A county permit-desk packet drop might be the physical top-of-rack switch or the NSX overlay. Which tool should the administrator use to trace underlay plus overlay path together?

When a county permit-desk packet drop might be the physical top-of-rack switch or the NSX overlay, the administrator should use vRealize Network Insight for physical and virtual path visibility. vRNI correlates underlay hops with overlay segments so civic network and security teams can see whether the drop is a ToR VLAN, a physical ACL, or an NSX hop without guessing which floor of the building owns the fault. That joint path view is what county permit-desk troubleshooting needs when metal and overlay are both in scope. NSX Intelligence alone, because it models Cisco ToR forwarding, fails by concept because Intelligence is NSX data-center security and overlay-flow focused and does not replace physical ToR traceroute or underlay path analytics the way vRNI does. Carbon Black Cloud sensor logs for the permit-desk VM fail by concept because endpoint process and prevention events do not reconstruct underlay-plus-overlay forwarding path. Workspace ONE UEM compliance on the clerk laptops fails by concept because device compliance is endpoint posture, not packet-path visibility across ToR and NSX. Exam caveat: when the stem says underlay plus overlay together, pick vRNI; Intelligence, Carbon Black, and UEM answer different layers and will not substitute for mixed physical-virtual path tracing. Operational check: run vRNI path analysis from the permit-desk source to destination, confirm which hop drops, validate ToR VLAN and NSX segment alignment, remediate the owning layer, and archive the path report in the county change ticket for municipal network governance.