Microsoft-Windows-TCPIP

624 events across 2 channels

Event ID	Title	Channel
1001	TCP: endpoint %2 (Family=%3, PID=%4) created with status = %1.	Diagnostic
1002	TCP: Tcb %1 (local=%3 remote=%5) requested to connect.	Diagnostic
1003	TCP: Inspect Connect has been completed on Tcb %1 with status = %2.	Diagnostic
1004	TCP: Tcb %1 is going to output SYN with ISN = %2, RcvWnd = %3, RcvWndScale = %4.	Diagnostic
1005	TCP: endpoint bind failed: address %2 cannot be resolved (%3).	Diagnostic
1006	TCP: endpoint (sockaddr=%2) bind failed: port-acquisition status = %3.	Diagnostic
1007	TCP: endpoint (sockaddr=%2) bind failed: inspection status = %3.	Diagnostic
1008	TCP: endpoint (sockaddr=%2) bound.	Diagnostic
1009	TCP: endpoint (sockaddr=%2) closed.	Diagnostic
1010	TCP: endpoint (Family=%6 PID=%4) create failed: address family not attached.	Diagnostic
1011	TCP: endpoint (Family=%6 PID=%4) create failed: compartment %5 not found.	Diagnostic
1012	TCP: endpoint (Family=%6 PID=%4) create failed: inspection status %3.	Diagnostic
1013	TCP: endpoint (Family=%6 PID=%4) created.	Diagnostic
1014	TCP: listener (local=%2 remote=%4) accept failed: Route lookup status = %5, TCB …	Diagnostic
1015	TCP: listener (local=%3 remote=%5) accept failed: connection insertion.	Diagnostic
1016	TCP: listener (local=%2 remote=%4) accept failed: client rejection status = %5.	Diagnostic
1017	TCP: listener (local=%2 remote=%4) accept completed.	Diagnostic
1018	TCP: connection %8 (local=%2 remote=%4 PID=%6) connect failed: address family …	Diagnostic
1019	TCP: connection %8 (local=%2 remote=%4 PID=%6) connect failed: compartment %7 …	Diagnostic
1020	TCP: connection %8 (local=%2 remote=%4 PID=%6) connect failed: inspection status …	Diagnostic
1021	TCP: connection %8 (local=%2 remote=%4) connect failed: route lookup status = …	Diagnostic
1022	TCP: Bypass rate limiting since flag is set on path %5 (local=%2 remote=%4).	Diagnostic
1023	TCP: Charge rate limiting quota and set rate limiting flag for path %5 (local=%2 …	Diagnostic
1024	TCP: connection %8 (local=%2 remote=%4) deferred.	Diagnostic
1025	TCP: %6 rate-limiting paths %3 backlogged connections.	Diagnostic
1026	TCP: Release and set rate limiting flag on path %5 (local=%2 remote=%4).	Diagnostic
1027	TCP: connection %8 (local=%2 remote=%4) released.	Diagnostic
1028	TCP: Clear rate limiting flag on path %5 (local=%2 remote=%4) since connection …	Diagnostic
1029	TCP: connection %8 (local=%2 remote=%4) connect failed: connection cancelled.	Diagnostic
1030	TCP: connection (local=%2 remote=%4) connect failed: connection insertion status …	Diagnostic
1031	TCP: connection %8 (local=%2 remote=%4) connect proceeding.	Diagnostic
1032	TCP: connection %8 (local=%2 remote=%4) released due to cancel.	Diagnostic
1033	TCP: connection %8 (local=%2 remote=%4) connect completed.	Diagnostic
1034	TCP: connection %8 (local=%2 remote=%4) connect attempt failed with status = %5.	Diagnostic
1035	TCP: connection %8 (local=%2 remote=%4) connect failed: connect-complete inspect …	Diagnostic
1036	TCP: ApplySynOptions, failed to create session state with status = %5, TCB = %8.	Diagnostic
1037	TCP: ApplySynOptions, failed to update DF with status = %5, TCB = %8.	Diagnostic
1038	TCP: connection %8 (local=%2 remote=%4) close issued.	Diagnostic
1039	TCP: connection %8 (local=%2 remote=%4) abort issued.	Diagnostic
1040	TCP: connection %8 (local=%2 remote=%4) abort completed.	Diagnostic
1041	TCP: Injecting disconnect on a shutdown TCB failed.	Diagnostic
1042	TCP: connection disconnect %3, length=%1.	Diagnostic
1043	TCP: connection %8 (local=%2 remote=%4) disconnect completed.	Diagnostic
1044	TCP: connection %8 (local=%2 remote=%4) shutdown initiated (%5).	Diagnostic
1045	TCP: connection %8 (local=%2 remote=%4) connect failed: connect-request timeout …	Diagnostic
1046	TCP: connection %8 (local=%2 remote=%4) terminating: retransmission timeout …	Diagnostic
1047	TCP: connection %8 (local=%2 remote=%4) terminating: keep-alive timeout expired.	Diagnostic
1048	TCP: connection %8 (local=%2 remote=%4) terminating: disconnect timeout expired.	Diagnostic
1049	TCP: connection %8 (local=%2 remote=%4) connect failed: extended statistics …	Diagnostic
1050	TCP: connection %8 (local=%2 remote=%4) connect failed: port-acquisition status …	Diagnostic
1051	TCP: connection %4 transition from %1 to %2, SndNxt = %3.	Diagnostic
1052	TCP: Process with PID = %1 reserved %4 ports starting at %3.	Diagnostic
1053	TCP: Process with PID = %1 failed to reserve %4 ports starting at %3 with status …	Diagnostic
1054	TCP: Process with PID = %1 completed global port reservation of %4 ports …	Diagnostic
1055	TCP: entering SYN attack resistance mode, Syn Attacks Detected = %1.	Diagnostic
1056	TCP: reasembly rate-limiting violated %2 times since boot.	Diagnostic
1057	TCP: connection rate-limiting violated %4 times since boot.	Diagnostic
1058	TCP: land attack has dropped %5 packets since boot.	Diagnostic
1059	TCP: low memory state detected.	Diagnostic
1060	TCP: leaving low memory state.	Diagnostic
1061	TCP: address family %2 added to interface %1.	Diagnostic
1062	TCP: address family %2 removed from interface %1.	Diagnostic
1063	TCP: leaving SYN attack resistance mode, Syn Attacks Detected = %1.	Diagnostic
1064	TCP: Connection %1 %2 timer started.	Diagnostic
1065	TCP: Connection %1 stopping %2 timer.	Diagnostic
1066	TCP: Connection %1 %2 timer has expired.	Diagnostic
1067	TCP: ISB changed to %1.	Diagnostic
1068	TCP: moving RSS indirection table index %6 from processor %1 to processor %3.	Diagnostic
1069	TCP: connection %1: Timeout Event updated cwnd = %2 and updated ssthresh = %3.	Diagnostic
1070	TCP: connection %1: Rtt sample recorded %4.	Diagnostic
1071	TCP: connection %1: Cumulative ACK updated cwnd = %2.	Diagnostic
1072	TCP: connection %1: Duplicate ACK updated cwnd = %2 and updated ssthresh = %3.	Diagnostic
1073	TCP: connection %1: Sent data with number of bytes = %5 and Sequence number = …	Diagnostic
1074	TCP: connection %1: Received data with number of bytes = %2.	Diagnostic
1075	TCP: connection %1: ECN Echo updated cwnd = %2 and updated ssthresh = %3.	Diagnostic
1076	TCP: connection %1: Spurious timeout with SndUna = %7.	Diagnostic
1077	TCP: connection %1: Send Retransmit round with SndUna = %6, Round = %8, SRTT = …	Diagnostic
1078	TCP: connection %1: Entered loss recovery phase with SndUna = %2 and SndMax = …	Diagnostic
1079	TCP: connection %1: Leaving loss recovery phase with SndUna = %2 and SndMax = …	Diagnostic
1080	TCP: connection %1 entering SACK mode with SndUna = %2.	Diagnostic
1081	TCP: connection %1 leaving SACK mode with SndUna = %2.	Diagnostic
1082	TCP: connection %1 entering Congestion Avoidance Phase with cwnd = %2 and …	Diagnostic
1084	TCP: connection %1 entered BH, BH MSS %2, original MSS %3.	Diagnostic
1085	TCP: connection %1 Exiting BH due to %4, BH mss %2, Original MSS %3.	Diagnostic
1086	TCP: connection %1 not entering BH due to %4.	Diagnostic
1087	TCP: connection %1 spurious RTO detection initiated at %7.	Diagnostic
1088	TCP: connection %1 spurious RTO detection terminated at %7.	Diagnostic
1089	TCP: active connect failed (family=%2) connect-complete inspection failed: …	Diagnostic
1090	TCP: TcpReleaseIndicationList: Nbl = %1.	Diagnostic
1091	TCP: connection %1 posted an average of %5 bytes per send.	Diagnostic
1092	TCP: connection (local=%2 remote=%4) starting receive window auto-tuning.	Diagnostic
1093	TCP: connection (local=%2 remote=%4) ending receive window auto-tuning.	Diagnostic
1094	TCP: connection (local=%2 remote=%4) failed to enter auto-tuning because …	Diagnostic
1095	TCP: connection (local=%2 remote=%4) failed to enter auto-tuning because …	Diagnostic
1096	TCP: connection (local=%2 remote=%4) failed to enter auto-tuning because of …	Diagnostic
1097	TCP: connection (local=%2 remote=%4) auto-tuner adjusted receive buffer size to …	Diagnostic
1098	TCP: connection %1: Rtt resiliency detection complete with Rtt sample = %4 and …	Diagnostic
1099	TCP: connection %5: Connection State = %1, Offload State = %2.	Diagnostic
1100	TCP: SWS avoidance began on connection %1.	Diagnostic
1101	TCP: SWS avoidance ended on connection %1.	Diagnostic
1102	TCP: connection %1 send: Beginning zero-window probing with SndUna = %2.	Diagnostic
1103	TCP: connection %1 send: Leaving zero-window probing with SndUna = %2.	Diagnostic
1104	TCP: Option %2 is going to be set for connection %1.	Diagnostic
1105	TCP: Socket Option %3 is going to be set for connection %1.	Diagnostic
1106	IP: Interface media disconnect.	Diagnostic
1107	TCPIP: Module %1 started.	Diagnostic
1108	TCPIP: Module %1 stopped.	Diagnostic
1109	TCPIP: Failure allocating %1.	Diagnostic
1110	TCP: Global parameters updated for Address Family %1: EnablePMtuDiscovery = %2, …	Diagnostic
1111	TCP: Connection %1 Large Send Offload, Bytes in segment = %2 and Bytes remaining …	Diagnostic
1112	TCP: Connection %1 status changed to %2.	Diagnostic
1113	TCP: Connection %1 status = %2, Interface = %3, PMax = %4.	Diagnostic
1114	IP: Address DAD successful.	Diagnostic
1115	IP: Address DAD failed.	Diagnostic
1116	IP: Address DAD started.	Diagnostic
1117	TCP: listener (sockaddr=%3 PID=%5) activation failed: address family not …	Diagnostic
1118	TCP: listener %1 (family=%7 PID=%5) activation failed: compartment %6 not found.	Diagnostic
1119	TCP: listener %1 (family=%7 PID=%5) activation failed: inspection status=%4.	Diagnostic
1120	TCP: listener %1 (sockaddr=%3) activation failed: inspection status=%4.	Diagnostic
1121	TCP: listener %1 (sockaddr=%3) bind failed: port-acquisition status=%4.	Diagnostic
1122	TCP: listener %1 (family=%7 PID=%5) bind failed: address %3 cannot be resolved …	Diagnostic
1123	TCP: listener %1 (sockaddr=%3) activated.	Diagnostic
1124	TCP: listener %1 (sockaddr=%3) unbound.	Diagnostic
1127	IP: Address addition.	Diagnostic
1128	IP: Address deletion.	Diagnostic
1130	Framing: Interface operation status change.	Diagnostic
1136	Framing: NDIS pause event.	Diagnostic
1137	Framing: NDIS restart event.	Diagnostic
1138	IP: IP address = %7 %9 %8 state changed to Preferred.	Diagnostic
1139	IP: IP address = %7 %9 %8 state changed to Non-preferred.	Diagnostic
1144	IP: Interface property change.	Diagnostic
1145	IP: Route %1 created on interface %2.	Diagnostic
1146	IP: Route %1 deleted on interface %2, Protocol = %5, DestinationPrefix = %16 %18 …	Diagnostic
1147	IP: Route %1 property change.	Diagnostic
1148	IP: Neighbor unreachable.	Diagnostic
1149	IP: Neighbor reachable.	Diagnostic
1150	TCP: CTCP DataTransferTimeout event.	Diagnostic
1151	TCP: CTCP Cumulative Ack event Connection %1, sequence = %6, CWnd = %2, DWnd = …	Diagnostic
1152	TCP: CTCP Duplicate Ack event.	Diagnostic
1153	TCP: CTCP Send event.	Diagnostic
1154	TCP: CTCP ECN event.	Diagnostic
1155	TCP: CTCP Spurious timeout event.	Diagnostic
1156	TCP: connection %1, delivery %2, Request %3 posted for %4 bytes, flags = %5.	Diagnostic
1157	TCP: connection %1 delivery %2 indicated %4 bytes accepted %6 bytes, status = …	Diagnostic
1158	TCP: connection %1 delivery %2 satisfied %4 bytes %6 requested.	Diagnostic
1159	TCP: connection %1 send %2 %3 bytes at %4.	Diagnostic
1160	TCP: connection %1 send transmitted %3 bytes at %4.	Diagnostic
1161	TCP: connection %1 send advance %3 bytes at %4.	Diagnostic
1162	TCP: CTcp: Connection %1 Delay window has not kicked in.	Diagnostic
1163	TCP: CTcp: Allocated blocks: %1; Assigned blocks: %2.	Diagnostic
1164	TCP: CTcp: Connection %1, DWnd = %2 (Prev = %3), BaseRtt = %4, AverageRtt = %5, …	Diagnostic
1165	TCP: CTcp: Gamma Autotuning: Connection %1 Updated Gamma %2, Average backlog %3, …	Diagnostic
1166	TCP: connection %1 SRTT measurement started (seq = %2, tick = %3).	Diagnostic
1167	TCP: connection %1 SRTT measurement complete (tick = %3, sample = %4 ms, new …	Diagnostic
1168	TCP: connection %1: SRTT measurement cancelled.	Diagnostic
1169	UDP: endpoint %1 (LocalAddress = %5, RemoteAddress = %7) sending %2 messages and …	Diagnostic
1170	UDP: endpoint %1 (LocalAddress = %5, RemoteAddress = %7) delivering %3 bytes.	Diagnostic
1171	TCP: connection %1 delivery %2 flushing %4 bytes %6 requested status = %7.	Diagnostic
1172	TCP: Injecting receive on a shutdown TCB failed.	Diagnostic
1173	TCP: connection %1 delivery %2 injecting %4 bytes delta %6, IsUrgentDelivery = …	Diagnostic
1174	TCP: Injecting fin on a shutdown TCB failed.	Diagnostic
1175	TCP: connection %1 delivery %2 accepting %4 bytes.	Diagnostic
1176	TCP: connection %1 delivery %2 delivering FIN.	Diagnostic
1178	TCP: connection %1 delivery %2 pushing %4 bytes %6 requested.	Diagnostic
1180	TCP: Injecting fin on TCB completed.	Diagnostic
1181	TCP: connection %1 delivery %2 urgent boundary completing %4 bytes %6 requested.	Diagnostic
1182	TCP: connection %1 (local=%3 remote=%5): initiating SYN/RST validation.	Diagnostic
1183	TCP: connection %1 (local=%3 remote=%5) connect failed: received RST.	Diagnostic
1184	TCP: connection %1 (local=%3 remote=%5) connection terminated: received RST.	Diagnostic
1185	TCP: connection %1 (local=%3 remote=%5) connection terminated: received SYN in …	Diagnostic
1186	TCP: connection %1 (local=%3 remote=%5) retransmitting connect attempt, …	Diagnostic
1187	TCP: connection %1 (local=%3 remote=%5) retransmitting data, RexmitCount = %7.	Diagnostic
1188	TCP: connection %1 send keep-alive at SndUna = %2.	Diagnostic
1189	TCP: connection %1, delivery %2: delivery state changed from %3 to %4.	Diagnostic
1190	TCP: connection %1 delivery %2 dropping data.	Diagnostic
1191	TCP: endpoint/connection %1 acquired port number %2.	Diagnostic
1192	TCP: connection %1 attempted to acquire weak reference on port number %2 …	Diagnostic
1193	TCP: endpoint/connection %1 released port number %2.	Diagnostic
1194	TCP: endpoint/connection %1 replaced base endpoint %4 and acquired reference to …	Diagnostic
1195	TCP: Portpool assigned port number %2 with weak references due to port …	Diagnostic
1196	TCP: connection %1 BH receive ACK for full size seq.	Diagnostic
1197	TCP: connection %1 flushed SACK state at SndUna = %2.	Diagnostic
1198	TCP: Connection %1 entering reassembly at RcvNxt = %2.	Diagnostic
1199	TCP: Connection %1 leaving reassembly at RcvNxt = %2.	Diagnostic
1200	TCP: connection %8 (local=%2 remote=%4) terminating: Zero window probe timeout …	Diagnostic
1201	TCP: connection %8 (local=%2 remote=%4) terminating: FIN-WAIT-2 timeout expired.	Diagnostic
1202	IP: Interface rundown: Index = %1, Linkspeed = %2 bps, PhysicalMediumType = %7, …	Diagnostic
1203	IP: Interface linkspeed change.	Diagnostic
1204	TCP: Connection %1 flushing reassembly state at RcvNxt = %2.	Diagnostic
1205	TCPIP: NBL %1 fell off the receive fast path, Reason: %10.	Diagnostic
1206	TCPIP: NBL %1 fell off the send fast path, Reason: %10.	Diagnostic
1207	TCP: WSD - %1 Status: %2.	Diagnostic
1208	TCP: WSD - %1 Status: %2.	Diagnostic
1209	TCP: WSD - TCB %2 will use a highly restricted window scale factor due to a %1.	Diagnostic
1210	TCP: WSD - TCB %2 will use a highly restricted window scale factor due to a %1.	Diagnostic
1211	TCP: WSD - Entry (%2, %3) moved from %4 to %5 due to %1.	Diagnostic
1212	TCP: WSD - Profile: %1 State: %2 Qualified: %3 EreQualified: %4.	Diagnostic
1213	TCP: WSD - Enabled moved from %1 to %2.	Diagnostic
1214	TCPIP: Transport (Protocol %1, AddressFamily = %2) dropped %8 packet(s) with …	Diagnostic
1215	TCPIP: Network layer (Protocol %1, AddressFamily = %2) dropped %10 packet(s).	Diagnostic
1216	TCP: MPP NPP Evaluation PhysicalPages = %1 NonPagedPoolPages = %2 Current = %3 …	Diagnostic
1217	TCP: MPP: Episode started.	Diagnostic
1218	TCP: MPP: Episode ended.	Diagnostic
1219	TCP: MPP: Epoch %1 started.	Diagnostic
1220	TCP: MPP: Epoch %1 ended.	Diagnostic
1221	TCP: Connection %1 restarting Cwnd.	Diagnostic
1222	TCP: Connection %1 adjust InitalCwnd.	Diagnostic
1223	TCP: Connection %1 committed TemplateType = %2.	Diagnostic
1224	TCP: Connection %1 template changed.	Diagnostic
1225	TCP: connection %1: End of a round, SndRound = %2, Bytes sent = %3.	Diagnostic
1226	TCP: interface %1: RSC state changed, IPV4 State = %2, IPV4 Failure Reason = %3, …	Diagnostic
1227	TCP: connection %1: RSC SCU received.	Diagnostic
1228	TCPIP: TCB %1 does not take fast path, Cause: %2.	Diagnostic
1229	TCP: Connection %1 send queue is idle.	Diagnostic
1230	RSS: %3 notification for %2 on interface %1.	Diagnostic
1231	RSS: %4 notification for adapter %1.	Diagnostic
1232	RSS: %4 reference on adapter %1.	Diagnostic
1233	RSS: adapter %1 with capabilities %2 and %4 receive queues.	Diagnostic
1234	RSS: adapter %1 processor group %2 maximum processors %3 processor affinity %4.	Diagnostic
1235	RSS: assigning processor %2 from adapter %3 to %1.	Diagnostic
1236	RSS: unassigning processor %2 from adapter %1.	Diagnostic
1237	RSS: adapter %1 reassigning indirection entry %2 from processor %3 to %4.	Diagnostic
1238	RSS: adapter %1 removing processor %2 from its indirection table.	Diagnostic
1239	RSS: adapter %1 changing %2 to %3.	Diagnostic
1240	RSS: Failed to %2 on IfIndex %1: %3.	Diagnostic
1241	RSS: bind completed successfully for %2 on interface %1.	Diagnostic
1242	RSS: bind completed successfully for adapter %1.	Diagnostic
1243	RSS: adapter %1 not supported.	Diagnostic
1244	RSS: adapter %1 indirection table initialized on group %4 with processor set %5.	Diagnostic
1245	RSS: Rundown: interface %1 with adapter %2 at port %3.	Diagnostic
1246	RSS: Rundown: adapter %1 hash info %2 maximum processors %3 group %4 affinity %5 …	Diagnostic
1247	RSS: interface %1 support: %2.	Diagnostic
1248	NDKPI Create CQ: RequestContext %6 Adapter %1 CqDepth %2 CqNotificationContext …	Diagnostic
1249	NDKPI Create Completion: RequestContext %1 Status %2 (%4) %5 %3.	Diagnostic
1250	NDKPI Close %2: RequestContext %3 %2 %1.	Diagnostic
1251	NDKPI Close Completion: RequestContext %1 (%2).	Diagnostic
1252	NDKPI Resize CQ: RequestContext %3 CQ %1 CqDepth %2.	Diagnostic
1253	NDKPI Request Completion: RequestContext %1 Status %2 (%3).	Diagnostic
1254	NDKPI Arm CQ: CQ %1 %2.	Diagnostic
1255	NDKPI Result %6/%7: CQ %1 RequestContext %5 Status %2 BytesTransferred %3 …	Diagnostic
1256	NDKPI Create MR: RequestContext %3 PD %1 FastRegister %2.	Diagnostic
1257	NDKPI Flush: QP %1.	Diagnostic
1258	NDKPI Send (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 Flags %7.	Diagnostic
1259	NDKPI Receive (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5.	Diagnostic
1260	NDKPI Register MR: RequestContext %5 MR %1 MDL %2 Length %3 Flags %4.	Diagnostic
1261	NDKPI Deregister MR: RequestContext %2 MR %1.	Diagnostic
1262	NDKPI Initialize FastRegister MR: RequestContext %4 MR %1 AdapterPageCount %2 …	Diagnostic
1263	NDKPI Modify SRQ: RequestContext %4 SRQ %1 SrqDepth %2 NotifyThreshold %3.	Diagnostic
1264	NDKPI Connect: RequestContext %9 Connector %1 QP %2 SrcAddress %4 DestAddress %6 …	Diagnostic
1265	NDKPI Connect: RequestContext %9 Connector %1 QP %2 SharedEndpoint %10 …	Diagnostic
1266	NDKPI CompleteConnect: RequestContext %3 Connector %1 DisconnectEventContext %2.	Diagnostic
1267	NDKPI Accept: RequestContext %6 Connector %1 QP %2 IRD %3 ORD %4 …	Diagnostic
1268	NDKPI Disconnect: RequestContext %2 Connector %1.	Diagnostic
1269	NDKPI Listen: RequestContext %4 Listener %1 Address %3.	Diagnostic
1270	NDKPI Create MW: RequestContext %2 PD %1.	Diagnostic
1271	NDKPI Create SRQ: RequestContext %8 PD %1 SrqDepth %2 MaxReceiveRequestSge %3 …	Diagnostic
1272	NDKPI Create QP: RequestContext %9 PD %1 ReceiveCQ %2 InitiatorCQ %3 QPContext …	Diagnostic
1273	NDKPI Create QP: RequestContext %9 PD %1 ReceiveCQ %2 InitiatorCQ %3 SRQ %10 …	Diagnostic
1274	NDKPI Create PD: RequestContext %2 Adapter %1.	Diagnostic
1275	NDKPI Create SharedEndpoint: RequestContext %4 Adapter %1 Address %3.	Diagnostic
1276	NDKPI Create Connector: RequestContext %2 Adapter %1.	Diagnostic
1277	NDKPI Create Listener: RequestContext %3 Adapter %1 ConnectEventContext %2.	Diagnostic
1278	NDKPI Build LAM: RequestContext %4 Adapter %1 MDL %2 Length %3 LAMBuffer %5 …	Diagnostic
1279	NDKPI Release LAM: Adapter %1 LAMBuffer %2.	Diagnostic
1280	NDKPI CQ Notification Callback: CqNotificationContext %1 CqStatus %2.	Diagnostic
1281	NDKPI SRQ Notification Callback: SrqNotificationContext %1 SrqStatus %2.	Diagnostic
1282	NDKPI Disconnect Event Callback: DisconnectEventContext %1.	Diagnostic
1283	NDKPI Connect Event Callback: ConnectEventContext %1 Connector %2.	Diagnostic
1284	NDKPI Got %3 Token %4 from %2 %1.	Diagnostic
1285	NDKPI Got %3 Address %5 from %2 %1.	Diagnostic
1286	NDKPI %3 Address query failure %4 on %2 %1.	Diagnostic
1287	NDKPI Reject: Connector %1 PrivateDataLength %2 Status %3.	Diagnostic
1288	NDKPI Get Connect Data: Connector %1 IRD %2 ORD %3 PrivateDataLength %4 Status …	Diagnostic
1289	NDKPI Work Request Inline Failure: RequestContext %2 QP %1 Status %3.	Diagnostic
1290	NDKPI Bind: RequestContext %2 QP %1 MR %3 MW %4 VirtualAddress %5 Length %6 …	Diagnostic
1291	NDKPI FastRegister: RequestContext %2 QP %1 MR %3 AdapterPageCount %4 …	Diagnostic
1292	NDKPI Invalidate: RequestContext %2 QP %1 %4 %3 Flags %5.	Diagnostic
1293	NDKPI Read (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 RemoteAddress %9 …	Diagnostic
1294	NDKPI Write (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 RemoteAddress %9 …	Diagnostic
1295	NDKPI SRQ Receive (SGE %8/%6): RequestContext %2 SRQ %1 SGE %3/%4/%5.	Diagnostic
1296	NDKPI SRQ Work Request Inline Failure: RequestContext %2 SRQ %1 Status %3.	Diagnostic
1297	NDKPI Open Adapter: InterfaceIndex %1 Adapter %2 Status %3.	Diagnostic
1298	NDKPI Close Adapter (Enter): Adapter %1.	Diagnostic
1299	NDKPI Close Adapter (Exit): Adapter %1.	Diagnostic
1300	TCP: connection %1 (local=%3 remote=%5) exists.	Diagnostic
1301	NDKPI Interface Event: InterfaceIndex %1, NDK-Operational %3, %2 (%4).	Diagnostic
1302	Network adapter Luid .	Operational
1302	Network adapter Luid %1 received a wake packet matching pattern %2.	Diagnostic
1303	Network adapter Luid .	Operational
1303	Network adapter Luid %1 received a wake packet matching pattern %2.	Diagnostic
1304	TCP: Connection %1: Silent Mode %2 Context %3.	Diagnostic
1305	TCP: Connection %1 notification channel request.	Diagnostic
1306	TCP: Connection %1 query notification channel status request.	Diagnostic
1307	TCP: Connection %1 notification channel request processed.	Diagnostic
1308	TCP: Connection %1 notification channel signal event.	Diagnostic
1309	TCP: Connection %1 notification channel detached.	Diagnostic
1310	TCP: Connection %1 notification channel unlinked.	Diagnostic
1311	TCP: Connection %1 notification channel wake pattern plumbing.	Diagnostic
1312	TCP: Connection %1 notification channel wake pattern deplumbing.	Diagnostic
1313	TCPIP: Interface index %1 wake pattern properties.	Diagnostic
1314	NDKPI Control CQ Interrupt Moderation: CQ %1 Interval %2 Count %3 Status %4.	Diagnostic
