding operator or responsibility.

References: ICMP reply handling / RFC 1812 · Round trip measurements / RFC 2681 · Full methodology