1315	TCP: Connection %1 notification channel request processing.	Diagnostic
1316	IP: IP address lifetime = %4 %6 %5 on interface = %1, protocol = %2, CurrentTime …	Diagnostic
1317	TCP: Repartition event %1 (%2) %5.	Diagnostic
1318	%1 %2 on processor %3 at Tick = %4 Time = %5.	Diagnostic
1319	%1 timer rescheduled by processor %2 for processor %3 at Tick = %4 to Tick = %5, …	Diagnostic
1320	%1 timer fired on processor %2 at Tick = %3, was scheduled for = %4.	Diagnostic
1321	IP: Interface media connect.	Diagnostic
1322	IP: Interface limited link connectivity set.	Diagnostic
1323	IP: Interface limited link connectivity reset.	Diagnostic
1324	IP: Neighbor state change.	Diagnostic
1325	IP: Neighbor Discovery.	Diagnostic
1326	IP: Source address %2 is preferred over %3 for Destination %4 in Compartment %5, …	Diagnostic
1327	IP: Address pair (%2, %3) is preferred over (%4, %5) by SortOptions = %6, Rule = …	Diagnostic
1328	NDKPI ResultEx %6/%7: CQ %1 RequestContext %5 Status %2 BytesTransferred %3 …	Diagnostic
1329	NDKPI SendInvalidate (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 …	Diagnostic
1330	TCP: connection %1: Cumulative Ack event, SeqNo = %5, BytesAcked = %4, CWnd = …	Diagnostic
1331	TCP: connection %1: CTCP Cumulative Ack event, SeqNo = %5, BytesAcked = %4, CWnd …	Diagnostic
1332	TCP: connection %1: TCP send event, SeqNo = %5, BytesSent = %4, CWnd = %2, …	Diagnostic
1333	TCP: connection %1: TCP CTCP send event, SeqNo = %5, BytesSent = %4, CWnd = %2, …	Diagnostic
1334	UDP: Endpoint %1 notification channel request.	Diagnostic
1335	UDP: Endpoint %1 query notification channel status request.	Diagnostic
1336	UDP: Endpoint %1 notification channel request processed.	Diagnostic
1337	UDP: Endpoint %1 notification channel signal event.	Diagnostic
1338	UDP: Endpoint %1 notification channel detached.	Diagnostic
1339	UDP: Endpoint %1 notification channel unlinked.	Diagnostic
1340	UDP: Endpoint %1 notification channel request processing.	Diagnostic
1341	TCP: connection %1: Rtt sample recorded %2 SRTT %4 RttVar %3.	Diagnostic
1342	TCP: connection %1: Rtt resiliency detection complete with Rtt sample = %2 and …	Diagnostic
1343	TCP: connection %1: Duplicate ACK updated cwnd = %2 and updated ssthresh = %3 …	Diagnostic
1344	TCP: CTCP Duplicate Ack event.	Diagnostic
1345	TCP: connection %1: Spurious timeout at Seq = %2.	Diagnostic
1346	TCP: connection %1 spurious RTO detection initiated at %2.	Diagnostic
1347	TCP: connection %1 spurious RTO detection terminated at %2.	Diagnostic
1348	TCP: CTCP DataTransferTimeout event.	Diagnostic
1349	TCP: CTCP Spurious timeout event.	Diagnostic
1350	TCP: connection %1 entering Congestion Avoidance Phase with cwnd = %2 and …	Diagnostic
1351	TCP: connection %1: Send Retransmit round with SndUna = %2, Round = %3, SRTT = …	Diagnostic
1352	TCP: Connection %1 Summary: DataBytesOut %2 DataBytesIn %3 DataSegmentsOut %4 …	Diagnostic
1353	TCPIP: Message %1 %2 %3 %4 %5.	Diagnostic
1354	TCP: Connection %1 SACK updated SndUna %2 SndMax %3 SackCount %4 SackBytes %5 …	Diagnostic
1355	TCP: TCB %1 Requires address based pattern = %2 LocalPort = %3 RtcPortRange = …	Diagnostic
1356	TCP: Rtc Port Range Assignment.	Diagnostic
1357	TCPIP has failed a %1 request from %4 to %6 on endpoint %2 owned by process %8 …	Diagnostic
1358	IP: Interface configuration flags updated.	Diagnostic
1359	TCP: Connection %1 notification channel unmark request.	Diagnostic
1360	TCPIP: A packet has been cloned for a raw listener.	Diagnostic
1361	TCPIP: A cloned packet has been dropped.	Diagnostic
1362	IP: Interface = %1 IpAddress = %3 processing WolEvent = %4 with Status = %5.	Diagnostic
1363	IP: Interface = %1 WolHandle = %3 has DestinationIpAddress = %4 TargetIpAddress1 …	Diagnostic
1364	TCP connection tuple inserted- TCB: %1 LocalAddress: %3 RemoteAddress: %5.	Diagnostic
1365	TCP connection tuple removed- TCB/TWTCB: %1 LocalAddress: %3 RemoteAddress: %5.	Diagnostic
1366	TCP port selection deferred for outbound connect- LocalAddress.	Diagnostic
1367	Nbl %1 OOB info (%2): TcpIpChecksumNetBufferListInfo %3, …	Diagnostic
1368	Teredo Add -- PID: %1 started listening on %3.	Diagnostic
1369	Teredo Remove -- PID: %1 stopped listening on %3.	Diagnostic
1370	IP: RouteLookup - API: %1 DstAddr: %3 ConstrainSrcAddr: %4 ConstrainIfIndex: %5 …	Diagnostic
1371	IP: SourceAddrLookup - DstAddr: %2 ConstrainSrcAddr: %3 ConstrainIfIndex: %4 …	Diagnostic
1372	WFP-ALE: Partition Count=.	Diagnostic
1373	WFP-ALE: HotAdd/Remove: Old Partiton Count=.	Diagnostic
1374	WFP-ALE: RemoteEndPoint Insertion: AddrLen=.	Diagnostic
1375	WFP-ALE: RemoteEndPoint Deletion: AddrLen=.	Diagnostic
1376	WFP-ALE: ALE: low memory state detected.	Diagnostic
1377	WFP-ALE: leaving low memory state.	Diagnostic
1378	WFP-ALE: Dpc for cleanup initiated: LowMemoryEvent = %3 LowNonPagedPoolEvent = …	Diagnostic
1379	WFP: Dpc for cleanup QUEUED or RE-QUEUED: LowMemoryEvent = %3 …	Diagnostic
1380	TCP: LEDBAT %2: Connection %1, BaseDelayMs = %6, CurrentDelayMs = %7, CWnd = %3, …	Diagnostic
1381	TCP: AssociateNameResContext Endpoint: %1 Status: %16 NameResolutionContext: %2 …	Diagnostic
1382	TCP: InspectConnectWithNameResContext Connection: %5 (local: %2 remote: %4) …	Diagnostic
1383	IP: Route [DestinationPrefix: %6/%4 NextHop: %8 InterfaceIndex: %9 …	Diagnostic
1384	IP: Route [DestinationPrefix: %6/%4 NextHop: %8 InterfaceIndex: %9 RouteMetric: …	Diagnostic
1385	TCP: Tail Loss Probe Send Connection = %1 SndUna = %2, SndMax = %3, …	Diagnostic
1386	TCP: Tail Loss Probe Event Connection = %1, Event = %2.	Diagnostic
1387	TCP: RACK Event Connection = %1, Event = %2, MinRTT = %3, ReoWind = %4, …	Diagnostic
1388	TCP: Fastopen state changed for connection = %1 from OldState = %2 to NewState = …	Diagnostic
1389	UDP: endpoint (family=%5 pid=%3) create failed: address family not attached.	Diagnostic
1390	UDP: endpoint %1 (family=%5 pid=%3) create failed: compartment %4 not found.	Diagnostic
1391	UDP: endpoint %1 (family=%5 pid=%3) created.	Diagnostic
1392	UDP: endpoint %1 (family=%5 pid=%3) create failed: inspection status = %2.	Diagnostic
1393	UDP: endpoint %4 bind failed: address %2 cannot be resolved, status = %3.	Diagnostic
1394	UDP: endpoint %4 (sockaddr=%2) bind failed: port-acquisition status = %3.	Diagnostic
1395	UDP: endpoint %4 (sockaddr=%2) bind failed: inspection status = %3.	Diagnostic
1396	UDP: endpoint %4 (sockaddr=%2) bound.	Diagnostic
1397	UDP: endpoint %4 (sockaddr=%2) closed.	Diagnostic
1398	UDP: endpoint %4 closed.	Diagnostic
1399	UDP: endpoint %1 (sockaddr=%3) send messages %5: address resolution status = %6.	Diagnostic
1400	UDP: endpoint %1 (sockaddr=%3) send messages %5: address validation failed.	Diagnostic
1401	UDP: endpoint %1 (sockaddr=%3) send messages %5: source-address selection status …	Diagnostic
1402	UDP: endpoint {Endpoint} too many packets queued for the pending join path.	Diagnostic
1403	UDP: address family %2added to interface %1.	Diagnostic
1404	UDP: address family %2removed from interface %1.	Diagnostic
1405	UDP: Failure initializing transport protocol, status = %1.	Diagnostic
1406	UDP: Failure starting NLNPI client, status = %1.	Diagnostic
1407	UDP: Failure initializing NSI support, status = %1.	Diagnostic
1408	UDP: Failure starting TLNPI provider, status = %1.	Diagnostic
1409	UDP: Failure initializing QoS support, status = %1.	Diagnostic
1410	UDP: Failure starting %1, status = %2.	Diagnostic
1411	UDP: endpoint %1 (sockaddr=%3) send messages %5: could not allocate send …	Diagnostic
1412	UDP: endpoint %1 (sockaddr=%3) send messages %5: path af failure, status = %6.	Diagnostic
1413	UDP: endpoint %1 (sockaddr=%3) send messages %5: path missing next hop failure.	Diagnostic
1414	UDP: endpoint %1 (sockaddr=%3) send messages %5: path next hop address failure.	Diagnostic
1415	TCP: Early Retransmission, FACK or RACK, Connection = %1, SndUna = %2, …	Diagnostic
1416	TCP: Ignoring fastopen SYN option due to limit on concurrent SYN_RCVD fastopen …	Diagnostic
1417	TCP: Failed to update fastopen key state, Location = %1, Status = %2.	Diagnostic
1418	TCP: Fast Retransmit Send, Connection = %1, BytesToSend = %2, SndNxt = %3.	Diagnostic
1419	TCP: SACK Retransmit Send, Connection = %1, BytesToSend = %2, SndNxt = %3.	Diagnostic
1420	TCP: Limited Transmit Send, Connection = %1, BytesToSend = %2, SndNxt = %3.	Diagnostic
1421	TCP: SACK Retransmit Additional Send, Connection = %1, BytesToSend = %2, SndNxt …	Diagnostic
1422	%1: %2message.	Diagnostic
1423	%1: %2path drop.	Diagnostic
1424	%1: Echo timeout.	Diagnostic
1425	%1 Timer state changed to %3 by Processor %2 Usage = %4 at Tick = %5.	Diagnostic
1426	TCP: connection %1 send complete %3 bytes at %4 (%2).	Diagnostic
1427	IP: Compartment creation.	Diagnostic
1428	IP: Compartment deletion.	Diagnostic
1429	TCP: connection %1: Cumulative Ack event, SeqNo = %5, BytesAcked = %4, CWnd = …	Diagnostic
1430	TCP: connection %1: Duplicate ACK updated cwnd = %2 and updated ssthresh = %3 …	Diagnostic
1431	IP: Compartment cleanup.	Diagnostic
1432	IP: Interface network category state change.	Diagnostic
1433	IP: Interface creation.	Diagnostic
1434	IP: Interface deletion.	Diagnostic
1435	IP: Interface cleanup.	Diagnostic
1436	IP: SubInterface creation.	Diagnostic
1437	IP: SubInterface deletion.	Diagnostic
1438	IP: SubInterface cleanup.	Diagnostic
1439	IP: Interface change Notification.	Diagnostic
1440	IP: Interface internet connectivity status change.	Diagnostic
1441	IP: Address change notification.	Diagnostic
1442	IP: Route change notification.	Diagnostic
1443	IP: Neighbor change notification.	Diagnostic
1444	IP: Address DAD state change.	Diagnostic
1445	IP: Route Dead Gateway Detection state change.	Diagnostic
1446	IP: Disconnecting TCP connections with Address = %2, Interface = %3, Compartment …	Diagnostic
1447	TCP: connection %1: Sending paced chunk of %6 bytes with CWnd = %2, SndWnd = %3, …	Diagnostic
1448	Fallback: Context = %1, Feature = %2, TraceReason = %3, Confidence = %4, …	Diagnostic
1449	TCPIP: TCB %1 using fast loopback.	Diagnostic
1450	IP: Router information change notification.	Diagnostic
1451	IP.	Diagnostic
1452	IP: Route rundown.	Diagnostic
1453	TCP: CUBIC ECN event.	Diagnostic
1454	INETINSPECT: Owner = %1, InspectHandle = %2, InspectType = %3, Action = %4, …	Diagnostic
1455	INETINSPECT: Owner = %1, InspectHandle = %2, InspectType = %3, Action = %4, …	Diagnostic
1456	FallbackCheck: Ctx = %1, Feature = %2, Failed = %3, Succeeeded = %4, InProbe = …	Diagnostic
1457	FallbackUpdate: Ctx = %1, Feature = %2, Failed = %3, Succeeeded = %4, InProbe = …	Diagnostic
1458	Fallback: Permanently disabling feature, Ctx = %1, Feature = %2, PathsProbed = …	Diagnostic
1459	Fallback: Enabling feature for this boot session, Ctx = %1, Feature = %2, …	Diagnostic
1460	Fallback: Feature previously disabled, Ctx = %1, Feature = %2, PathsProbed = %6.	Diagnostic
1461	TCP Fastopen fallback update: Tcb = %1, FastopenState = %2, DataBytesIn = %3, …	Diagnostic
1462	Disabling feature until connectivity is established: CompartmentId =.	Diagnostic
1463	Disabling %1 for loopback connection.	Diagnostic
1464	Disabling TCP Fastopen for BaseEndpoint = %1 because an incompatible WFP callout …	Diagnostic
1465	IP: Setting source constraint for route lookup - Compartment: %1 DstAddr: %3 …	Diagnostic
1466	WFP-ALE: RemoteEndPoint Insertion: (local=%2 remote=%3) PartitionId=%4 …	Diagnostic
1467	WFP-ALE: RemoteEndPoint Deletion: (local=%2 remote=%3) PartitionId=%4 …	Diagnostic
1468	TCP: connection %8 (local=%2 remote=%4) system abort.	Diagnostic
1469	Disabling %1 due to no next hop.	Diagnostic
1470	TCP: endpoint (sockaddr=%2) bind failed: wake status = %3.	Diagnostic
1471	UDP: endpoint %4 (sockaddr=%2) bind failed: wake status = %3.	Diagnostic
1472	Acquire wake port %2, type=%1, family=%3, IF=%4, compartment=%5.	Diagnostic
1473	TCP: Connection %1 reached max SACK queue length.	Diagnostic
1474	TCP: Connection %1 requested fast open.	Diagnostic
1475	TCP: CUBIC Hystart state change event.	Diagnostic
1476	IP: Transmitting loopback Nbl %1.	Diagnostic
1477	TCP: Connection %1 Summary: DataBytesOut %2 DataBytesIn %3 DataSegmentsOut %4 …	Diagnostic
1478	TCPIP: Framing layer %1 (AddressFamily=%2) dropped %4 packet(s) on interface=%3, …	Diagnostic
1479	TCP: Connection %1 Transport (Protocol %2, AddressFamily = %3) sent RST with …	Diagnostic
1480	TCP connection failed with Status = %1, Local = %3, Remote = %5, ProcessId = %6, …	Diagnostic
1481	TCP: Connection %1 PRR send SackIsLostSeq %2 SackInFlight %3 SackBytes %4 …	Operational
1482	UDP: Endpoint %1 segment message.	Diagnostic
1483	UDP: Endpoint %1 segmentation offload unavailable.	Diagnostic
1484	TCPIP: Framing layer interface %1 (AddressFamily = %2) failed to bind to its …	Diagnostic
1485	TCPIP: OID request from framing layer interface %1 (AddressFamily = %2) failed.	Diagnostic
1486	TCPIP received a status indication on interface %1.	Diagnostic
1487	IP: Failed to set socket option.	Diagnostic
1488	IP: Failed to set socket IOCTL.	Diagnostic
1489	Failed to process multicast %1 request.	Diagnostic
1490	Processed multicast %1 request successfully.	Diagnostic
1491	%1.	Diagnostic
1492	%1.	Diagnostic
1493	Invalid ECN codepoints in reassembly.	Diagnostic
1494	Reassembly failure: packets do not add up correctly.	Diagnostic
1495	Reassembly failure: failed to restore IPSec packet history.	Diagnostic
1496	Could not transfer %1.	Diagnostic
1497	Attempting to %1 the multicast group at FL.	Diagnostic
1498	Failed to update address list at FL.	Diagnostic
1499	Too many DAD failures, so will not create temporary address.	Diagnostic
1500	Failed to address interface; deleting it.	Diagnostic
1501	Failed to reach default gateway after reconnect; cleaning settings.	Diagnostic
1502	Failed to sync interface with registry.	Diagnostic
1503	Failed to %1 an active reference on the interface.	Diagnostic
1504	Redirect path hijack for destination %2 %3 from %5 %6.	Diagnostic
1505	Redirect path rate limit for IPv6 source address %3.	Diagnostic
1506	Dropped %2 fragment.	Diagnostic
1507	Reassembly timeout.	Diagnostic
1508	Invalid IP option.	Diagnostic
1509	Invalid IP hop-by-hop option.	Diagnostic
1510	Invalid IP hop-by-hop option.	Diagnostic
1511	Invalid IP routing header option.	Diagnostic
1512	Invalid IP routing header option.	Diagnostic
1513	This option cannot be specified by the user	Diagnostic
1514	TCP: interface %1: received potential RSC status indication.	Diagnostic
1515	UDP: endpoint %1: URO SCU received.	Diagnostic
1516	TCP software RSC global disabled mask = %1, UDP software URO global disabled …	Diagnostic
1517	UDP: Global parameters updated for Address Family %1: DisableUro = %2.	Diagnostic
1518	IP: IPSNPI client rundown.	Diagnostic
1519	TCPIP: Process with PID=.	Diagnostic
1520	Illegal tunnel.	Diagnostic
1521	Framing: Interface change in progress.	Diagnostic
1522	Framing: Isolation is not supported on this network adapter.	Diagnostic
1523	Framing: Failed to set pattern.	Diagnostic
1524	Framing: Interface management request.	Diagnostic
1525	Framing: WOL capabilities update in progress.	Diagnostic
1526	Framing: A PNP event has been indicated.	Diagnostic
1527	Framing: interface rundown: Interface = %1, Luid = %2, Address family = %3, …	Diagnostic
1528	RAW: endpoint %1 (Proto = %2, LocalAddress = %6, RemoteAddress = %8) sending %3 …	Diagnostic
1529	RAW: endpoint %1 (Proto = %2, LocalAddress = %6, RemoteAddress = %8) delivering …	Diagnostic
1530	RAW: endpoint %1 (Proto = %2, LocalAddress = %4, RemoteAddress = %6) send failed …	Diagnostic
1531	RAW: endpoint %1 (Family = %2, Proto = %3, Compartment = %4, PID = %5, …	Diagnostic
1532	RAW: endpoint (Family = %2, Proto = %3, Compartment = %4, PID = %5, …	Diagnostic
1533	RAW: endpoint %1 (Proto = %2, LocalAddress = %4) bound.	Diagnostic
1534	RAW: endpoint %1 (Proto = %2, LocalAddress = %4) bind failed with reason %5 …	Diagnostic
1535	RAW: endpoint %1 closed.	Diagnostic
1536	TCPIP: Error processing router advertisement on interface index %1 - Preferred …	Diagnostic
1537	TCPIP: Error processing router advertisement on interface index %1 - Prefix …	Diagnostic
1538	TCPIP: An ARP request was dropped on interface %1.	Diagnostic
1539	TCPIP: An ARP reply was dropped on interface %1.	Diagnostic
1540	TCPIP: No handler found for an %1 packet with upper layer protocol %2.	Diagnostic
1541	TCPIP: Handler for upper layer protocol %2 for an %1 packet returned with error …	Diagnostic
1542	IP: neighbor rundown: Interface = %1, Compartment = %2, IpAddress = %4, …	Diagnostic
1543	TCPIP: An ARP request was dropped on interface %1.	Diagnostic
1544	Endpoint %1 socket option set with level %2, name %3, value %5.	Diagnostic
1545	TCP: connection = %1 RACK timeout expired.	Diagnostic
1546	TCP: connection = %1 armed RACK timer.	Diagnostic
1547	TCP: connection = %1 received a SACK block.	Diagnostic
1548	TCP: connection = %1 received a SACK.	Diagnostic
1549	TCP: connection = %1 enabled send tracker.	Diagnostic
1550	TCP: connection = %1 send tracker acked a transmit.	Diagnostic
1551	TCP: connection = %1 send tracker enqueued a transmit.	Diagnostic
1552	TCP: connection = %1 send tracker marked a transmit as lost.	Diagnostic
1553	TCP: accept redirection: original listener = %1, redirected listener = %2, …	Diagnostic
1554	TCP: connection = %1 dropped a SACK block due to SACK limit reached.	Diagnostic
1555	TCP: connection %1 terminated by NSI.	Diagnostic
1556	TCP: connection = %1 rate-based pacing timeout expired.	Diagnostic
1557	TCP RLedbat connection = %1.	Diagnostic
1558	UDP: endpoint %5 rebind initiated: current address = %2, modified address = %4.	Diagnostic
1559	UDP: endpoint %5 rebind failed: current address = %2, modified address = %4, …	Diagnostic
1560	TCP: endpoint %5 rebind initiated: current address = %2, modified address = %4.	Diagnostic
1561	TCP: endpoint %5 rebind failed: current address = %2, modified address = %4, …	Diagnostic
1562	TCP: endpoint (PID=%4 ProcessSeqNum=%7) create failed: access denied.	Diagnostic
1563	UDP: endpoint (PID=%3 ProcessSeqNum=%6) create failed: access denied.	Diagnostic
1564	TCP: connection %8 (local=%2 remote=%4 PID=%6 ProcessSeqNum=%9) connect failed: …	Diagnostic
1565	TCP: Congestion state changed for connection = %1 from OldState = %2 to NewState …	Diagnostic
1566	TCP: connection = %1 detected reordering.	Diagnostic
1577	TCP: connection = %1 updated reownd.	Diagnostic
1578	IP: Injecting NBL %1 on send path.	Diagnostic
1579	IP: Injecting NBL %1 on raw send path.	Diagnostic
1580	IP: Injecting NBL %1 on receive path.	Diagnostic
1581	IP: Injecting NBL %1 on forward path.	Diagnostic
1582	IP: Indication filtered because destination interface %1 is not contained in IF …	Diagnostic
1583	BBR2: TCB %1 bbr_bw %2 min_rtt_us %3 mode %4 cycle_idx %5 CWnd %6 PacingRate %7 …	Diagnostic
1584	TCP: connection = %1 send tracker marked a transmit as rexmit.	Diagnostic
1585	TCP: connection = %1 send tracker update RACK info.	Diagnostic
1586	IP: Prefix sharing now %4 on Interface = %3, Compartment = %2, Family = %1.	Diagnostic
1587	TCP: connection %1 received a careful ACK.	Diagnostic
1588	IP: Forwarding tag on Interface = %3, Compartment = %2, Family = %1 changed from …	Diagnostic
1589	TCP: AF %1, RssEnabled = %2 .	Diagnostic
1590	TCP: connection = %1 send completion failed.	Diagnostic
1591	TCPIP: Alloc hooks setup: Status = %1.	Diagnostic
1592	IP: Neighbor with IpAddress = %3 DlAddress = %5 on Interface = %1 was reset …	Diagnostic
1593	TCP: Global timer fired, Processor = %1, Tick = %2.	Diagnostic
1594	TCP: Global timer armed, NextToExpire = %1, Period = %2.	Diagnostic
1595	TCP: Global timer cancelled	Diagnostic
1596	TCP: Updating Fastopen Key	Diagnostic
1597	TCP: paused receive buffer growth for high memory usage, AF = %1, TCB = %2, …	Diagnostic
1598	IP: Autoconfigured address creation failed due to autoconfiguration limit, …	Diagnostic
1599	IP: Autoconfigured route creation failed due to autoconfiguration limit, …	Diagnostic
1600	IP: Policy based routing failed - Compartment: %1 DstAddr: %3 SrcAddr: %5 …	Diagnostic
1601	TCP: connection %1 in %2 received NBL %4 in FastPath = %3 Seq = %5 Ack = %6 …	Diagnostic
1602	TCP: connection %1 process fast RX batch SegmentCount = %2 NumBytes = %3 NblHead …	Diagnostic
1603	TCP: connection %1 in %2 %3 disconnect DataLength=%4.	Diagnostic
1604	NDKPI Disconnect Event CallbackEx: DisconnectEventContext %1 …	Diagnostic
1605	NDKPI AcceptEx: RequestContext %6 Connector %1 QP %2 IRD %3 ORD %4 …	Diagnostic
1606	NDKPI CompleteConnectEx: RequestContext %3 Connector %1 DisconnectEventContext …	Diagnostic
1607	NDKPI Open Adapter Version Override: IF_INDEX %7 ProviderSupportedNDKVersion …	Diagnostic
1608	Fl Reload Registry Config: Override Status: %5 OldFlConfiguredVersion {%1.	Diagnostic
1609	NDKPI Open Adapter: Unexpected version returned by provider, IF_INDEX %5 …	Diagnostic
1610	TCPIP: Disconnected Standby traffic.	Diagnostic
1611	TCPIP: Disconnected Standby (DS) transition detected.	Diagnostic
1612	ResetResolve API call: ProcessName %1.	Diagnostic
1613	USO global disabled mask = %1.	Operational
1614	Framing: SW URO %1, HW URO %2.	Diagnostic
1615	Tcpip Power Policy set to.	Diagnostic
1616	Router Solicitation sent.	Diagnostic
1617	Router Solicitation requested on dormant interface.	Diagnostic
1618	IP: Route lifetime refresh.	Diagnostic
1619	IP: Constraint computation (unused) - Source address %2 is preferred over %3 for …	Diagnostic
1620	WFP-ALE: RemoteEndPoint Cleanup: (local=%2 remote=%3) currentTick=%4 lastTick=%5 …	Diagnostic
1621	FL: Virtual interface creation.	Diagnostic
1622	FL: Virtual interface deletion.	Diagnostic
1623	Tcpip Power Policy Standby-to-Full-Power transition detected.	Diagnostic
1624	TCP: connection %1: flow label refreshed, old = %2 new = %3.	Diagnostic
1625	TCP: Connection %1 send idle triggered.	Diagnostic
1626	TCP: connection %1: bytes limited by sender = %2 receiver = %3 congestion = %4.	Diagnostic
1627	UDP: %2 scheduled HW URO to be %3 on interface %1.	Diagnostic
1628	UDP: %2 %3 HW URO on interface %1.	Diagnostic
1629	FL: FLSNPI client attach.	Diagnostic
1630	FL: FLSNPI client detach.	Diagnostic
1631	FL: FLSNPI client interface attach.	Diagnostic
1632	FL: FLSNPI client interface detach.	Diagnostic
1633	FL: FLSNPI datapath failure.	Diagnostic
1634	FL: FLSNPI client silent drop.	Diagnostic
1635	FL: FLSNPI indication stats.	Diagnostic
1636	TCPIP: Current Power Policy.	Diagnostic
1637	TCP: connection %1 send acked %2 bytes starting from %3 ActivityID = %4.	Diagnostic
1638		Operational
1638	IP.	Diagnostic
1639		Operational
1639	IP: Destination cache invalidated.	Diagnostic
1640		Operational
1640	FL: Virtual interface set failed.	Diagnostic
1641		Operational
1641	FL: Virtual interface get failed.	Diagnostic
1642		Operational
1642	IP: Received Prefix Option in Router Advertisement.	Diagnostic

Event ID 1001 — TCP: endpoint %2 (Family=%3, PID=%4) created with status = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint %2 (Family=%3, PID=%4) created with status = %1.

Fields

Name	Description
`Status`	—
`Endpoint`	—
`AddressFamily`	—
`Pid`	—

Event ID 1002 — TCP: Tcb %1 (local=%3 remote=%5) requested to connect.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Tcb %1 (local=%3 remote=%5) requested to connect.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1003 — TCP: Inspect Connect has been completed on Tcb %1 with status = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Inspect Connect has been completed on Tcb %1 with status = %2.

Fields

Name	Description
`Tcb`	—
`Status`	—
`AddressFamily`	—

Event ID 1004 — TCP: Tcb %1 is going to output SYN with ISN = %2, RcvWnd = %3, RcvWndScale = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Tcb %1 is going to output SYN with ISN = %2, RcvWnd = %3, RcvWndScale = %4.

Fields

Name	Description
`Tcb`	—
`ISN`	—
`RcvWnd`	—
`RcvWndScale`	—

Event ID 1005 — TCP: endpoint bind failed: address %2 cannot be resolved (%3).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint bind failed: address %2 cannot be resolved (%3).

Fields

Name	Description
`Endpoint`	—
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—

Event ID 1006 — TCP: endpoint (sockaddr=%2) bind failed: port-acquisition status = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (sockaddr=%2) bind failed: port-acquisition status = %3.

Fields

Name	Description
`Endpoint`	—
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—

Event ID 1007 — TCP: endpoint (sockaddr=%2) bind failed: inspection status = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (sockaddr=%2) bind failed: inspection status = %3.

Fields

Name	Description
`Endpoint`	—
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—

Event ID 1008 — TCP: endpoint (sockaddr=%2) bound.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (sockaddr=%2) bound.

Fields

Name	Description
`Endpoint`	—
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—

Event ID 1009 — TCP: endpoint (sockaddr=%2) closed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (sockaddr=%2) closed.

Fields

Name	Description
`Endpoint`	—
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—

Event ID 1010 — TCP: endpoint (Family=%6 PID=%4) create failed: address family not attached.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (Family=%6 PID=%4) create failed: address family not attached.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1011 — TCP: endpoint (Family=%6 PID=%4) create failed: compartment %5 not found.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (Family=%6 PID=%4) create failed: compartment %5 not found.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1012 — TCP: endpoint (Family=%6 PID=%4) create failed: inspection status %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (Family=%6 PID=%4) create failed: inspection status %3.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1013 — TCP: endpoint (Family=%6 PID=%4) created.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (Family=%6 PID=%4) created.

Fields

Name	Description
`Endpoint`	—
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1014 — TCP: listener (local=%2 remote=%4) accept failed: Route lookup status = %5, TCB = %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener (local=%2 remote=%4) accept failed: Route lookup status = %5, TCB = %8.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1015 — TCP: listener (local=%3 remote=%5) accept failed: connection insertion.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener (local=%3 remote=%5) accept failed: connection insertion. Duplicate TCB = %1.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1016 — TCP: listener (local=%2 remote=%4) accept failed: client rejection status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener (local=%2 remote=%4) accept failed: client rejection status = %5.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1017 — TCP: listener (local=%2 remote=%4) accept completed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener (local=%2 remote=%4) accept completed. TCB = %8. PID = %6.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1018 — TCP: connection %8 (local=%2 remote=%4 PID=%6) connect failed: address family not attached.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4 PID=%6) connect failed: address family not attached.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1019 — TCP: connection %8 (local=%2 remote=%4 PID=%6) connect failed: compartment %7 not found.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4 PID=%6) connect failed: compartment %7 not found.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1020 — TCP: connection %8 (local=%2 remote=%4 PID=%6) connect failed: inspection status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4 PID=%6) connect failed: inspection status = %5.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1021 — TCP: connection %8 (local=%2 remote=%4) connect failed: route lookup status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) connect failed: route lookup status = %5.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1022 — TCP: Bypass rate limiting since flag is set on path %5 (local=%2 remote=%4).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Bypass rate limiting since flag is set on path %5 (local=%2 remote=%4)

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Path`	—

Event ID 1023 — TCP: Charge rate limiting quota and set rate limiting flag for path %5 (local=%2 remote=%4).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Charge rate limiting quota and set rate limiting flag for path %5 (local=%2 remote=%4)

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Path`	—

Event ID 1024 — TCP: connection %8 (local=%2 remote=%4) deferred.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) deferred.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1025 — TCP: %6 rate-limiting paths %3 backlogged connections.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: %6 rate-limiting paths %3 backlogged connections.

Fields

Name	Description
`SynAttacksDetected`	—
`ReassemblyLimitViolations`	—
`ConnectionRateLimitBacklog`	—
`ConnectionRateLimitViolations`	—
`LandAttackSegmentsDropped`	—
`ConnectionRateLimitDepth`	—

Event ID 1026 — TCP: Release and set rate limiting flag on path %5 (local=%2 remote=%4).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Release and set rate limiting flag on path %5 (local=%2 remote=%4)

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Path`	—

Event ID 1027 — TCP: connection %8 (local=%2 remote=%4) released.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) released.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1028 — TCP: Clear rate limiting flag on path %5 (local=%2 remote=%4) since connection is cancelled.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Clear rate limiting flag on path %5 (local=%2 remote=%4) since connection is cancelled.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Path`	—

Event ID 1029 — TCP: connection %8 (local=%2 remote=%4) connect failed: connection cancelled.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) connect failed: connection cancelled.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1030 — TCP: connection (local=%2 remote=%4) connect failed: connection insertion status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection (local=%2 remote=%4) connect failed: connection insertion status = %5.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1031 — TCP: connection %8 (local=%2 remote=%4) connect proceeding.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) connect proceeding.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1032 — TCP: connection %8 (local=%2 remote=%4) released due to cancel.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) released due to cancel.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1033 — TCP: connection %8 (local=%2 remote=%4) connect completed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) connect completed. PID = %6.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1034 — TCP: connection %8 (local=%2 remote=%4) connect attempt failed with status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) connect attempt failed with status = %5.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1035 — TCP: connection %8 (local=%2 remote=%4) connect failed: connect-complete inspect status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) connect failed: connect-complete inspect status = %5.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1036 — TCP: ApplySynOptions, failed to create session state with status = %5, TCB = %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: ApplySynOptions, failed to create session state with status = %5, TCB = %8.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1037 — TCP: ApplySynOptions, failed to update DF with status = %5, TCB = %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: ApplySynOptions, failed to update DF with status = %5, TCB = %8.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1038 — TCP: connection %8 (local=%2 remote=%4) close issued.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) close issued.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1039 — TCP: connection %8 (local=%2 remote=%4) abort issued.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) abort issued.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1040 — TCP: connection %8 (local=%2 remote=%4) abort completed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) abort completed.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1041 — TCP: Injecting disconnect on a shutdown TCB failed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Injecting disconnect on a shutdown TCB failed. TCB = %1.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1042 — TCP: connection disconnect %3, length=%1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection disconnect %3, length=%1.

Fields

Name	Description
`Length`	—
`Timeout`	—
`Injected`	—

Event ID 1043 — TCP: connection %8 (local=%2 remote=%4) disconnect completed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) disconnect completed.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—
`Inspect`	—

Event ID 1044 — TCP: connection %8 (local=%2 remote=%4) shutdown initiated (%5).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) shutdown initiated (%5). PID = %6.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1045 — TCP: connection %8 (local=%2 remote=%4) connect failed: connect-request timeout expired.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) connect failed: connect-request timeout expired.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1046 — TCP: connection %8 (local=%2 remote=%4) terminating: retransmission timeout expired.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) terminating: retransmission timeout expired.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1047 — TCP: connection %8 (local=%2 remote=%4) terminating: keep-alive timeout expired.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) terminating: keep-alive timeout expired.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1048 — TCP: connection %8 (local=%2 remote=%4) terminating: disconnect timeout expired.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) terminating: disconnect timeout expired.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1049 — TCP: connection %8 (local=%2 remote=%4) connect failed: extended statistics status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) connect failed: extended statistics status = %5.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1050 — TCP: connection %8 (local=%2 remote=%4) connect failed: port-acquisition status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) connect failed: port-acquisition status = %5.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1051 — TCP: connection %4 transition from %1 to %2, SndNxt = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %4 transition from %1 to %2, SndNxt = %3.

Fields

Name	Description
`OldState`	—
`NewState`	—
`SndNxt`	—
`Tcb`	—

Event ID 1052 — TCP: Process with PID = %1 reserved %4 ports starting at %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Process with PID = %1 reserved %4 ports starting at %3.

Fields

Name	Description
`ProcessId`	—
`Status`	—
`StartPort`	—
`NumberOfPorts`	—
`ProcessStartKey`	—

Event ID 1053 — TCP: Process with PID = %1 failed to reserve %4 ports starting at %3 with status = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Process with PID = %1 failed to reserve %4 ports starting at %3 with status = %2.

Fields

Name	Description
`ProcessId`	—
`Status`	—
`StartPort`	—
`NumberOfPorts`	—
`ProcessStartKey`	—

Event ID 1054 — TCP: Process with PID = %1 completed global port reservation of %4 ports starting at %3 with status = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Process with PID = %1 completed global port reservation of %4 ports starting at %3 with status = %2.

Fields

Name	Description
`ProcessId`	—
`Status`	—
`StartPort`	—
`NumberOfPorts`	—
`ProcessStartKey`	—

Event ID 1055 — TCP: entering SYN attack resistance mode, Syn Attacks Detected = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: entering SYN attack resistance mode, Syn Attacks Detected = %1.

Fields

Name	Description
`SynAttacksDetected`	—
`ReassemblyLimitViolations`	—
`ConnectionRateLimitBacklog`	—
`ConnectionRateLimitViolations`	—
`LandAttackSegmentsDropped`	—
`ConnectionRateLimitDepth`	—

Event ID 1056 — TCP: reasembly rate-limiting violated %2 times since boot.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: reasembly rate-limiting violated %2 times since boot.

Fields

Name	Description
`SynAttacksDetected`	—
`ReassemblyLimitViolations`	—
`ConnectionRateLimitBacklog`	—
`ConnectionRateLimitViolations`	—
`LandAttackSegmentsDropped`	—
`ConnectionRateLimitDepth`	—

Event ID 1057 — TCP: connection rate-limiting violated %4 times since boot.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection rate-limiting violated %4 times since boot.

Fields

Name	Description
`SynAttacksDetected`	—
`ReassemblyLimitViolations`	—
`ConnectionRateLimitBacklog`	—
`ConnectionRateLimitViolations`	—
`LandAttackSegmentsDropped`	—
`ConnectionRateLimitDepth`	—

Event ID 1058 — TCP: land attack has dropped %5 packets since boot.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: land attack has dropped %5 packets since boot.

Fields

Name	Description
`SynAttacksDetected`	—
`ReassemblyLimitViolations`	—
`ConnectionRateLimitBacklog`	—
`ConnectionRateLimitViolations`	—
`LandAttackSegmentsDropped`	—
`ConnectionRateLimitDepth`	—

Event ID 1059 — TCP: low memory state detected.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: low memory state detected. LowMemoryEvent =%3 LowPagedPoolEvent = %4.

Fields

Name	Description
`HighMemoryEvent`	—
`HighPagedPoolEvent`	—
`LowMemoryEvent`	—
`LowPagedPoolEvent`	—

Event ID 1060 — TCP: leaving low memory state.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: leaving low memory state. HighMemoryEvent = %1 HighPagedPoolEvent = %2.

Fields

Name	Description
`HighMemoryEvent`	—
`HighPagedPoolEvent`	—
`LowMemoryEvent`	—
`LowPagedPoolEvent`	—

Event ID 1061 — TCP: address family %2 added to interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: address family %2 added to interface %1.

Fields

Name	Description
`InterfaceIndex`	—
`AddressFamily`	—

Event ID 1062 — TCP: address family %2 removed from interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: address family %2 removed from interface %1.

Fields

Name	Description
`InterfaceIndex`	—
`AddressFamily`	—

Event ID 1063 — TCP: leaving SYN attack resistance mode, Syn Attacks Detected = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: leaving SYN attack resistance mode, Syn Attacks Detected = %1.

Fields

Name	Description
`SynAttacksDetected`	—
`ReassemblyLimitViolations`	—
`ConnectionRateLimitBacklog`	—
`ConnectionRateLimitViolations`	—
`LandAttackSegmentsDropped`	—
`ConnectionRateLimitDepth`	—

Event ID 1064 — TCP: Connection %1 %2 timer started.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 %2 timer started. Scheduled to expire in %3 ms.

Fields

Name	Description
`Tcb`	—
`TimerType`	—
`WaitTimeMilliseconds`	—
`Processor`	—
`LastInterruptTime`	—
`LastMicroseconds`	—

Event ID 1065 — TCP: Connection %1 stopping %2 timer.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 stopping %2 timer.

Fields

Name	Description
`Tcb`	—
`TimerType`	—
`WaitTimeMilliseconds`	—

Event ID 1066 — TCP: Connection %1 %2 timer has expired.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 %2 timer has expired.

Fields

Name	Description
`Tcb`	—
`TimerType`	—
`WaitTimeMilliseconds`	—

Event ID 1067 — TCP: ISB changed to %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: ISB changed to %1. CWnd = %2 SndWnd = %3 SendAvailable = %4 SSThresh = %5.

Fields

Name	Description
`IsbSize`	—
`Cwnd`	—
`SndWnd`	—
`SendAvailable`	—
`SSThresh`	—

Event ID 1068 — TCP: moving RSS indirection table index %6 from processor %1 to processor %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: moving RSS indirection table index %6 from processor %1 to processor %3.

Fields

Name	Description
`SourceProcessor`	—
`SourceActivity`	—
`DestinationProcessor`	—
`DestinationActivity`	—
`PartitionMovesRemaining`	—
`TableEntry`	—

Event ID 1069 — TCP: connection %1: Timeout Event updated cwnd = %2 and updated ssthresh = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Timeout Event updated cwnd = %2 and updated ssthresh = %3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1070 — TCP: connection %1: Rtt sample recorded %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1:  Rtt sample recorded %4.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1071 — TCP: connection %1: Cumulative ACK updated cwnd = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Cumulative ACK updated cwnd = %2.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1072 — TCP: connection %1: Duplicate ACK updated cwnd = %2 and updated ssthresh = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Duplicate ACK updated cwnd = %2 and updated ssthresh = %3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1073 — TCP: connection %1: Sent data with number of bytes = %5 and Sequence number = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Sent data with number of bytes = %5 and Sequence number = %6.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1074 — TCP: connection %1: Received data with number of bytes = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Received data with number of bytes = %2. ThSeq = %3.

Fields

Name	Description
`Tcb`	—
`NumBytes`	—
`SeqNo`	—
`NumPkt`	—

Event ID 1075 — TCP: connection %1: ECN Echo updated cwnd = %2 and updated ssthresh = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: ECN Echo updated cwnd = %2 and updated ssthresh = %3. SndUna = %4, Mss = %5, ThAck = %6.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`SndUna`	—
`Mss`	—
`ThAck`	—
`DWnd`	—
`BaseRtt`	—

Event ID 1076 — TCP: connection %1: Spurious timeout with SndUna = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Spurious timeout with SndUna = %7.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1077 — TCP: connection %1: Send Retransmit round with SndUna = %6, Round = %8, SRTT = %9, RTO = %10.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Send Retransmit round with SndUna = %6, Round = %8, SRTT = %9, RTO = %10.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1078 — TCP: connection %1: Entered loss recovery phase with SndUna = %2 and SndMax = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Entered loss recovery phase with SndUna = %2 and SndMax = %3.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—

Event ID 1079 — TCP: connection %1: Leaving loss recovery phase with SndUna = %2 and SndMax = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Leaving loss recovery phase with SndUna = %2 and SndMax = %3.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—

Event ID 1080 — TCP: connection %1 entering SACK mode with SndUna = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 entering SACK mode with SndUna = %2.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`Reason`	—
`IsSack`	—

Event ID 1081 — TCP: connection %1 leaving SACK mode with SndUna = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 leaving SACK mode with SndUna = %2.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`Reason`	—
`IsSack`	—

Event ID 1082 — TCP: connection %1 entering Congestion Avoidance Phase with cwnd = %2 and ssthresh = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 entering Congestion Avoidance Phase with cwnd = %2 and ssthresh = %3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1084 — TCP: connection %1 entered BH, BH MSS %2, original MSS %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 entered BH, BH MSS %2, original MSS %3.

Fields

Name	Description
`Tcb`	—
`BHMSS`	—
`OriginalMSS`	—
`TraceString`	—

Event ID 1085 — TCP: connection %1 Exiting BH due to %4, BH mss %2, Original MSS %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 Exiting BH due to %4, BH mss %2, Original MSS %3.

Fields

Name	Description
`Tcb`	—
`BHMSS`	—
`OriginalMSS`	—
`TraceString`	—

Event ID 1086 — TCP: connection %1 not entering BH due to %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 not entering BH due to %4.

Fields

Name	Description
`Tcb`	—
`BHMSS`	—
`OriginalMSS`	—
`TraceString`	—

Event ID 1087 — TCP: connection %1 spurious RTO detection initiated at %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 spurious RTO detection initiated at %7.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1088 — TCP: connection %1 spurious RTO detection terminated at %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 spurious RTO detection terminated at %7.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1089 — TCP: active connect failed (family=%2) connect-complete inspection failed: status = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: active connect failed (family=%2) connect-complete inspection failed: status = %3.

Fields

Name	Description
`Tcb`	—
`Status`	—
`AddressFamily`	—

Event ID 1090 — TCP: TcpReleaseIndicationList: Nbl = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: TcpReleaseIndicationList: Nbl = %1.

Fields

Name	Description
`NBL`	—

Event ID 1091 — TCP: connection %1 posted an average of %5 bytes per send.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 posted an average of %5 bytes per send.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1092 — TCP: connection (local=%2 remote=%4) starting receive window auto-tuning.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection (local=%2 remote=%4) starting receive window auto-tuning.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`BufferSize`	—

Event ID 1093 — TCP: connection (local=%2 remote=%4) ending receive window auto-tuning.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection (local=%2 remote=%4) ending receive window auto-tuning.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`BufferSize`	—

Event ID 1094 — TCP: connection (local=%2 remote=%4) failed to enter auto-tuning because fine-grained RTT estimation could not be started.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection (local=%2 remote=%4) failed to enter auto-tuning because fine-grained RTT estimation could not be started.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`BufferSize`	—

Event ID 1095 — TCP: connection (local=%2 remote=%4) failed to enter auto-tuning because receiver bandwidth estimation could not be started.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection (local=%2 remote=%4) failed to enter auto-tuning because receiver bandwidth estimation could not be started.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`BufferSize`	—

Event ID 1096 — TCP: connection (local=%2 remote=%4) failed to enter auto-tuning because of receive window tuning allocation failure.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection (local=%2 remote=%4) failed to enter auto-tuning because of receive window tuning allocation failure.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`BufferSize`	—

Event ID 1097 — TCP: connection (local=%2 remote=%4) auto-tuner adjusted receive buffer size to %5 bytes.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection (local=%2 remote=%4) auto-tuner adjusted receive buffer size to %5 bytes.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`BufferSize`	—

Event ID 1098 — TCP: connection %1: Rtt resiliency detection complete with Rtt sample = %4 and new SRTT = %9.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Rtt resiliency detection complete with Rtt sample = %4 and new SRTT = %9.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1099 — TCP: connection %5: Connection State = %1, Offload State = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %5: Connection State = %1, Offload State = %2. SndNxt = %3, RcvNxt = %4. NdisStatus = %6.

Fields

Name	Description
`TcbState`	—
`OcbState`	—
`SndNxt`	—
`RcvNxt`	—
`Tcb`	—
`Status`	—

Event ID 1100 — TCP: SWS avoidance began on connection %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: SWS avoidance began on connection %1. Timer set for %2 ms. BytesToSend = %3, SendAvailable = %4, Cwnd = %5, MaxSndWnd = %6.

Fields

Name	Description
`Tcb`	—
`TimerValue`	—
`BytesToSend`	—
`SendAvailable`	—
`Cwnd`	—
`MaxSndWnd`	—

Event ID 1101 — TCP: SWS avoidance ended on connection %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: SWS avoidance ended on connection %1.

Fields

Name	Description
`Tcb`	—
`TimerValue`	—
`BytesToSend`	—
`SendAvailable`	—
`Cwnd`	—
`MaxSndWnd`	—

Event ID 1102 — TCP: connection %1 send: Beginning zero-window probing with SndUna = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 send: Beginning zero-window probing with SndUna = %2.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—

Event ID 1103 — TCP: connection %1 send: Leaving zero-window probing with SndUna = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 send: Leaving zero-window probing with SndUna = %2.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—

Event ID 1104 — TCP: Option %2 is going to be set for connection %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Option %2 is going to be set for connection %1.

Fields

Name	Description
`Tcb`	—
`OptionType`	—
`SoOptionType`	—

Event ID 1105 — TCP: Socket Option %3 is going to be set for connection %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Socket Option %3 is going to be set for connection %1.

Fields

Name	Description
`Tcb`	—
`OptionType`	—
`SoOptionType`	—

Event ID 1106 — IP: Interface media disconnect.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Disconnecting interface %1, trace = %2.

Fields

Name	Description
`InterfaceIndex`	—
`TraceString`	—
`CompartmentId`	—

Event ID 1107 — TCPIP: Module %1 started.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Module %1 started.

Fields

Name	Description
`ModuleNameString`	—

Event ID 1108 — TCPIP: Module %1 stopped.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Module %1 stopped.

Fields

Name	Description
`ModuleNameString`	—

Event ID 1109 — TCPIP: Failure allocating %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Failure allocating %1.

Fields

Name	Description
`AllocationObjectString`	—

Event ID 1110 — TCP: Global parameters updated for Address Family %1: EnablePMtuDiscovery = %2, UseRfc1122UrgentPointer = %3, DisableTaskOffload = %4, DisableTcpCh...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Global parameters updated for Address Family %1: EnablePMtuDiscovery = %2, UseRfc1122UrgentPointer = %3, DisableTaskOffload = %4, DisableTcpChimneyOffload = %5, DisableRss = %6, EnablePMtuBHDetect = %7, EcnCapability = %8, MaxDataRetransmissions = %9, KeepAliveTime = %10, KeepAliveInterval = %11, TimedWaitDelay = %12, SillyWindowTimeout = %13, FinWait2Timeout = %14, CongestionAlgorithm = %15, UseRfc1323Timestamps = %16, AutoTuningLevelLocal = %17, AutoTuningLevelGroupPolicy = %18.

Fields

Name	Description
`AddressFamily`	—
`EnablePMTUDiscovery`	—
`TcpUseRFC1122UrgentPointer`	—
`DisableTaskOffload`	—
`EnablePMTUBHDetect`	—
`DisableTcpChimneyOffload`	—
`DisableRss`	—
`EcnCapability`	—
`TcpMaxDataRetransmissions`	—
`KeepAliveTime`	—
`KeepAliveInterval`	—
`TcpTimedWaitDelay`	—
`SillyWindowTimeout`	—
`TcpFinWait2Delay`	—
`CongestionAlgorithm`	—
`Tcp1323Opts`	—
`AutoTuningLevelLocal`	—
`AutoTuningLevelGroupPolicy`	—

Event ID 1111 — TCP: Connection %1 Large Send Offload, Bytes in segment = %2 and Bytes remaining = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 Large Send Offload, Bytes in segment = %2 and Bytes remaining = %3.

Fields

Name	Description
`Tcb`	—
`BytesInSegment`	—
`BytesRemaining`	—

Event ID 1112 — TCP: Connection %1 status changed to %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 status changed to %2.

Fields

Name	Description
`Tcb`	—
`Status`	—
`Interface`	—
`PMax`	—

Event ID 1113 — TCP: Connection %1 status = %2, Interface = %3, PMax = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 status = %2, Interface = %3, PMax = %4.

Fields

Name	Description
`Tcb`	—
`Status`	—
`Interface`	—
`PMax`	—

Event ID 1114 — IP: Address DAD successful.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: DAD successful for IP address = %7 %9 %8 on interface = %1, protocol = %2.

Fields

Name	Description
`Interface`	—
`Protocol`	—
`DadState`	—
`DlAddrLength`	—
`DLAddress`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—
`CompartmentId`	—

Event ID 1115 — IP: Address DAD failed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: DAD failed for IP address = %7 %9 %8 on interface = %1, protocol = %2, DL address of packet = %5.

Fields

Name	Description
`Interface`	—
`Protocol`	—
`DadState`	—
`DlAddrLength`	—
`DLAddress`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—
`CompartmentId`	—

Event ID 1116 — IP: Address DAD started.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: DAD started for IP address = %7 %9 %8 on interface = %1, protocol = %2.

Fields

Name	Description
`Interface`	—
`Protocol`	—
`DadState`	—
`DlAddrLength`	—
`DLAddress`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—
`CompartmentId`	—

Event ID 1117 — TCP: listener (sockaddr=%3 PID=%5) activation failed: address family not attached.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener (sockaddr=%3 PID=%5) activation failed: address family not attached.

Fields

Name	Description
`Listener`	—
`AddressLength`	—
`SocketAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1118 — TCP: listener %1 (family=%7 PID=%5) activation failed: compartment %6 not found.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener %1 (family=%7 PID=%5) activation failed: compartment %6 not found. Status=%4.

Fields

Name	Description
`Listener`	—
`AddressLength`	—
`SocketAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1119 — TCP: listener %1 (family=%7 PID=%5) activation failed: inspection status=%4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener %1 (family=%7 PID=%5) activation failed: inspection status=%4.

Fields

Name	Description
`Listener`	—
`AddressLength`	—
`SocketAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1120 — TCP: listener %1 (sockaddr=%3) activation failed: inspection status=%4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener %1 (sockaddr=%3) activation failed: inspection status=%4.

Fields

Name	Description
`Listener`	—
`AddressLength`	—
`SocketAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1121 — TCP: listener %1 (sockaddr=%3) bind failed: port-acquisition status=%4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener %1 (sockaddr=%3) bind failed: port-acquisition status=%4.

Fields

Name	Description
`Listener`	—
`AddressLength`	—
`SocketAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1122 — TCP: listener %1 (family=%7 PID=%5) bind failed: address %3 cannot be resolved (Status=%4).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener %1 (family=%7 PID=%5) bind failed: address %3 cannot be resolved (Status=%4).

Fields

Name	Description
`Listener`	—
`AddressLength`	—
`SocketAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1123 — TCP: listener %1 (sockaddr=%3) activated.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener %1 (sockaddr=%3) activated.

Fields

Name	Description
`Listener`	—
`AddressLength`	—
`SocketAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1124 — TCP: listener %1 (sockaddr=%3) unbound.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: listener %1 (sockaddr=%3) unbound.

Fields

Name	Description
`Listener`	—
`AddressLength`	—
`SocketAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1127 — IP: Address addition.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: IP address = %7 %9 %8 added on interface = %1, Protocol = %2.

Fields

Name	Description
`Interface`	—
`Protocol`	—
`DadState`	—
`DlAddrLength`	—
`DLAddress`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—
`CompartmentId`	—
`PrefixOrigin`	—
`SuffixOrigin`	—

Event ID 1128 — IP: Address deletion.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: IP address = %7 %9 %8 deleted on interface = %1, Protocol = %2.

Fields

Name	Description
`Interface`	—
`Protocol`	—
`DadState`	—
`DlAddrLength`	—
`DLAddress`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—
`CompartmentId`	—

Event ID 1130 — Framing: Interface operation status change.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: Interface %1 Operational Status = %2, Operational Status Flags = %3.

Fields

Name	Description
`Interface`	—
`OperationalStatus`	—
`Status`	—
`CompartmentId`	—

Event ID 1136 — Framing: NDIS pause event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: NDIS pause event on interface %1.

Fields

Name	Description
`InterfaceIndex`	—
`TraceString`	—
`CompartmentId`	—

Event ID 1137 — Framing: NDIS restart event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: NDIS restart event on interface %1.

Fields

Name	Description
`InterfaceIndex`	—
`TraceString`	—
`CompartmentId`	—

Event ID 1138 — IP: IP address = %7 %9 %8 state changed to Preferred.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: IP address = %7 %9 %8 state changed to Preferred. Interface = %1.

Fields

Name	Description
`Interface`	—
`Protocol`	—
`DadState`	—
`DlAddrLength`	—
`DLAddress`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—

Event ID 1139 — IP: IP address = %7 %9 %8 state changed to Non-preferred.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: IP address = %7 %9 %8 state changed to Non-preferred. Interface = %1. DadState = %3.

Fields

Name	Description
`Interface`	—
`Protocol`	—
`DadState`	—
`DlAddrLength`	—
`DLAddress`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—

Event ID 1144 — IP: Interface property change.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface %1 property change. Advertise= %2, AdvertiseDefaultRoute = %3, Forward = %4, ForwardMulticast = %5, UseNud = %6, AdvertisingEnabled = %7.

Fields

Name	Description
`Interface`	—
`Advertise`	—
`AdvertiseDefaultRoute`	—
`Forward`	—
`ForwardMulticast`	—
`UseNud`	—
`AdvertisingEnabled`	—
`WeakHostSend`	—
`WeakHostReceive`	—
`CompartmentId`	—
`AddressFamily`	—
`StrictSourceForwarding`	—

Event ID 1145 — IP: Route %1 created on interface %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Route %1 created on interface %2. Protocol = %5, DestinationPrefix = %16 %18 %7 /%6, Nexthop = %17 %18 %8, ValidLifetime = %9, PreferredLifetime = %10.

Fields

Name	Description
`Route`	—
`Interface`	—
`CompartmentId`	—
`DestinationPrefixAddressLength`	—
`DestinationPrefix`	—
`NextHopAddressLength`	—
`NextHopAddress`	—
`DestinationPrefixLength`	—
`ValidLifetime`	—
`PreferredLifetime`	—
`Metric`	—
`Loopback`	—
`AutoconfigureAddress`	—
`Publish`	—
`Immortal`	—
`IPUnicastroutedeletionreason`	—

Event ID 1146 — IP: Route %1 deleted on interface %2, Protocol = %5, DestinationPrefix = %16 %18 %7 /%6, Nexthop = %17 %18 %8, ValidLifetime = %9, PreferredLifetim...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Route %1 deleted on interface %2, Protocol = %5, DestinationPrefix = %16 %18 %7 /%6, Nexthop = %17 %18 %8, ValidLifetime = %9, PreferredLifetime = %10, Reason = %19.

Fields

Name	Description
`Route`	—
`Interface`	—
`CompartmentId`	—
`DestinationPrefixAddressLength`	—
`DestinationPrefix`	—
`NextHopAddressLength`	—
`NextHopAddress`	—
`DestinationPrefixLength`	—
`ValidLifetime`	—
`PreferredLifetime`	—
`Metric`	—
`Loopback`	—
`AutoconfigureAddress`	—
`Publish`	—
`Immortal`	—
`IPUnicastroutedeletionreason`	—

Event ID 1147 — IP: Route %1 property change.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Route %1 property change. Interface = %2, Protocol = %5, DestinationPrefix = %16 %18 %7 /%6, Nexthop = %17 %18 %8. Properties: ValidLifetime = %9, PreferredLifetime = %10, Metric = %11, Loopback = %12, AutoconfigureAddress = %13, Publish = %14, Immortal = %15.

Fields

Name	Description
`Route`	—
`Interface`	—
`CompartmentId`	—
`DestinationPrefixAddressLength`	—
`DestinationPrefix`	—
`NextHopAddressLength`	—
`NextHopAddress`	—
`DestinationPrefixLength`	—
`ValidLifetime`	—
`PreferredLifetime`	—
`Metric`	—
`Loopback`	—
`AutoconfigureAddress`	—
`Publish`	—
`Immortal`	—
`IPUnicastroutedeletionreason`	—

Event ID 1148 — IP: Neighbor unreachable.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Neighbor unreachable. Interface %1, IP address = %5 %7 %6.

Fields

Name	Description
`Interface`	—
`DlAddrLength`	—
`DlAddress`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—

Event ID 1149 — IP: Neighbor reachable.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Neighbor reachable. Interface %1, IP address = %5 %7 %6, DlAddress = %3.

Fields

Name	Description
`Interface`	—
`DlAddrLength`	—
`DlAddress`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—

Event ID 1150 — TCP: CTCP DataTransferTimeout event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTCP DataTransferTimeout event. Connection %1, CWnd = %2, SsThresh = %3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1151 — TCP: CTCP Cumulative Ack event Connection %1, sequence = %6, CWnd = %2, DWnd = %11, BaseRtt = %12.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTCP Cumulative Ack event Connection %1, sequence = %6, CWnd = %2, DWnd = %11, BaseRtt = %12.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1152 — TCP: CTCP Duplicate Ack event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTCP Duplicate Ack event. Connection %1, sequence = %6, SndUna = %7, CWnd = %2, DWnd = %11, BaseRtt = %12, DupAckCount = %13.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1153 — TCP: CTCP Send event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTCP Send event. Connection %1, sequence = %6, length = %5.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1154 — TCP: CTCP ECN event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTCP ECN event. Connection %1, CWnd %2, SndUna = %4, Mss = %5, DWnd = %7, BaseRtt = %8.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`SndUna`	—
`Mss`	—
`ThAck`	—
`DWnd`	—
`BaseRtt`	—

Event ID 1155 — TCP: CTCP Spurious timeout event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTCP Spurious timeout event. Connection %1, CWnd = %2, SsThresh = %3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`RttSample`	—
`NumBytes`	—
`SeqNo`	—
`SndUna`	—
`Round`	—
`SRTT`	—
`RTO`	—
`DWnd`	—
`BaseRtt`	—
`DupAckCount`	—

Event ID 1156 — TCP: connection %1, delivery %2, Request %3 posted for %4 bytes, flags = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1, delivery %2, Request %3  posted for %4 bytes, flags = %5. RcvNxt = %10.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1157 — TCP: connection %1 delivery %2 indicated %4 bytes accepted %6 bytes, status = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 delivery %2 indicated %4 bytes accepted %6 bytes, status = %7. RcvNxt = %10.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1158 — TCP: connection %1 delivery %2 satisfied %4 bytes %6 requested.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 delivery %2 satisfied %4 bytes %6 requested. IsFullySatisfied = %9. RcvNxt = %10.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1159 — TCP: connection %1 send %2 %3 bytes at %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 send %2 %3 bytes at %4.

Fields

Name	Description
`Tcb`	—
`Injected`	—
`NumBytes`	—
`SndNxt`	—
`SendAvailable`	—
`ActivityID`	—
`SndLimBytesSnd`	—
`SndLimBytesRwin`	—
`SndLimBytesCwnd`	—
`CWnd`	—
`SRtt`	—
`LossRecoveryEpisodes`	—
`RtoEpisodes`	—
`PtoEpisodes`	—

Event ID 1160 — TCP: connection %1 send transmitted %3 bytes at %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 send transmitted %3 bytes at %4.

Fields

Name	Description
`Tcb`	—
`Injected`	—
`NumBytes`	—
`SndNxt`	—

Event ID 1161 — TCP: connection %1 send advance %3 bytes at %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 send advance %3 bytes at %4.

Fields

Name	Description
`Tcb`	—
`Injected`	—
`NumBytes`	—
`SndNxt`	—
`SendAvailable`	—

Event ID 1162 — TCP: CTcp: Connection %1 Delay window has not kicked in.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTcp: Connection %1 Delay window has not kicked in.

Fields

Name	Description
`Tcb`	—
`Status`	—
`AddressFamily`	—

Event ID 1163 — TCP: CTcp: Allocated blocks: %1; Assigned blocks: %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTcp: Allocated blocks: %1; Assigned blocks: %2.

Fields

Name	Description
`AssignedBlocks`	—
`AllocatedBlocks`	—

Event ID 1164 — TCP: CTcp: Connection %1, DWnd = %2 (Prev = %3), BaseRtt = %4, AverageRtt = %5, CWnd =%6, DiffWnd = %7, DWnd increment = %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTcp: Connection %1, DWnd = %2 (Prev = %3), BaseRtt = %4, AverageRtt = %5, CWnd =%6, DiffWnd = %7, DWnd increment = %8.

Fields

Name	Description
`Tcb`	—
`DWnd`	—
`PrevDWnd`	—
`BaseRtt`	—
`AvgRtt`	—
`Cwnd`	—
`DiffWnd`	—
`DwndIncrement`	—

Event ID 1165 — TCP: CTcp: Gamma Autotuning: Connection %1 Updated Gamma %2, Average backlog %3, Average backlog across LFPs %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTcp: Gamma Autotuning: Connection %1 Updated Gamma %2, Average backlog %3, Average backlog across LFPs %4.

Fields

Name	Description
`Tcb`	—
`Gamma`	—
`AverageBacklog`	—
`AverageBacklogAcrossLFP`	—

Event ID 1166 — TCP: connection %1 SRTT measurement started (seq = %2, tick = %3).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 SRTT measurement started (seq = %2, tick = %3).

Fields

Name	Description
`Tcb`	—
`SeqNum`	—
`Tick`	—
`RttSample`	—
`NewSrtt`	—

Event ID 1167 — TCP: connection %1 SRTT measurement complete (tick = %3, sample = %4 ms, new srtt = %5 ms).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 SRTT measurement complete (tick = %3, sample = %4 ms, new srtt = %5 ms).

Fields

Name	Description
`Tcb`	—
`SeqNum`	—
`Tick`	—
`RttSample`	—
`NewSrtt`	—

Event ID 1168 — TCP: connection %1: SRTT measurement cancelled.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: SRTT measurement cancelled.

Fields

Name	Description
`Tcb`	—
`SeqNum`	—
`Tick`	—
`RttSample`	—
`NewSrtt`	—

Event ID 1169 — UDP: endpoint %1 (LocalAddress = %5, RemoteAddress = %7) sending %2 messages and a total of %3 bytes.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (LocalAddress = %5, RemoteAddress = %7) sending %2 messages and a total of %3 bytes. PID = %8.

Fields

Name	Description
`Endpoint`	—
`NumMessages`	—
`NumBytes`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`RemoteSockAddrLength`	—
`RemoteSockAddr`	—
`Pid`	—
`ProcessStartKey`	—

Event ID 1170 — UDP: endpoint %1 (LocalAddress = %5, RemoteAddress = %7) delivering %3 bytes.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (LocalAddress = %5, RemoteAddress = %7) delivering %3 bytes. PID = %8.

Fields

Name	Description
`Endpoint`	—
`NumMessages`	—
`NumBytes`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`RemoteSockAddrLength`	—
`RemoteSockAddr`	—
`Pid`	—
`ProcessStartKey`	—

Event ID 1171 — TCP: connection %1 delivery %2 flushing %4 bytes %6 requested status = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 delivery %2 flushing %4 bytes %6 requested status = %7.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1172 — TCP: Injecting receive on a shutdown TCB failed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Injecting receive on a shutdown TCB failed. TCB = %1.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1173 — TCP: connection %1 delivery %2 injecting %4 bytes delta %6, IsUrgentDelivery = %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 delivery %2 injecting %4 bytes delta %6, IsUrgentDelivery = %8.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1174 — TCP: Injecting fin on a shutdown TCB failed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Injecting fin on a shutdown TCB failed. TCB = %1.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1175 — TCP: connection %1 delivery %2 accepting %4 bytes.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 delivery %2 accepting %4 bytes. RcvNxt = %10.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1176 — TCP: connection %1 delivery %2 delivering FIN.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 delivery %2 delivering FIN. RcvNxt = %10.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1178 — TCP: connection %1 delivery %2 pushing %4 bytes %6 requested.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 delivery %2 pushing %4 bytes %6 requested. Delayed push = %9.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1180 — TCP: Injecting fin on TCB completed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Injecting fin on TCB completed. TCB = %1, Processor = %4.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1181 — TCP: connection %1 delivery %2 urgent boundary completing %4 bytes %6 requested.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 delivery %2 urgent boundary completing %4 bytes %6 requested.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1182 — TCP: connection %1 (local=%3 remote=%5): initiating SYN/RST validation.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 (local=%3 remote=%5): initiating SYN/RST validation.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1183 — TCP: connection %1 (local=%3 remote=%5) connect failed: received RST.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 (local=%3 remote=%5) connect failed: received RST.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1184 — TCP: connection %1 (local=%3 remote=%5) connection terminated: received RST.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 (local=%3 remote=%5) connection terminated: received RST.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1185 — TCP: connection %1 (local=%3 remote=%5) connection terminated: received SYN in state %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 (local=%3 remote=%5) connection terminated: received SYN in state %6.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1186 — TCP: connection %1 (local=%3 remote=%5) retransmitting connect attempt, RexmitCount = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 (local=%3 remote=%5) retransmitting connect attempt, RexmitCount = %7.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1187 — TCP: connection %1 (local=%3 remote=%5) retransmitting data, RexmitCount = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 (local=%3 remote=%5) retransmitting data, RexmitCount = %7.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1188 — TCP: connection %1 send keep-alive at SndUna = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 send keep-alive at SndUna = %2.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—

Event ID 1189 — TCP: connection %1, delivery %2: delivery state changed from %3 to %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1, delivery %2: delivery state changed from %3 to %4.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`OldDeliveryState`	—
`NewDeliveryState`	—

Event ID 1190 — TCP: connection %1 delivery %2 dropping data.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 delivery %2 dropping data. TotalBytesEnqueued = %4. Length = %6. RcvNxt = %10.

Fields

Name	Description
`Tcb`	—
`Delivery`	—
`Request`	—
`NumBytes`	—
`RequestFlags`	—
`Length`	—
`RequestStatus`	—
`IsUrgentDelivery`	—
`FullySatisfiedORDelayedPush`	—
`RcvNxt`	—

Event ID 1191 — TCP: endpoint/connection %1 acquired port number %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint/connection %1 acquired port number %2.

Fields

Name	Description
`PortAcquirer`	—
`PortNumber`	—
`WeakReference`	—
`OriginalAcquirer`	—

Event ID 1192 — TCP: connection %1 attempted to acquire weak reference on port number %2 inherited from endpoint %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 attempted to acquire weak reference on port number %2 inherited from endpoint %4. Successful = %3.

Fields

Name	Description
`PortAcquirer`	—
`PortNumber`	—
`WeakReference`	—
`OriginalAcquirer`	—

Event ID 1193 — TCP: endpoint/connection %1 released port number %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint/connection %1 released port number %2. WeakReference = %3.

Fields

Name	Description
`PortAcquirer`	—
`PortNumber`	—
`WeakReference`	—
`OriginalAcquirer`	—

Event ID 1194 — TCP: endpoint/connection %1 replaced base endpoint %4 and acquired reference to port number %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint/connection %1 replaced base endpoint %4 and acquired reference to port number %2.

Fields

Name	Description
`PortAcquirer`	—
`PortNumber`	—
`WeakReference`	—
`OriginalAcquirer`	—

Event ID 1195 — TCP: Portpool assigned port number %2 with weak references due to port exhaustion.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Portpool assigned port number %2 with weak references due to port exhaustion.

Fields

Name	Description
`PortAcquirer`	—
`PortNumber`	—
`WeakReference`	—
`OriginalAcquirer`	—

Event ID 1196 — TCP: connection %1 BH receive ACK for full size seq.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 BH receive ACK for full size seq. Seq = %2. IsSack = %5.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`Reason`	—
`IsSack`	—

Event ID 1197 — TCP: connection %1 flushed SACK state at SndUna = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 flushed SACK state at SndUna = %2. Reason: %4.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`Reason`	—
`IsSack`	—

Event ID 1198 — TCP: Connection %1 entering reassembly at RcvNxt = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 entering reassembly at RcvNxt = %2.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—

Event ID 1199 — TCP: Connection %1 leaving reassembly at RcvNxt = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 leaving reassembly at RcvNxt = %2.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—

Event ID 1200 — TCP: connection %8 (local=%2 remote=%4) terminating: Zero window probe timeout expired.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) terminating: Zero window probe timeout expired.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1201 — TCP: connection %8 (local=%2 remote=%4) terminating: FIN-WAIT-2 timeout expired.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) terminating: FIN-WAIT-2 timeout expired.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1202 — IP: Interface rundown: Index = %1, Linkspeed = %2 bps, PhysicalMediumType = %7, IP Address = %4 %3 %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface rundown: Index = %1, Linkspeed = %2 bps, PhysicalMediumType = %7, IP Address = %4 %3 %6.

Fields

Name	Description
`IfIndex`	—
`CurrLinkSpeed`	—
`IPProtocol`	—
`IPv4Address`	—
`IpAddrLength`	—
`IPv6Address`	—
`PhysicalMediumType`	—
`CompartmentId`	—
`OldLinkSpeed`	—
`NetworkCategory`	—
`Metric`	—
`Connected`	—
`InternetConnectivityStatus`	—
`Flags`	—
`IsolationId`	—
`NlMtu`	—
`ForwardingTag`	—

Event ID 1203 — IP: Interface linkspeed change.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface Index = %1, Linkspeed changed to %2 bps, PhysicalMediumType = %7.

Fields

Name	Description
`IfIndex`	—
`CurrLinkSpeed`	—
`IPProtocol`	—
`IPv4Address`	—
`IpAddrLength`	—
`IPv6Address`	—
`PhysicalMediumType`	—
`CompartmentId`	—
`OldLinkSpeed`	—
`ReceiveLinkSpeed`	—
`MediaConnectState`	—

Event ID 1204 — TCP: Connection %1 flushing reassembly state at RcvNxt = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 flushing reassembly state at RcvNxt = %2. Reason = %4.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`Reason`	—
`IsSack`	—

Event ID 1205 — TCPIP: NBL %1 fell off the receive fast path, Reason: %10.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: NBL %1 fell off the receive fast path, Reason: %10. Protocol = %2, Family = %3, Number of NBLs = %11. SourceAddress = %4 %12 %7. DestAddress = %5 %12 %9.

Fields

Name	Description
`Nbl`	—
`IPTransportProtocol`	—
`AddressFamily`	—
`SourceIPv4Address`	—
`DestIPv4Address`	—
`IPv6SourceIpAddrLength`	—
`IPv6SourceAddress`	—
`IPv6DestIpAddrLength`	—
`IPv6DestAddress`	—
`Reason`	—
`NblCount`	—
`IPProtocol`	—

Event ID 1206 — TCPIP: NBL %1 fell off the send fast path, Reason: %10.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: NBL %1 fell off the send fast path, Reason: %10. Protocol = %2, Family = %3, Number of NBLs = %11. SourceAddress = %4 %12 %7. DestAddress = %5 %12 %9.

Fields

Name	Description
`Nbl`	—
`IPTransportProtocol`	—
`AddressFamily`	—
`SourceIPv4Address`	—
`DestIPv4Address`	—
`IPv6SourceIpAddrLength`	—
`IPv6SourceAddress`	—
`IPv6DestIpAddrLength`	—
`IPv6DestAddress`	—
`Reason`	—
`NblCount`	—
`IPProtocol`	—

Event ID 1207 — TCP: WSD - %1 Status: %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: WSD - %1 Status: %2.

Fields

Name	Description
`TcpWsdEtwPoint`	—
`Status`	—

Event ID 1208 — TCP: WSD - %1 Status: %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: WSD - %1 Status: %2.

Fields

Name	Description
`TcpWsdEtwPoint`	—
`Status`	—

Event ID 1209 — TCP: WSD - TCB %2 will use a highly restricted window scale factor due to a %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: WSD - TCB %2 will use a highly restricted window scale factor due to a %1.

Fields

Name	Description
`TcpWsdEtwPoint`	—
`Tcb`	—

Event ID 1210 — TCP: WSD - TCB %2 will use a highly restricted window scale factor due to a %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: WSD - TCB %2 will use a highly restricted window scale factor due to a %1.

Fields

Name	Description
`TcpWsdEtwPoint`	—
`Tcb`	—

Event ID 1211 — TCP: WSD - Entry (%2, %3) moved from %4 to %5 due to %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: WSD - Entry (%2, %3) moved from %4 to %5 due to %1.

Fields

Name	Description
`TcpWsdEtwPoint`	—
`Processor`	—
`Entry`	—
`OldState`	—
`NewState`	—
`ProbeCount`	—
`ProbeCountWs`	—

Event ID 1212 — TCP: WSD - Profile: %1 State: %2 Qualified: %3 EreQualified: %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: WSD - Profile: %1 State: %2 Qualified: %3 EreQualified: %4.

Fields

Name	Description
`Profile`	—
`State`	—
`Qualified`	—
`EreQualified`	—

Event ID 1213 — TCP: WSD - Enabled moved from %1 to %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: WSD - Enabled moved from %1 to %2. Threshold moved from  %3 to %4.

Fields

Name	Description
`OldEnabledState`	—
`NewEnabledState`	—
`OldThreshold`	—
`NewThreshold`	—

Event ID 1214 — TCPIP: Transport (Protocol %1, AddressFamily = %2) dropped %8 packet(s) with Local = %4, Remote = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Transport (Protocol %1, AddressFamily = %2) dropped %8 packet(s) with Local = %4, Remote = %6. Reason = %7.

Fields

Name	Description
`IPTransportProtocol`	—
`AddressFamily`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`RemoteSockAddrLength`	—
`RemoteSockAddr`	—
`Reason`	—
`PacketCount`	—

Event ID 1215 — TCPIP: Network layer (Protocol %1, AddressFamily = %2) dropped %10 packet(s).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Network layer (Protocol %1, AddressFamily = %2) dropped %10 packet(s). SourceAddress = %3 %11 %6. DestAddress = %4 %11 %8. Reason = %9.

Fields

Name	Description
`IPTransportProtocol`	—
`AddressFamily`	—
`SourceIPv4Address`	—
`DestIPv4Address`	—
`IPv6SourceIpAddrLength`	—
`IPv6SourceAddress`	—
`IPv6DestIpAddrLength`	—
`IPv6DestAddress`	—
`Reason`	—
`PacketCount`	—
`IPProtocol`	—
`SourceAddressLength`	—
`SourceAddress`	—
`DestAddressLength`	—
`DestAddress`	—
`IfIndex`	—
`PathDirection`	—
`Nbl`	—

Event ID 1216 — TCP: MPP NPP Evaluation PhysicalPages = %1 NonPagedPoolPages = %2 Current = %3 Peak = %4 Low = %5 High = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: MPP NPP Evaluation PhysicalPages = %1 NonPagedPoolPages = %2 Current = %3 Peak = %4 Low = %5 High = %6.

Fields

Name	Description
`PhysicalPages`	—
`NonPagedPoolPages`	—
`CurrentWatermark`	—
`PeakWatermark`	—
`HighWatermark`	—
`LowWatermark`	—

Event ID 1217 — TCP: MPP: Episode started.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: MPP: Episode started. LowNppEventState = %1 HighNppEventState = %2 EpisodeStartTick = %3 EpisodeStopTick = %4 Current = %5 Low = %6 Reentry = %7.

Fields

Name	Description
`LowNppEventState`	—
`HighNppEventState`	—
`EpisodeStartTick`	—
`EpisodeStopTick`	—
`CurrentWatermark`	—
`LowWatermark`	—
`ReentryWatermark`	—

Event ID 1218 — TCP: MPP: Episode ended.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: MPP: Episode ended. LowNppEventState = %1 HighNppEventState = %2 EpisodeStartTick = %3 EpisodeStopTick = %4 Reentry = %5.

Fields

Name	Description
`LowNppEventState`	—
`HighNppEventState`	—
`EpisodeStartTick`	—
`EpisodeStopTick`	—
`ReentryWatermark`	—

Event ID 1219 — TCP: MPP: Epoch %1 started.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: MPP: Epoch %1 started. LowNppEventState = %2 HighNppEventState = %3 EpochStartTick = %4 EpochStopTick = %5 SynDropRate = %6 -> %7 TcbKillRate = %8 -> %9 CurrentWatermark = %10.

Fields

Name	Description
`Epoch`	—
`LowNppEventState`	—
`HighNppEventState`	—
`EpochStartTick`	—
`EpochStopTick`	—
`OldSynDropRate`	—
`NewSynDropRate`	—
`OldTcbKillRate`	—
`NewTcbKillRate`	—
`CurrentWatermark`	—

Event ID 1220 — TCP: MPP: Epoch %1 ended.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: MPP: Epoch %1 ended. LowNppEventState = %2 HighNppEventState = %3 EpochStartTick = %4 EpochStopTick = %5 SynDropRate = %6 TcbKillRate = %7 Current = %8.

Fields

Name	Description
`Epoch`	—
`LowNppEventState`	—
`HighNppEventState`	—
`EpochStartTick`	—
`EpochStopTick`	—
`SynDropRate`	—
`TcbKillRate`	—
`CurrentWatermark`	—

Event ID 1221 — TCP: Connection %1 restarting Cwnd.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 restarting Cwnd. Old Cwnd = %2, New Cwnd = %3, Processor = %4, CurrentTick = %5, IdleTick = %6, Rto = %7.

Fields

Name	Description
`Tcb`	—
`OldCwnd`	—
`NewCwnd`	—
`Processor`	—
`CurrentTick`	—
`IdleTick`	—
`Rto`	—

Event ID 1222 — TCP: Connection %1 adjust InitalCwnd.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 adjust InitalCwnd. Cwnd = %2, New Initial Cwnd = %3 MSS.

Fields

Name	Description
`Tcb`	—
`OldCwnd`	—
`NewCwnd`	—
`Processor`	—
`CurrentTick`	—
`IdleTick`	—
`Rto`	—

Event ID 1223 — TCP: Connection %1 committed TemplateType = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 committed TemplateType = %2. MinRto = %3 msec, EnableCwndRestart = %4, InitialCwnd = %5 MSS, CongestionAlgorithm = %6, MaxDataRetransmissions = %7, DelayedAckTicks = %8 msec, DelayedAckFrequency = %9, RACK enabled = %10, Tail Loss Probe enabled = %11.

Fields

Name	Description
`Tcb`	—
`TemplateType`	—
`MinRto`	—
`EnableCwndRestart`	—
`InitialCwnd`	—
`CongestionAlgorithm`	—
`MaxDataRetransmissions`	—
`DelayedAckTicks`	—
`DelayedAckFrequency`	—
`Rack`	—
`TailLossProbe`	—

Event ID 1224 — TCP: Connection %1 template changed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 template changed. New template=%2. Context=%3.

Fields

Name	Description
`Tcb`	—
`TemplateType`	—
`Context`	—

Event ID 1225 — TCP: connection %1: End of a round, SndRound = %2, Bytes sent = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: End of a round, SndRound = %2, Bytes sent = %3. Bytes marked = %4, ThAck = %5, updated EcnAlpha = %6.

Fields

Name	Description
`Tcb`	—
`SndRound`	—
`EcnTotalByteCount`	—
`EcnTotalMarkedCount`	—
`ThAck`	—
`EcnAlpha`	—

Event ID 1226 — TCP: interface %1: RSC state changed, IPV4 State = %2, IPV4 Failure Reason = %3, IPV6 State = %4, IPV6 Failure Reason = %5, Event = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: interface %1: RSC state changed, IPV4 State = %2, IPV4 Failure Reason = %3, IPV6 State = %4, IPV6 Failure Reason = %5, Event = %6.

Fields

Name	Description
`IfIndex`	—
`StateV4`	—
`FailureReasonV4`	—
`StateV6`	—
`FailureReasonV6`	—
`Event`	—

Event ID 1227 — TCP: connection %1: RSC SCU received.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: RSC SCU received. CoalescedSegCount = %2, DupAckCount = %3, RscTcpTimestampDelta = %4, HeaderFlags = %5, EcnCePresent = %6.

Fields

Name	Description
`Tcb`	—
`CoalescedSegCount`	—
`DupAckCount`	—
`RscTcpTimestampDelta`	—
`HeaderFlags`	—
`EcnCePresent`	—

Event ID 1228 — TCPIP: TCB %1 does not take fast path, Cause: %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: TCB %1 does not take fast path, Cause: %2.

Fields

Name	Description
`Tcb`	—
`Cause`	—

Event ID 1229 — TCP: Connection %1 send queue is idle.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 send queue is idle. Cwnd = %2, Processor = %4, CurrentTick = %5, IdleTick = %6.

Fields

Name	Description
`Tcb`	—
`OldCwnd`	—
`NewCwnd`	—
`Processor`	—
`CurrentTick`	—
`IdleTick`	—
`Rto`	—

Event ID 1230 — RSS: %3 notification for %2 on interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: %3 notification for %2 on interface %1.

Fields

Name	Description
`InterfaceIndex`	—
`AddressFamily`	—
`Bind`	—

Event ID 1231 — RSS: %4 notification for adapter %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: %4 notification for adapter %1.

Fields

Name	Description
`AdapterIndex`	—
`InterfaceIndex`	—
`PortNumber`	—
`Bind`	—

Event ID 1232 — RSS: %4 reference on adapter %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: %4 reference on adapter %1.

Fields

Name	Description
`AdapterIndex`	—
`ExistingInterfaceIndex`	—
`ExistingPortNumber`	—
`ReferenceAdded`	—

Event ID 1233 — RSS: adapter %1 with capabilities %2 and %4 receive queues.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: adapter %1 with capabilities %2 and %4 receive queues.

Fields

Name	Description
`AdapterIndex`	—
`CapabilitiesFlags`	—
`NumberOfInterruptMessages`	—
`NumberOfReceiveQueues`	—

Event ID 1234 — RSS: adapter %1 processor group %2 maximum processors %3 processor affinity %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: adapter %1 processor group %2 maximum processors %3 processor affinity %4.

Fields

Name	Description
`AdapterIndex`	—
`GroupNumber`	—
`MaximumProcessors`	—
`GroupAffinity`	—
`AvailableProcessorsSize`	—
`AvailableProcessors`	—

Event ID 1235 — RSS: assigning processor %2 from adapter %3 to %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: assigning processor %2 from adapter %3 to %1.

Fields

Name	Description
`NewAdapterIndex`	—
`ProcessorIndex`	—
`PreviousAdapterIndex`	—
`TriggeringProcessorIndex`	—

Event ID 1236 — RSS: unassigning processor %2 from adapter %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: unassigning processor %2 from adapter %1.

Fields

Name	Description
`PreviousAdapterIndex`	—
`ProcessorIndex`	—

Event ID 1237 — RSS: adapter %1 reassigning indirection entry %2 from processor %3 to %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: adapter %1 reassigning indirection entry %2 from processor %3 to %4.

Fields

Name	Description
`AdapterIndex`	—
`IndirectionIndex`	—
`OldProcessorIndex`	—
`NewProcessorIndex`	—

Event ID 1238 — RSS: adapter %1 removing processor %2 from its indirection table.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: adapter %1 removing processor %2 from its indirection table.

Fields

Name	Description
`AdapterIndex`	—
`ProcessorIndex`	—

Event ID 1239 — RSS: adapter %1 changing %2 to %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: adapter %1 changing %2 to %3.

Fields

Name	Description
`AdapterIndex`	—
`Setting`	—
`Value`	—

Event ID 1240 — RSS: Failed to %2 on IfIndex %1: %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: Failed to %2 on IfIndex %1: %3

Fields

Name	Description
`InterfaceIndex`	—
`FailureDescription`	—
`Status`	—

Event ID 1241 — RSS: bind completed successfully for %2 on interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: bind completed successfully for %2 on interface %1.

Fields

Name	Description
`InterfaceIndex`	—
`AddressFamily`	—

Event ID 1242 — RSS: bind completed successfully for adapter %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: bind completed successfully for adapter %1.

Fields

Name	Description
`AdapterIndex`	—

Event ID 1243 — RSS: adapter %1 not supported.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: adapter %1 not supported.

Fields

Name	Description
`AdapterIndex`	—

Event ID 1244 — RSS: adapter %1 indirection table initialized on group %4 with processor set %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: adapter %1 indirection table initialized on group %4 with processor set %5.

Fields

Name	Description
`AdapterIndex`	—
`IndirectionTableSize`	—
`IndirectionTable`	—
`GroupNumber`	—
`ActiveAffinity`	—

Event ID 1245 — RSS: Rundown: interface %1 with adapter %2 at port %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: Rundown: interface %1 with adapter %2 at port %3.

Fields

Name	Description
`InterfaceIndex`	—
`AdapterIndex`	—
`PortNumber`	—

Event ID 1246 — RSS: Rundown: adapter %1 hash info %2 maximum processors %3 group %4 affinity %5 active processors %6 active mode: %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: Rundown: adapter %1 hash info %2 maximum processors %3 group %4 affinity %5 active processors %6 active mode: %7.

Fields

Name	Description
`AdapterIndex`	—
`HashInfo`	—
`MaximumProcessors`	—
`GroupNumber`	—
`GroupAffinity`	—
`ActiveAffinity`	—
`ActiveMode`	—
`IndirectionTableSize`	—
`IndirectionTable`	—

Event ID 1247 — RSS: interface %1 support: %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RSS: interface %1 support: %2.

Fields

Name	Description
`InterfaceIndex`	—
`Capability`	—

Event ID 1248 — NDKPI Create CQ: RequestContext %6 Adapter %1 CqDepth %2 CqNotificationContext %3 AffinityMask %4 AffinityGroup %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create CQ: RequestContext %6 Adapter %1 CqDepth %2 CqNotificationContext %3 AffinityMask %4 AffinityGroup %5

Fields

Name	Description
`NdkAdapter`	—
`CqDepth`	—
`CqNotificationContext`	—
`AffinityMask`	—
`AffinityGroup`	—
`RequestContext`	—

Event ID 1249 — NDKPI Create Completion: RequestContext %1 Status %2 (%4) %5 %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create Completion: RequestContext %1 Status %2 (%4) %5 %3

Fields

Name	Description
`RequestContext`	—
`Status`	—
`NdkObject`	—
`CompletionType`	—
`NdkObjectType`	—

Event ID 1250 — NDKPI Close %2: RequestContext %3 %2 %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Close %2: RequestContext %3 %2 %1

Fields

Name	Description
`NdkObject`	—
`NdkObjectType`	—
`RequestContext`	—

Event ID 1251 — NDKPI Close Completion: RequestContext %1 (%2).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Close Completion: RequestContext %1 (%2)

Fields

Name	Description
`RequestContext`	—
`CompletionType`	—

Event ID 1252 — NDKPI Resize CQ: RequestContext %3 CQ %1 CqDepth %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Resize CQ: RequestContext %3 CQ %1 CqDepth %2

Fields

Name	Description
`NdkCq`	—
`CqDepth`	—
`RequestContext`	—

Event ID 1253 — NDKPI Request Completion: RequestContext %1 Status %2 (%3).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Request Completion: RequestContext %1 Status %2 (%3)

Fields

Name	Description
`RequestContext`	—
`Status`	—
`CompletionType`	—

Event ID 1254 — NDKPI Arm CQ: CQ %1 %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Arm CQ: CQ %1 %2

Fields

Name	Description
`NdkCq`	—
`ArmType`	—

Event ID 1255 — NDKPI Result %6/%7: CQ %1 RequestContext %5 Status %2 BytesTransferred %3 QpContext %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Result %6/%7: CQ %1 RequestContext %5 Status %2 BytesTransferred %3 QpContext %4

Fields

Name	Description
`NdkCq`	—
`Status`	—
`BytesTransferred`	—
`QpContext`	—
`RequestContext`	—
`ResultIndex`	—
`ResultCount`	—

Event ID 1256 — NDKPI Create MR: RequestContext %3 PD %1 FastRegister %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create MR: RequestContext %3 PD %1 FastRegister %2

Fields

Name	Description
`NdkPd`	—
`FastRegister`	—
`RequestContext`	—

Event ID 1257 — NDKPI Flush: QP %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Flush: QP %1

Fields

Name	Description
`NdkQp`	—

Event ID 1258 — NDKPI Send (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 Flags %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Send (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 Flags %7

Fields

Name	Description
`NdkQp`	—
`RequestContext`	—
`SgeAddress`	—
`SgeLength`	—
`SgeMemoryRegionToken`	—
`NumSge`	—
`Flags`	—
`SgeIndex`	—

Event ID 1259 — NDKPI Receive (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Receive (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5

Fields

Name	Description
`NdkQp`	—
`RequestContext`	—
`SgeAddress`	—
`SgeLength`	—
`SgeMemoryRegionToken`	—
`NumSge`	—
`Flags`	—
`SgeIndex`	—

Event ID 1260 — NDKPI Register MR: RequestContext %5 MR %1 MDL %2 Length %3 Flags %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Register MR: RequestContext %5 MR %1 MDL %2 Length %3 Flags %4

Fields

Name	Description
`NdkMr`	—
`Mdl`	—
`Length`	—
`Flags`	—
`RequestContext`	—

Event ID 1261 — NDKPI Deregister MR: RequestContext %2 MR %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Deregister MR: RequestContext %2 MR %1

Fields

Name	Description
`NdkObject`	—
`RequestContext`	—

Event ID 1262 — NDKPI Initialize FastRegister MR: RequestContext %4 MR %1 AdapterPageCount %2 RemoteAccess %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Initialize FastRegister MR: RequestContext %4 MR %1 AdapterPageCount %2 RemoteAccess %3

Fields

Name	Description
`NdkMr`	—
`AdapterPageCount`	—
`RemoteAccess`	—
`RequestContext`	—

Event ID 1263 — NDKPI Modify SRQ: RequestContext %4 SRQ %1 SrqDepth %2 NotifyThreshold %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Modify SRQ: RequestContext %4 SRQ %1 SrqDepth %2 NotifyThreshold %3

Fields

Name	Description
`NdkSrq`	—
`SrqDepth`	—
`NotifyThreshold`	—
`RequestContext`	—

Event ID 1264 — NDKPI Connect: RequestContext %9 Connector %1 QP %2 SrcAddress %4 DestAddress %6 IRD %7 ORD %8 PrivateDataLength %11.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Connect: RequestContext %9 Connector %1 QP %2 SrcAddress %4 DestAddress %6 IRD %7 ORD %8 PrivateDataLength %11

Fields

Name	Description
`NdkConnector`	—
`NdkQp`	—
`SrcSockAddrLength`	—
`SrcSockAddr`	—
`DestSockAddrLength`	—
`DestSockAddr`	—
`IRD`	—
`ORD`	—
`RequestContext`	—
`NdkSharedEndpoint`	—
`PrivateDataLength`	—

Event ID 1265 — NDKPI Connect: RequestContext %9 Connector %1 QP %2 SharedEndpoint %10 DestAddress %6 IRD %7 ORD %8 PrivateDataLength %11.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Connect: RequestContext %9 Connector %1 QP %2 SharedEndpoint %10 DestAddress %6 IRD %7 ORD %8 PrivateDataLength %11

Fields

Name	Description
`NdkConnector`	—
`NdkQp`	—
`SrcSockAddrLength`	—
`SrcSockAddr`	—
`DestSockAddrLength`	—
`DestSockAddr`	—
`IRD`	—
`ORD`	—
`RequestContext`	—
`NdkSharedEndpoint`	—
`PrivateDataLength`	—

Event ID 1266 — NDKPI CompleteConnect: RequestContext %3 Connector %1 DisconnectEventContext %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI CompleteConnect: RequestContext %3 Connector %1 DisconnectEventContext %2

Fields

Name	Description
`NdkConnector`	—
`DisconnectEventContext`	—
`RequestContext`	—

Event ID 1267 — NDKPI Accept: RequestContext %6 Connector %1 QP %2 IRD %3 ORD %4 PrivateDataLength %7 DisconnectEventContext %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Accept: RequestContext %6 Connector %1 QP %2 IRD %3 ORD %4 PrivateDataLength %7 DisconnectEventContext %5

Fields

Name	Description
`NdkConnector`	—
`NdkQp`	—
`IRD`	—
`ORD`	—
`DisconnectEventContext`	—
`RequestContext`	—
`PrivateDataLength`	—

Event ID 1268 — NDKPI Disconnect: RequestContext %2 Connector %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Disconnect: RequestContext %2 Connector %1

Fields

Name	Description
`NdkObject`	—
`RequestContext`	—

Event ID 1269 — NDKPI Listen: RequestContext %4 Listener %1 Address %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Listen: RequestContext %4 Listener %1 Address %3

Fields

Name	Description
`NdkListener`	—
`SockAddrLength`	—
`SockAddr`	—
`RequestContext`	—

Event ID 1270 — NDKPI Create MW: RequestContext %2 PD %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create MW: RequestContext %2 PD %1

Fields

Name	Description
`NdkObject`	—
`RequestContext`	—

Event ID 1271 — NDKPI Create SRQ: RequestContext %8 PD %1 SrqDepth %2 MaxReceiveRequestSge %3 NotifyThreshold %4 SrqNotificationContext %5 AffinityMask %6 Affinity...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create SRQ: RequestContext %8 PD %1 SrqDepth %2 MaxReceiveRequestSge %3 NotifyThreshold %4 SrqNotificationContext %5 AffinityMask %6 AffinityGroup %7

Fields

Name	Description
`NdkPd`	—
`SrqDepth`	—
`MaxReceiveRequestSge`	—
`NotifyThreshold`	—
`SrqNotificationContext`	—
`AffinityMask`	—
`AffinityGroup`	—
`RequestContext`	—

Event ID 1272 — NDKPI Create QP: RequestContext %9 PD %1 ReceiveCQ %2 InitiatorCQ %3 QPContext %4 ReceiveQueueDepth %5 InitiatorQueueDepth %6 MaxReceiveRequestSge ...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create QP: RequestContext %9 PD %1 ReceiveCQ %2 InitiatorCQ %3 QPContext %4 ReceiveQueueDepth %5 InitiatorQueueDepth %6 MaxReceiveRequestSge %7 MaxInitiatorRequestSge %8

Fields

Name	Description
`NdkPd`	—
`ReceiveCq`	—
`InitiatorCq`	—
`QPContext`	—
`ReceiveQueueDepth`	—
`InitiatorQueueDepth`	—
`MaxReceiveRequestSge`	—
`MaxInitiatorRequestSge`	—
`RequestContext`	—
`NdkSrq`	—

Event ID 1273 — NDKPI Create QP: RequestContext %9 PD %1 ReceiveCQ %2 InitiatorCQ %3 SRQ %10 QPContext %4 InitiatorQueueDepth %6 MaxInitiatorRequestSge %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create QP: RequestContext %9 PD %1 ReceiveCQ %2 InitiatorCQ %3 SRQ %10 QPContext %4 InitiatorQueueDepth %6 MaxInitiatorRequestSge %8

Fields

Name	Description
`NdkPd`	—
`ReceiveCq`	—
`InitiatorCq`	—
`QPContext`	—
`ReceiveQueueDepth`	—
`InitiatorQueueDepth`	—
`MaxReceiveRequestSge`	—
`MaxInitiatorRequestSge`	—
`RequestContext`	—
`NdkSrq`	—

Event ID 1274 — NDKPI Create PD: RequestContext %2 Adapter %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create PD: RequestContext %2 Adapter %1

Fields

Name	Description
`NdkObject`	—
`RequestContext`	—

Event ID 1275 — NDKPI Create SharedEndpoint: RequestContext %4 Adapter %1 Address %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create SharedEndpoint: RequestContext %4 Adapter %1 Address %3

Fields

Name	Description
`NdkListener`	—
`SockAddrLength`	—
`SockAddr`	—
`RequestContext`	—

Event ID 1276 — NDKPI Create Connector: RequestContext %2 Adapter %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create Connector: RequestContext %2 Adapter %1

Fields

Name	Description
`NdkObject`	—
`RequestContext`	—

Event ID 1277 — NDKPI Create Listener: RequestContext %3 Adapter %1 ConnectEventContext %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Create Listener: RequestContext %3 Adapter %1 ConnectEventContext %2

Fields

Name	Description
`NdkAdapter`	—
`ConnectEventContext`	—
`RequestContext`	—

Event ID 1278 — NDKPI Build LAM: RequestContext %4 Adapter %1 MDL %2 Length %3 LAMBuffer %5 LAMBufferSize %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Build LAM: RequestContext %4 Adapter %1 MDL %2 Length %3 LAMBuffer %5 LAMBufferSize %6

Fields

Name	Description
`NdkAdapter`	—
`Mdl`	—
`Length`	—
`RequestContext`	—
`LAMBuffer`	—
`LAMBufferSize`	—

Event ID 1279 — NDKPI Release LAM: Adapter %1 LAMBuffer %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Release LAM: Adapter %1 LAMBuffer %2

Fields

Name	Description
`NdkAdapter`	—
`LAMBuffer`	—

Event ID 1280 — NDKPI CQ Notification Callback: CqNotificationContext %1 CqStatus %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI CQ Notification Callback: CqNotificationContext %1 CqStatus %2

Fields

Name	Description
`CqNotificationContext`	—
`CqStatus`	—

Event ID 1281 — NDKPI SRQ Notification Callback: SrqNotificationContext %1 SrqStatus %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI SRQ Notification Callback: SrqNotificationContext %1 SrqStatus %2

Fields

Name	Description
`SrqNotificationContext`	—
`SrqStatus`	—

Event ID 1282 — NDKPI Disconnect Event Callback: DisconnectEventContext %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Disconnect Event Callback: DisconnectEventContext %1

Fields

Name	Description
`DisconnectEventContext`	—

Event ID 1283 — NDKPI Connect Event Callback: ConnectEventContext %1 Connector %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Connect Event Callback: ConnectEventContext %1 Connector %2

Fields

Name	Description
`ConnectEventContext`	—
`NdkConnector`	—

Event ID 1284 — NDKPI Got %3 Token %4 from %2 %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Got %3 Token %4 from %2 %1

Fields

Name	Description
`NdkObject`	—
`NdkObjectType`	—
`TokenType`	—
`Token`	—

Event ID 1285 — NDKPI Got %3 Address %5 from %2 %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Got %3 Address %5 from %2 %1

Fields

Name	Description
`NdkObject`	—
`NdkObjectType`	—
`SockAddrType`	—
`SockAddrLength`	—
`SockAddr`	—

Event ID 1286 — NDKPI %3 Address query failure %4 on %2 %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI %3 Address query failure %4 on %2 %1

Fields

Name	Description
`NdkObject`	—
`NdkObjectType`	—
`SockAddrType`	—
`Status`	—

Event ID 1287 — NDKPI Reject: Connector %1 PrivateDataLength %2 Status %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Reject: Connector %1 PrivateDataLength %2 Status %3

Fields

Name	Description
`NdkConnector`	—
`PrivateDataLength`	—
`Status`	—

Event ID 1288 — NDKPI Get Connect Data: Connector %1 IRD %2 ORD %3 PrivateDataLength %4 Status %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Get Connect Data: Connector %1 IRD %2 ORD %3 PrivateDataLength %4 Status %5

Fields

Name	Description
`NdkConnector`	—
`IRD`	—
`ORD`	—
`PrivateDataLength`	—
`Status`	—

Event ID 1289 — NDKPI Work Request Inline Failure: RequestContext %2 QP %1 Status %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Work Request Inline Failure: RequestContext %2 QP %1 Status %3

Fields

Name	Description
`NdkQp`	—
`RequestContext`	—
`Status`	—

Event ID 1290 — NDKPI Bind: RequestContext %2 QP %1 MR %3 MW %4 VirtualAddress %5 Length %6 Flags %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Bind: RequestContext %2 QP %1 MR %3 MW %4 VirtualAddress %5 Length %6 Flags %7

Fields

Name	Description
`NdkQp`	—
`RequestContext`	—
`NdkMr`	—
`NdkMw`	—
`VirtualAddress`	—
`Length`	—
`Flags`	—

Event ID 1291 — NDKPI FastRegister: RequestContext %2 QP %1 MR %3 AdapterPageCount %4 AdapterPageArray %5 FBO %6 Length %7 BaseVirtualAddress %8 Flags %9.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI FastRegister: RequestContext %2 QP %1 MR %3 AdapterPageCount %4 AdapterPageArray %5 FBO %6 Length %7 BaseVirtualAddress %8 Flags %9

Fields

Name	Description
`NdkQp`	—
`RequestContext`	—
`NdkMr`	—
`AdapterPageCount`	—
`AdapterPageArray`	—
`FBO`	—
`Length`	—
`BaseVirtualAddress`	—
`Flags`	—

Event ID 1292 — NDKPI Invalidate: RequestContext %2 QP %1 %4 %3 Flags %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Invalidate: RequestContext %2 QP %1 %4 %3 Flags %5

Fields

Name	Description
`NdkQp`	—
`RequestContext`	—
`NdkObject`	—
`NdkObjectType`	—
`Flags`	—

Event ID 1293 — NDKPI Read (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 RemoteAddress %9 RemoteToken %10 Flags %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Read (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 RemoteAddress %9 RemoteToken %10 Flags %7

Fields

Name	Description
`NdkQp`	—
`RequestContext`	—
`SgeAddress`	—
`SgeLength`	—
`SgeMemoryRegionToken`	—
`NumSge`	—
`Flags`	—
`SgeIndex`	—
`RemoteAddress`	—
`RemoteToken`	—

Event ID 1294 — NDKPI Write (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 RemoteAddress %9 RemoteToken %10 Flags %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Write (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 RemoteAddress %9 RemoteToken %10 Flags %7

Fields

Name	Description
`NdkQp`	—
`RequestContext`	—
`SgeAddress`	—
`SgeLength`	—
`SgeMemoryRegionToken`	—
`NumSge`	—
`Flags`	—
`SgeIndex`	—
`RemoteAddress`	—
`RemoteToken`	—

Event ID 1295 — NDKPI SRQ Receive (SGE %8/%6): RequestContext %2 SRQ %1 SGE %3/%4/%5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI SRQ Receive (SGE %8/%6): RequestContext %2 SRQ %1 SGE %3/%4/%5

Fields

Name	Description
`NdkSrq`	—
`RequestContext`	—
`SgeAddress`	—
`SgeLength`	—
`SgeMemoryRegionToken`	—
`NumSge`	—
`Flags`	—
`SgeIndex`	—

Event ID 1296 — NDKPI SRQ Work Request Inline Failure: RequestContext %2 SRQ %1 Status %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI SRQ Work Request Inline Failure: RequestContext %2 SRQ %1 Status %3

Fields

Name	Description
`NdkSrq`	—
`RequestContext`	—
`Status`	—

Event ID 1297 — NDKPI Open Adapter: InterfaceIndex %1 Adapter %2 Status %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Open Adapter: InterfaceIndex %1 Adapter %2 Status %3

Fields

Name	Description
`InterfaceIndex`	—
`NdkAdapter`	—
`Status`	—

Event ID 1298 — NDKPI Close Adapter (Enter): Adapter %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Close Adapter (Enter): Adapter %1

Fields

Name	Description
`NdkAdapter`	—

Event ID 1299 — NDKPI Close Adapter (Exit): Adapter %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Close Adapter (Exit): Adapter %1

Fields

Name	Description
`NdkAdapter`	—

Event ID 1300 — TCP: connection %1 (local=%3 remote=%5) exists.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 (local=%3 remote=%5) exists. State = %6. PID = %7.

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`State`	—
`Pid`	—
`ProcessStartKey`	—
`SendTrackerEnabled`	—
`RcvBufSet`	—

Event ID 1301 — NDKPI Interface Event: InterfaceIndex %1, NDK-Operational %3, %2 (%4).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Interface Event: InterfaceIndex %1, NDK-Operational %3, %2 (%4)

Fields

Name	Description
`InterfaceIndex`	—
`EventDescription`	—
`NDKOperational`	—
`StatusCode`	—

Event ID 1302 — Network adapter Luid .

Provider: Microsoft-Windows-TCPIP
Channel: Operational

Fields

Name	Description
`AdapterLuid`	—
`PatternFriendlyName`	—
`DlAddrLength`	—
`SrcDLAddress`	—
`DestDLAddress`	—
`SrcAddress`	—
`DestAddress`	—
`Protocol`	—
`SrcPort`	—
`DestPort`	—

Event ID 1302 — Network adapter Luid %1 received a wake packet matching pattern %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Network adapter Luid %1 received a wake packet matching pattern %2. Protocol: %8. Destination MAC address: %5. Source: %6 : %9, Destination: %7 : %10.

Fields

Name	Description
`AdapterLuid`	—
`PatternFriendlyName`	—
`DlAddrLength`	—
`SrcDLAddress`	—
`DestDLAddress`	—
`SrcAddress`	—
`DestAddress`	—
`Protocol`	—
`SrcPort`	—
`DestPort`	—

Event ID 1303 — Network adapter Luid .

Provider: Microsoft-Windows-TCPIP
Channel: Operational

Fields

Name	Description
`AdapterLuid`	—
`PatternFriendlyName`	—
`DlAddrLength`	—
`SrcDLAddress`	—
`DestDLAddress`	—
`IpAddrLength`	—
`SrcAddress`	—
`DestAddress`	—
`Protocol`	—
`SrcPort`	—
`DestPort`	—

Event ID 1303 — Network adapter Luid %1 received a wake packet matching pattern %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Network adapter Luid %1 received a wake packet matching pattern %2. Protocol: %9. Destination MAC address: %5. Source: %7 : %10, Destination %8 : %11.

Fields

Name	Description
`AdapterLuid`	—
`PatternFriendlyName`	—
`DlAddrLength`	—
`SrcDLAddress`	—
`DestDLAddress`	—
`IpAddrLength`	—
`SrcAddress`	—
`DestAddress`	—
`Protocol`	—
`SrcPort`	—
`DestPort`	—

Event ID 1304 — TCP: Connection %1: Silent Mode %2 Context %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1: Silent Mode %2 Context %3

Fields

Name	Description
`Tcb`	—
`SilentModeEvent`	—
`Context`	—

Event ID 1305 — TCP: Connection %1 notification channel request.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 notification channel request. NcmContext = %2, TCB State = %3, PID = %4, IsLoopback = %5, Status = %7.

Fields

Name	Description
`Tcb`	—
`NcmContext`	—
`State`	—
`Pid`	—
`IsLoopback`	—
`ChannelStatus`	—
`Status`	—

Event ID 1306 — TCP: Connection %1 query notification channel status request.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 query notification channel status request. NcmContext = %2, PID = %4, Channel Status = %6, Status = %7.

Fields

Name	Description
`Tcb`	—
`NcmContext`	—
`State`	—
`Pid`	—
`IsLoopback`	—
`ChannelStatus`	—
`Status`	—

Event ID 1307 — TCP: Connection %1 notification channel request processed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 notification channel request processed. NcmContext = %2, PID = %3, Status = %4 PushNotificationId = %5.

Fields

Name	Description
`Tcb`	—
`NcmContext`	—
`Pid`	—
`Status`	—
`PushNotificationGuid`	—

Event ID 1308 — TCP: Connection %1 notification channel signal event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 notification channel signal event. NcmContext = %2, PID = %3, RcvNxt = %4, Delivered Data = %5, Indicated Data = %6, FinalEvent = %7.

Fields

Name	Description
`Tcb`	—
`NcmContext`	—
`Pid`	—
`RcvNxt`	—
`Delivered`	—
`Indicated`	—
`FinalEvent`	—

Event ID 1309 — TCP: Connection %1 notification channel detached.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 notification channel detached. NcmContext = %2, TCB State = %3. Cleanup NcmContext = %5

Fields

Name	Description
`Tcb`	—
`NcmContext`	—
`State`	—
`Pid`	—
`IsLoopback`	—
`ChannelStatus`	—
`Status`	—

Event ID 1310 — TCP: Connection %1 notification channel unlinked.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 notification channel unlinked. TCB State = %3.

Fields

Name	Description
`Tcb`	—
`NcmContext`	—
`State`	—
`Pid`	—
`IsLoopback`	—
`ChannelStatus`	—
`Status`	—

Event ID 1311 — TCP: Connection %1 notification channel wake pattern plumbing.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 notification channel wake pattern plumbing. SystemReserved = %2, Wake-on-Lan Handle = %3, Status = %4.

Fields

Name	Description
`Tcb`	—
`SystemReserved`	—
`WolHandle`	—
`Status`	—

Event ID 1312 — TCP: Connection %1 notification channel wake pattern deplumbing.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 notification channel wake pattern deplumbing. Wake-on-Lan Handle = %3, Status = %4.

Fields

Name	Description
`Tcb`	—
`SystemReserved`	—
`WolHandle`	—
`Status`	—

Event ID 1313 — TCPIP: Interface index %1 wake pattern properties.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Interface index %1 wake pattern properties. AOAC capable = %2, Bitmap pattern supported = %3, ARP/ND offload supported = %4, IP address = %9 %11 %10 wake ready = %5, pattern priority = %6, interface medium = %7, Status = %12.

Fields

Name	Description
`InterfaceIndex`	—
`AoAcCapable`	—
`BitmapPatternSupported`	—
`ARPNDOffloadSupported`	—
`IPAddressWakeReady`	—
`PatternPriority`	—
`PhysicalMediumType`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—
`Status`	—
`HasBeenAoAcCapable`	—
`WolHandle`	—

Event ID 1314 — NDKPI Control CQ Interrupt Moderation: CQ %1 Interval %2 Count %3 Status %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Control CQ Interrupt Moderation: CQ %1 Interval %2 Count %3 Status %4

Fields

Name	Description
`NdkCq`	—
`ModerationInterval`	—
`ModerationCount`	—
`Status`	—

Event ID 1315 — TCP: Connection %1 notification channel request processing.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 notification channel request processing. IsRedirected = %2, WfpFailure = %3, Status = %4, WaitStatus = %5, Local IP address = %7 %9 %8, Remote IP address = %10 %9 %11 Local Port = %12, Remote Port = %13.

Fields

Name	Description
`Tcb`	—
`IsRedirected`	—
`WfpFailure`	—
`Status`	—
`WaitStatus`	—
`IpAddrLength`	—
`LocalIPv4Address`	—
`LocalIPv6Address`	—
`IPProtocol`	—
`RemoteIPv4Address`	—
`RemoteIPv6Address`	—
`SrcPort`	—
`DestPort`	—

Event ID 1316 — IP: IP address lifetime = %4 %6 %5 on interface = %1, protocol = %2, CurrentTime = %7 Old BaseTime = %8 Old ValidTime = %9 New BaseTime = %11 New V...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: IP address lifetime = %4 %6 %5 on interface = %1, protocol = %2, CurrentTime = %7 Old BaseTime = %8 Old ValidTime = %9 New BaseTime = %11 New ValidTime = %12.

Fields

Name	Description
`Interface`	—
`Protocol`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—
`CurrentTime`	—
`OldBaseTime`	—
`OldValidTime`	—
`OldPreferredTime`	—
`NewBaseTime`	—
`NewValidTime`	—
`NewPreferredTime`	—
`InterfaceGuid`	—
`IpAddressLifetimeChangeReason`	—

Event ID 1317 — TCP: Repartition event %1 (%2) %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Repartition event %1 (%2) %5.

Fields

Name	Description
`Event`	—
`Type`	—
`Processor`	—
`PowerSource`	—
`OldPartitionCount`	—
`NewPartitionCount`	—
`Progress`	—

Event ID 1318 — %1 %2 on processor %3 at Tick = %4 Time = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

%1 %2 on processor %3 at Tick = %4 Time = %5.

Fields

Name	Description
`Component`	—
`PowerStateTransition`	—
`IndicatingProcessor`	—
`CurrentTick`	—
`CurrentTime`	—

Event ID 1319 — %1 timer rescheduled by processor %2 for processor %3 at Tick = %4 to Tick = %5, OldScheduledExpiration = %6 NewScheduledExpiration = %7 DueTime = ...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

%1 timer rescheduled by processor %2 for processor %3 at Tick = %4 to Tick = %5, OldScheduledExpiration = %6 NewScheduledExpiration = %7 DueTime = %8 Aperiodic = %9.

Fields

Name	Description
`Component`	—
`IndicatingProcessor`	—
`TargetProcessor`	—
`CurrentTick`	—
`NextExpirationTick`	—
`DueTime`	—
`Aperiodic`	—

Event ID 1320 — %1 timer fired on processor %2 at Tick = %3, was scheduled for = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

%1 timer fired on processor %2 at Tick = %3, was scheduled for = %4.

Fields

Name	Description
`Component`	—
`TargetProcessor`	—
`CurrentTick`	—
`NextExpiration`	—
`ExternalTrigger`	—

Event ID 1321 — IP: Interface media connect.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Connecting interface %1, trace = %2.

Fields

Name	Description
`InterfaceIndex`	—
`TraceString`	—
`CompartmentId`	—

Event ID 1322 — IP: Interface limited link connectivity set.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Limited link connectivity set on interface %1, trace = %2.

Fields

Name	Description
`InterfaceIndex`	—
`TraceString`	—
`CompartmentId`	—

Event ID 1323 — IP: Interface limited link connectivity reset.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Limited link connectivity reset on interface %1, trace = %2.

Fields

Name	Description
`InterfaceIndex`	—
`TraceString`	—
`CompartmentId`	—

Event ID 1324 — IP: Neighbor state change.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Neighbor with IpAddress = %3 DlAddress = %5 on Interface = %1 changed state from %6 to %7 due to Event = %8.

Fields

Name	Description
`Interface`	—
`IpAddrLength`	—
`IPAddress`	—
`DlAddrLength`	—
`DLAddress`	—
`OldNeighborState`	—
`NewNeighborState`	—
`NeighborEvent`	—
`CompartmentId`	—

Event ID 1325 — IP: Neighbor Discovery.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: %5 on Interface = %1 from SourceIpAddress = %3 for TargetIpAddress = %4.

Fields

Name	Description
`Interface`	—
`IpAddrLength`	—
`SourceIPAddress`	—
`TargetIPAddress`	—
`NeighborEvent`	—
`CompartmentId`	—

Event ID 1326 — IP: Source address %2 is preferred over %3 for Destination %4 in Compartment %5, Reason: %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Source address %2 is preferred over %3 for Destination %4 in Compartment %5, Reason: %8 (Rule %6.%7).

Fields

Name	Description
`IpAddrLength`	—
`PreferredSourceIPAddress`	—
`NonPreferredSourceIPAddress`	—
`DestinationIPAddress`	—
`CompartmentId`	—
`Rule`	—
`RuleExtension`	—
`RuleName`	—

Event ID 1327 — IP: Address pair (%2, %3) is preferred over (%4, %5) by SortOptions = %6, Rule = %7 %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Address pair (%2, %3) is preferred over (%4, %5) by SortOptions = %6, Rule = %7 %8.%9.

Fields

Name	Description
`IpAddrLength`	—
`PreferredSourceIPAddress`	—
`PreferredDestinationIPAddress`	—
`NonPreferredSourceIPAddress`	—
`NonPreferredDestinationIPAddress`	—
`SortOption`	—
`RuleType`	—
`RuleMajor`	—
`RuleMinor`	—
`RuleName`	—

Event ID 1328 — NDKPI ResultEx %6/%7: CQ %1 RequestContext %5 Status %2 BytesTransferred %3 QpContext %4 Type %8 TypeSpecific %9.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI ResultEx %6/%7: CQ %1 RequestContext %5 Status %2 BytesTransferred %3 QpContext %4 Type %8 TypeSpecific %9

Fields

Name	Description
`NdkCq`	—
`Status`	—
`BytesTransferred`	—
`QpContext`	—
`RequestContext`	—
`ResultIndex`	—
`ResultCount`	—
`Type`	—
`TypeSpecificCompletionOutput`	—
`ProviderErrorCode`	—

Event ID 1329 — NDKPI SendInvalidate (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 RemoteToken %9 Flags %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI SendInvalidate (SGE %8/%6): RequestContext %2 QP %1 SGE %3/%4/%5 RemoteToken %9 Flags %7

Fields

Name	Description
`NdkQp`	—
`RequestContext`	—
`SgeAddress`	—
`SgeLength`	—
`SgeMemoryRegionToken`	—
`NumSge`	—
`Flags`	—
`SgeIndex`	—
`RemoteToken`	—

Event ID 1330 — TCP: connection %1: Cumulative Ack event, SeqNo = %5, BytesAcked = %4, CWnd = %2, SndWnd =%3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Cumulative Ack event, SeqNo = %5, BytesAcked = %4, CWnd = %2, SndWnd =%3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SndWnd`	—
`BytesAcked`	—
`SeqNo`	—

Event ID 1331 — TCP: connection %1: CTCP Cumulative Ack event, SeqNo = %5, BytesAcked = %4, CWnd = %2, SndWnd =%3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: CTCP Cumulative Ack event, SeqNo = %5, BytesAcked = %4, CWnd = %2, SndWnd =%3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SndWnd`	—
`BytesAcked`	—
`SeqNo`	—

Event ID 1332 — TCP: connection %1: TCP send event, SeqNo = %5, BytesSent = %4, CWnd = %2, SndWnd = %3, SRtt = %6, RttVar = %7, RTO = %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: TCP send event, SeqNo = %5, BytesSent = %4, CWnd = %2, SndWnd = %3, SRtt = %6, RttVar = %7, RTO = %8

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SndWnd`	—
`BytesSent`	—
`SeqNo`	—
`SRtt`	—
`RttVar`	—
`RTO`	—
`RcvWnd`	—
`PacingRate`	—
`TcpState`	—
`CongestionState`	—
`SndUna`	—
`SndMax`	—
`RecoveryMax`	—
`RcvBufSet`	—
`MaxRcvBuf`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—

Event ID 1333 — TCP: connection %1: TCP CTCP send event, SeqNo = %5, BytesSent = %4, CWnd = %2, SndWnd = %3, SRtt = %6, RttVar = %7, RTO = %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: TCP CTCP send event, SeqNo = %5, BytesSent = %4, CWnd = %2, SndWnd = %3, SRtt = %6, RttVar = %7, RTO = %8.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SndWnd`	—
`BytesSent`	—
`SeqNo`	—
`SRtt`	—
`RttVar`	—
`RTO`	—
`RcvWnd`	—

Event ID 1334 — UDP: Endpoint %1 notification channel request.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Endpoint %1 notification channel request. NcmContext = %2, Endpoint State = %3, PID = %4, IsLoopback = %5, Status = %7.

Fields

Name	Description
`UdpEndpoint`	—
`NcmContext`	—
`Activated`	—
`Pid`	—
`IsLoopback`	—
`ChannelStatus`	—
`Status`	—

Event ID 1335 — UDP: Endpoint %1 query notification channel status request.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Endpoint %1 query notification channel status request. NcmContext = %2, Endpoint State = %3, PID = %4, Channel Status = %6, Status = %7.

Fields

Name	Description
`UdpEndpoint`	—
`NcmContext`	—
`Activated`	—
`Pid`	—
`IsLoopback`	—
`ChannelStatus`	—
`Status`	—

Event ID 1336 — UDP: Endpoint %1 notification channel request processed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Endpoint %1 notification channel request processed. NcmContext = %2, PID = %3, Status = %4 PushNotificationId = %5.

Fields

Name	Description
`UdpEndpoint`	—
`NcmContext`	—
`Pid`	—
`Status`	—
`PushNotificationGuid`	—

Event ID 1337 — UDP: Endpoint %1 notification channel signal event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Endpoint %1 notification channel signal event. NcmContext = %2, PID = %3, Delivered Data = %4 FinalEvent = %5.

Fields

Name	Description
`UdpEndpoint`	—
`NcmContext`	—
`Pid`	—
`Delivered`	—
`FinalEvent`	—

Event ID 1338 — UDP: Endpoint %1 notification channel detached.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Endpoint %1 notification channel detached. NcmContext = %2, Endpoint State = %3.

Fields

Name	Description
`UdpEndpoint`	—
`NcmContext`	—
`Activated`	—
`Pid`	—
`IsLoopback`	—
`ChannelStatus`	—
`Status`	—

Event ID 1339 — UDP: Endpoint %1 notification channel unlinked.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Endpoint %1 notification channel unlinked. Endpoint State = %3.

Fields

Name	Description
`UdpEndpoint`	—
`NcmContext`	—
`Activated`	—
`Pid`	—
`IsLoopback`	—
`ChannelStatus`	—
`Status`	—

Event ID 1340 — UDP: Endpoint %1 notification channel request processing.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Endpoint %1 notification channel request processing. Local IP address = %3 %5 %4, Local Port = %6.

Fields

Name	Description
`UdpEndpoint`	—
`IpAddrLength`	—
`LocalIPv4Address`	—
`LocalIPv6Address`	—
`IPProtocol`	—
`SrcPort`	—

Event ID 1341 — TCP: connection %1: Rtt sample recorded %2 SRTT %4 RttVar %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1:  Rtt sample recorded %2 SRTT %4 RttVar %3.

Fields

Name	Description
`Tcb`	—
`RttSample`	—
`RttVar`	—
`SRTT`	—

Event ID 1342 — TCP: connection %1: Rtt resiliency detection complete with Rtt sample = %2 and new SRTT = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Rtt resiliency detection complete with Rtt sample = %2 and new SRTT = %4.

Fields

Name	Description
`Tcb`	—
`RttSample`	—
`RttVar`	—
`SRTT`	—

Event ID 1343 — TCP: connection %1: Duplicate ACK updated cwnd = %2 and updated ssthresh = %3 DupAckCount = %4 SndUna = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Duplicate ACK updated cwnd = %2 and updated ssthresh = %3 DupAckCount = %4 SndUna = %5.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`DupAckCount`	—
`SeqNo`	—

Event ID 1344 — TCP: CTCP Duplicate Ack event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTCP Duplicate Ack event. Connection %1, SndUna = %5, CWnd = %2, DupAckCount = %4.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`DupAckCount`	—
`SeqNo`	—

Event ID 1345 — TCP: connection %1: Spurious timeout at Seq = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Spurious timeout at Seq = %2.

Fields

Name	Description
`Tcb`	—
`SeqNo`	—

Event ID 1346 — TCP: connection %1 spurious RTO detection initiated at %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 spurious RTO detection initiated at %2.

Fields

Name	Description
`Tcb`	—
`SeqNo`	—

Event ID 1347 — TCP: connection %1 spurious RTO detection terminated at %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 spurious RTO detection terminated at %2.

Fields

Name	Description
`Tcb`	—
`SeqNo`	—

Event ID 1348 — TCP: CTCP DataTransferTimeout event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTCP DataTransferTimeout event. Connection %1, CWnd = %2, SsThresh = %3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—

Event ID 1349 — TCP: CTCP Spurious timeout event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CTCP Spurious timeout event. Connection %1, CWnd = %2, SsThresh = %3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—

Event ID 1350 — TCP: connection %1 entering Congestion Avoidance Phase with cwnd = %2 and ssthresh = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 entering Congestion Avoidance Phase with cwnd = %2 and ssthresh = %3.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—

Event ID 1351 — TCP: connection %1: Send Retransmit round with SndUna = %2, Round = %3, SRTT = %4, RTO = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Send Retransmit round with SndUna = %2, Round = %3, SRTT = %4, RTO = %5.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`RexmitCount`	—
`SRTT`	—
`RTO`	—
`SndMax`	—
`RecoveryMax`	—
`TcpState`	—
`CongestionState`	—
`Frto`	—
`TotalRT`	—
`MaxRT`	—

Event ID 1352 — TCP: Connection %1 Summary: DataBytesOut %2 DataBytesIn %3 DataSegmentsOut %4 DataSegmentsIn %5 SegmentsOut %6 SegmentsIn %7 NonRecovDa \ %8 NonRec...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 Summary: DataBytesOut %2 DataBytesIn %3 DataSegmentsOut %4 DataSegmentsIn %5 SegmentsOut %6 SegmentsIn %7 NonRecovDa \   %8 NonRecovDaEpisodes %9 DupAcksIn %10 BytesRetrans %11 Timeouts %12 SpuriousRtoDetections %13 FastRetran %14 MaxSsthresh %15 MaxSsCwnd %16 \   MaxCaCwnd %17 SndLimTransRwin %18 SndLimTimeRwin %19 SndLimBytesRwin %20 SndLimTransCwnd %21 SndLimTimeCwnd %22 SndLimBytesCwnd %23 \   SndLimTransSnd %24 SndLimTimeSnd %25 SndLimBytesSnd %26.

Fields

Name	Description
`Tcb`	—
`DataBytesOut`	—
`DataBytesIn`	—
`DataSegmentsOut`	—
`DataSegmentsIn`	—
`SegmentsOut`	—
`SegmentsIn`	—
`NonRecovDa`	—
`NonRecovDaEpisodes`	—
`DupAcksIn`	—
`BytesRetrans`	—
`Timeouts`	—
`SpuriousRtoDetections`	—
`FastRetran`	—
`MaxSsthresh`	—
`MaxSsCwnd`	—
`MaxCaCwnd`	—
`SndLimTransRwin`	—
`SndLimTimeRwin`	—
`SndLimBytesRwin`	—
`SndLimTransCwnd`	—
`SndLimTimeCwnd`	—
`SndLimBytesCwnd`	—
`SndLimTransSnd`	—
`SndLimTimeRSnd`	—
`SndLimBytesRSnd`	—

Event ID 1353 — TCPIP: Message %1 %2 %3 %4 %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Message %1 %2 %3 %4 %5.

Fields

Name	Description
`AllocationObjectString`	—
`Param1`	—
`Param2`	—
`Param3`	—
`Param4`	—

Event ID 1354 — TCP: Connection %1 SACK updated SndUna %2 SndMax %3 SackCount %4 SackBytes %5 SackInFlight %6 SackIsLost %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 SACK updated SndUna %2 SndMax %3 SackCount %4 SackBytes %5 SackInFlight %6 SackIsLost %7.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`SackCount`	—
`SackBytes`	—
`SackInFlight`	—
`SackIsLost`	—

Event ID 1355 — TCP: TCB %1 Requires address based pattern = %2 LocalPort = %3 RtcPortRange = [%4, %5] Status = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: TCB %1 Requires address based pattern = %2 LocalPort = %3 RtcPortRange = [%4, %5] Status = %6.

Fields

Name	Description
`Tcb`	—
`RequireAddressCoalescing`	—
`LocalPort`	—
`RtcStartPort`	—
`RtcEndPort`	—
`Status`	—

Event ID 1356 — TCP: Rtc Port Range Assignment.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Rtc Port Range Assignment. Allocated = %1, Port = %2.

Fields

Name	Description
`AssignedFromRtcRange`	—
`Port`	—

Event ID 1357 — TCPIP has failed a %1 request from %4 to %6 on endpoint %2 owned by process %8 with %7 since network interface %9 is in low-power mode.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP has failed a %1 request from %4 to %6 on endpoint %2 owned by process %8 with %7 since network interface %9 is in low-power mode.

Fields

Name	Description
`RequestType`	—
`TcbOrEndpoint`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`InterfaceIndex`	—
`ProcessStartKey`	—

Event ID 1358 — IP: Interface configuration flags updated.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface configuration updated on interface %1 property %2 value %3 event %4.

Fields

Name	Description
`InterfaceIndex`	—
`Property`	—
`Value`	—
`InterfaceUpdateEvent`	—
`CompartmentId`	—
`AddressFamily`	—

Event ID 1359 — TCP: Connection %1 notification channel unmark request.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 notification channel unmark request. NcmContext = %2, TCB State = %3, PID = %4, IsLoopback = %5, IsShutdown = %6, Status = %7.

Fields

Name	Description
`Tcb`	—
`NcmContext`	—
`State`	—
`Pid`	—
`IsLoopback`	—
`IsShutdown`	—
`Status`	—

Event ID 1360 — TCPIP: A packet has been cloned for a raw listener.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: A packet has been cloned for a raw listener. NBL %2 cloned from NBL %1. Protocol = %3, Family = %4.

Fields

Name	Description
`Nbl`	—
`ClonedNbl`	—
`IPTransportProtocol`	—
`AddressFamily`	—

Event ID 1361 — TCPIP: A cloned packet has been dropped.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: A cloned packet has been dropped. NBL %2 cloned from NBL %1. Family = %3.

Fields

Name	Description
`Nbl`	—
`ClonedNbl`	—
`AddressFamily`	—

Event ID 1362 — IP: Interface = %1 IpAddress = %3 processing WolEvent = %4 with Status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface = %1 IpAddress = %3 processing WolEvent = %4 with Status = %5.

Fields

Name	Description
`Interface`	—
`IpAddrLength`	—
`IPAddress`	—
`WoLEvent`	—
`Status`	—

Event ID 1363 — IP: Interface = %1 WolHandle = %3 has DestinationIpAddress = %4 TargetIpAddress1 = %5 TargetIpAddress2 = %6 Flags = %7 while processing WolEvent = ...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface = %1 WolHandle = %3 has DestinationIpAddress = %4 TargetIpAddress1 = %5 TargetIpAddress2 = %6 Flags = %7 while processing WolEvent = %8 with Status = %9.

Fields

Name	Description
`Interface`	—
`IpAddrLength`	—
`WolHandle`	—
`DestinationIPAddress`	—
`TargetIPAddress1`	—
`TargetIPAddress2`	—
`Flags`	—
`WoLEvent`	—
`Status`	—

Event ID 1364 — TCP connection tuple inserted- TCB: %1 LocalAddress: %3 RemoteAddress: %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP connection tuple inserted- TCB: %1 LocalAddress: %3 RemoteAddress: %5

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1365 — TCP connection tuple removed- TCB/TWTCB: %1 LocalAddress: %3 RemoteAddress: %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP connection tuple removed- TCB/TWTCB: %1 LocalAddress: %3 RemoteAddress: %5

Fields

Name	Description
`Tcb`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`NewState`	—
`RexmitCount`	—

Event ID 1366 — TCP port selection deferred for outbound connect- LocalAddress.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP port selection deferred for outbound connect- LocalAddress: %2

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—

Event ID 1367 — Nbl %1 OOB info (%2): TcpIpChecksumNetBufferListInfo %3, TcpLargeSendNetBufferListInfo %4, Ieee8021QNetBufferListInfo %5, NetBufferListHashValue %6...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Nbl %1 OOB info (%2): TcpIpChecksumNetBufferListInfo %3, TcpLargeSendNetBufferListInfo %4, Ieee8021QNetBufferListInfo %5, NetBufferListHashValue %6, NetBufferListHashInfo %7, VirtualSubnetInfo %8, TcpRecvSegCoalesceInfo %9

Fields

Name	Description
`Nbl`	—
`PathDirection`	—
`TcpIpChecksumNetBufferListInfo`	—
`TcpLargeSendNetBufferListInfo`	—
`Ieee8021QNetBufferListInfo`	—
`NetBufferListHashValue`	—
`NetBufferListHashInfo`	—
`VirtualSubnetInfo`	—
`TcpRecvSegCoalesceInfo`	—
`NrtNameResolutionInfo`	—

Event ID 1368 — Teredo Add -- PID: %1 started listening on %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Teredo Add -- PID: %1 started listening on %3. AddressType %4. ScopeLevel %5. Port %6. EndpointRecord %7.

Fields

Name	Description
`PID`	—
`LocalAddressLength`	—
`LocalAddress`	—
`AddressType`	—
`ScopeLevel`	—
`Port`	—
`EndpointRecord`	—

Event ID 1369 — Teredo Remove -- PID: %1 stopped listening on %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Teredo Remove -- PID: %1 stopped listening on %3. AddressType %4. ScopeLevel %5. Port %6. EndpointRecord %7.

Fields

Name	Description
`PID`	—
`LocalAddressLength`	—
`LocalAddress`	—
`AddressType`	—
`ScopeLevel`	—
`Port`	—
`EndpointRecord`	—

Event ID 1370 — IP: RouteLookup - API: %1 DstAddr: %3 ConstrainSrcAddr: %4 ConstrainIfIndex: %5 ConstraintOveridden: %6 ReturnConstrained: %7 OutgoingIfIndex: %8 N...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: RouteLookup - API: %1 DstAddr: %3 ConstrainSrcAddr: %4 ConstrainIfIndex: %5 ConstraintOveridden: %6 ReturnConstrained: %7 OutgoingIfIndex: %8 NextHopAddr: %9 Status: %10

Fields

Name	Description
`API`	—
`IpAddrLength`	—
`DestinationAddress`	—
`ConstrainSourceAddress`	—
`ConstrainInterfaceIndex`	—
`ConstrainForwardingTag`	—
`ConstraintOverridden`	—
`ReturnConstrained`	—
`OutgoingInterfaceIndex`	—
`NextHopAddress`	—
`Status`	—

Event ID 1371 — IP: SourceAddrLookup - DstAddr: %2 ConstrainSrcAddr: %3 ConstrainIfIndex: %4 OutgoingIfIndex: %5 ReturnConstrained: %6 SelectedSrcAddr: %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: SourceAddrLookup - DstAddr: %2 ConstrainSrcAddr: %3 ConstrainIfIndex: %4 OutgoingIfIndex: %5 ReturnConstrained: %6 SelectedSrcAddr: %7

Fields

Name	Description
`IpAddrLength`	—
`DestinationAddress`	—
`ConstrainSourceAddress`	—
`ConstrainInterfaceIndex`	—
`OutgoingInterfaceIndex`	—
`ReturnConstrained`	—
`SelectedSourceAddress`	—

Event ID 1372 — WFP-ALE: Partition Count=.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: Partition Count=%1 Partition Mask=%2: Partition Id=%d Partition NumEntries = %4.

Fields

Name	Description
`PartitionCount`	—
`PartitionMask`	—
`PartitionId`	—
`NumEntries`	—

Event ID 1373 — WFP-ALE: HotAdd/Remove: Old Partiton Count=.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: HotAdd/Remove: Old Partiton Count=%1 Old Partition Mask=%2 New Partiton Count=%1 New Partition Mask=%2.

Fields

Name	Description
`OldPartitionCount`	—
`OldPartitionMask`	—
`NewPartitionCount`	—
`NewPartitionMask`	—

Event ID 1374 — WFP-ALE: RemoteEndPoint Insertion: AddrLen=.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: RemoteEndPoint Insertion: AddrLen=%1 RemoteAddr=%2 RemotePort=%3 LocalAddr=%4 LocalPort=%5 PartitionId=%6 PartitionNumEntries=%7

Fields

Name	Description
`AddressLength`	—
`RemoteAddress`	—
`RemotePort`	—
`LocalAddress`	—
`LocalPort`	—
`PartitionId`	—
`NumEntries`	—

Event ID 1375 — WFP-ALE: RemoteEndPoint Deletion: AddrLen=.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: RemoteEndPoint Deletion: AddrLen=%1 RemoteAddr=%2 RemotePort=%3 LocalAddr=%4 LocalPort=%5 PartitionId=%6 PartitionNumEntries=%7

Fields

Name	Description
`AddressLength`	—
`RemoteAddress`	—
`RemotePort`	—
`LocalAddress`	—
`LocalPort`	—
`PartitionId`	—
`NumEntries`	—

Event ID 1376 — WFP-ALE: ALE: low memory state detected.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: ALE: low memory state detected. LowMemoryEvent = %3 LowNonPagedPoolEvent = %4.

Fields

Name	Description
`HighMemoryEvent`	—
`HighNonPagedPoolEvent`	—
`LowMemoryEvent`	—
`LowNonPagedPoolEvent`	—

Event ID 1377 — WFP-ALE: leaving low memory state.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: leaving low memory state. HighMemoryEvent = %1 HighNonPagedPoolEvent = %2.

Fields

Name	Description
`HighMemoryEvent`	—
`HighNonPagedPoolEvent`	—
`LowMemoryEvent`	—
`LowNonPagedPoolEvent`	—

Event ID 1378 — WFP-ALE: Dpc for cleanup initiated: LowMemoryEvent = %3 LowNonPagedPoolEvent = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: Dpc for cleanup initiated: LowMemoryEvent = %3 LowNonPagedPoolEvent = %4.

Fields

Name	Description
`HighMemoryEvent`	—
`HighNonPagedPoolEvent`	—
`LowMemoryEvent`	—
`LowNonPagedPoolEvent`	—

Event ID 1379 — WFP: Dpc for cleanup QUEUED or RE-QUEUED: LowMemoryEvent = %3 LowNonPagedPoolEvent = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP: Dpc for cleanup QUEUED or RE-QUEUED: LowMemoryEvent = %3 LowNonPagedPoolEvent = %4.

Fields

Name	Description
`HighMemoryEvent`	—
`HighNonPagedPoolEvent`	—
`LowMemoryEvent`	—
`LowNonPagedPoolEvent`	—

Event ID 1380 — TCP: LEDBAT %2: Connection %1, BaseDelayMs = %6, CurrentDelayMs = %7, CWnd = %3, SsThresh = %4, SndWnd = %5, DelayBasedCwndFactor %9%, RemainingTim...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: LEDBAT %2: Connection %1, BaseDelayMs = %6, CurrentDelayMs = %7, CWnd = %3, SsThresh = %4, SndWnd = %5, DelayBasedCwndFactor %9%%, RemainingTimeMs = %8.

Fields

Name	Description
`Tcb`	—
`LedbatEvent`	—
`Cwnd`	—
`SsThresh`	—
`SndWnd`	—
`BaseDelayMs`	—
`CurrentDelayMs`	—
`RemainingTimeMs`	—
`DelayBasedCwndFactorPercent`	—

Event ID 1381 — TCP: AssociateNameResContext Endpoint: %1 Status: %16 NameResolutionContext: %2 DnsName: %3 InterfaceIndex: %4 IPAddrCount: %5 IPAddrs: %7 %9 %11 %...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: AssociateNameResContext Endpoint: %1 Status: %16 NameResolutionContext: %2 DnsName: %3 InterfaceIndex: %4 IPAddrCount: %5 IPAddrs: %7 %9 %11 %13 %15

Fields

Name	Description
`EndpointObj`	—
`IsConnectionObj`	—
`NameResContext`	—
`Status`	—

Event ID 1382 — TCP: InspectConnectWithNameResContext Connection: %5 (local: %2 remote: %4) NameResolutionContext: %6 DnsName: %7 Status: %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: InspectConnectWithNameResContext Connection: %5 (local: %2 remote: %4) NameResolutionContext: %6 DnsName: %7 Status: %8.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Tcb`	—
`NameResContext`	—
`DnsName`	—
`Status`	—

Event ID 1383 — IP: Route [DestinationPrefix: %6/%4 NextHop: %8 InterfaceIndex: %9 InterfaceMetric: %10 RouteMetric: %11] is preferred over Route [DestinationPrefi...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Route [DestinationPrefix: %6/%4 NextHop: %8 InterfaceIndex: %9 InterfaceMetric: %10 RouteMetric: %11] is preferred over Route [DestinationPrefix: %14/%12 NextHop: %16 InterfaceIndex: %17 InterfaceMetric: %18 RouteMetric: %19] for Destination: %3 in Compartment: %1, Reason: %20.

Fields

Name	Description
`CompartmentId`	—
`DestinationAddressLength`	—
`DestinationAddress`	—
`PrDestinationPrefixLength`	—
`PrDestinationPrefixAddressLength`	—
`PrDestinationPrefix`	—
`PrNextHopAddressLength`	—
`PrNextHopAddress`	—
`PrInterfaceIndex`	—
`PrInterfaceMetric`	—
`PrRouteMetric`	—
`NonPrDestinationPrefixLength`	—
`NonPrDestinationPrefixAddressLength`	—
`NonPrDestinationPrefix`	—
`NonPrNextHopAddressLength`	—
`NonPrNextHopAddress`	—
`NonPrInterfaceIndex`	—
`NonPrInterfaceMetric`	—
`NonPrRouteMetric`	—
`PreferenceReason`	—

Event ID 1384 — IP: Route [DestinationPrefix: %6/%4 NextHop: %8 InterfaceIndex: %9 RouteMetric: %10] is blocked for Destination: %3 ConstrainInterfaceIndex: %11 Co...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Route [DestinationPrefix: %6/%4 NextHop: %8 InterfaceIndex: %9 RouteMetric: %10] is blocked for Destination: %3 ConstrainInterfaceIndex: %11 ConstrainScopeZone: %12 in Compartment: %1, Reason: %13.

Fields

Name	Description
`CompartmentId`	—
`DestinationAddressLength`	—
`DestinationAddress`	—
`DestinationPrefixLength`	—
`DestinationPrefixAddressLength`	—
`DestinationPrefix`	—
`NextHopAddressLength`	—
`NextHopAddress`	—
`InterfaceIndex`	—
`RouteMetric`	—
`ConstrainInterfaceIndex`	—
`ConstrainScope`	—
`BlockReason`	—

Event ID 1385 — TCP: Tail Loss Probe Send Connection = %1 SndUna = %2, SndMax = %3, SendAvailable = %4, TailProbeSeq = %5, TailProbeLast = %6, ControlsToSend = %7,...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Tail Loss Probe Send Connection = %1 SndUna = %2, SndMax = %3, SendAvailable = %4, TailProbeSeq = %5, TailProbeLast = %6, ControlsToSend = %7, ThFlags = %8.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`SendAvailable`	—
`TailProbeSeq`	—
`TailProbeLast`	—
`ControlsToSend`	—
`ThFlags`	—

Event ID 1386 — TCP: Tail Loss Probe Event Connection = %1, Event = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Tail Loss Probe Event Connection = %1, Event = %2.

Fields

Name	Description
`Tcb`	—
`TlpEvent`	—

Event ID 1387 — TCP: RACK Event Connection = %1, Event = %2, MinRTT = %3, ReoWind = %4, TimeSlotDeltaMin = %5, SeqNum = %6, Timestamp = %7, RttSample = %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: RACK Event Connection = %1, Event = %2, MinRTT = %3, ReoWind = %4, TimeSlotDeltaMin = %5, SeqNum = %6, Timestamp = %7, RttSample = %8.

Fields

Name	Description
`Tcb`	—
`RackEvent`	—
`RackMinRtt`	—
`RackReoWind`	—
`RackTimeSlotDeltaMin`	—
`SequenceNumber`	—
`Timestamp`	—
`RttSample`	—

Event ID 1388 — TCP: Fastopen state changed for connection = %1 from OldState = %2 to NewState = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Fastopen state changed for connection = %1 from OldState = %2 to NewState = %3.

Fields

Name	Description
`Tcb`	—
`OldState`	—
`NewState`	—

Event ID 1389 — UDP: endpoint (family=%5 pid=%3) create failed: address family not attached.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint (family=%5 pid=%3) create failed: address family not attached.

Fields

Name	Description
`Endpoint`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1390 — UDP: endpoint %1 (family=%5 pid=%3) create failed: compartment %4 not found.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (family=%5 pid=%3) create failed: compartment %4 not found.

Fields

Name	Description
`Endpoint`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1391 — UDP: endpoint %1 (family=%5 pid=%3) created.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (family=%5 pid=%3) created.

Fields

Name	Description
`Endpoint`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1392 — UDP: endpoint %1 (family=%5 pid=%3) create failed: inspection status = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (family=%5 pid=%3) create failed: inspection status = %2

Fields

Name	Description
`Endpoint`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1393 — UDP: endpoint %4 bind failed: address %2 cannot be resolved, status = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %4 bind failed: address %2 cannot be resolved, status = %3

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`Endpoint`	—

Event ID 1394 — UDP: endpoint %4 (sockaddr=%2) bind failed: port-acquisition status = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %4 (sockaddr=%2) bind failed: port-acquisition status = %3

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`Endpoint`	—

Event ID 1395 — UDP: endpoint %4 (sockaddr=%2) bind failed: inspection status = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %4 (sockaddr=%2) bind failed: inspection status = %3

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`Endpoint`	—

Event ID 1396 — UDP: endpoint %4 (sockaddr=%2) bound.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %4 (sockaddr=%2) bound.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`Endpoint`	—
`Pid`	—
`ProcessStartKey`	—

Event ID 1397 — UDP: endpoint %4 (sockaddr=%2) closed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %4 (sockaddr=%2) closed.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`Endpoint`	—

Event ID 1398 — UDP: endpoint %4 closed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %4 closed.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`Endpoint`	—

Event ID 1399 — UDP: endpoint %1 (sockaddr=%3) send messages %5: address resolution status = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (sockaddr=%3) send messages %5: address resolution status = %6

Fields

Name	Description
`Endpoint`	—
`EndpointAddressLength`	—
`EndpointAddress`	—
`SendAddressLength`	—
`SendAddress`	—
`Status`	—

Event ID 1400 — UDP: endpoint %1 (sockaddr=%3) send messages %5: address validation failed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (sockaddr=%3) send messages %5: address validation failed.

Fields

Name	Description
`Endpoint`	—
`EndpointAddressLength`	—
`EndpointAddress`	—
`SendAddressLength`	—
`SendAddress`	—
`Status`	—

Event ID 1401 — UDP: endpoint %1 (sockaddr=%3) send messages %5: source-address selection status = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (sockaddr=%3) send messages %5: source-address selection status = %6

Fields

Name	Description
`Endpoint`	—
`EndpointAddressLength`	—
`EndpointAddress`	—
`SendAddressLength`	—
`SendAddress`	—
`Status`	—

Event ID 1402 — UDP: endpoint {Endpoint} too many packets queued for the pending join path.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint {Endpoint} too many packets queued for the pending join path.

Fields

Name	Description
`Endpoint`	—

Event ID 1403 — UDP: address family %2added to interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: address family %2added to interface %1.

Fields

Name	Description
`InterfaceIndex`	—
`AddressFamily`	—

Event ID 1404 — UDP: address family %2removed from interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: address family %2removed from interface %1.

Fields

Name	Description
`InterfaceIndex`	—
`AddressFamily`	—

Event ID 1405 — UDP: Failure initializing transport protocol, status = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Failure initializing transport protocol, status = %1

Fields

Name	Description
`Status`	—

Event ID 1406 — UDP: Failure starting NLNPI client, status = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Failure starting NLNPI client, status = %1

Fields

Name	Description
`Status`	—

Event ID 1407 — UDP: Failure initializing NSI support, status = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Failure initializing NSI support, status = %1

Fields

Name	Description
`Status`	—

Event ID 1408 — UDP: Failure starting TLNPI provider, status = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Failure starting TLNPI provider, status = %1

Fields

Name	Description
`Status`	—

Event ID 1409 — UDP: Failure initializing QoS support, status = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Failure initializing QoS support, status = %1

Fields

Name	Description
`Status`	—

Event ID 1410 — UDP: Failure starting %1, status = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Failure starting %1, status = %2

Fields

Name	Description
`FailedQueueString`	—
`Status`	—

Event ID 1411 — UDP: endpoint %1 (sockaddr=%3) send messages %5: could not allocate send context.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (sockaddr=%3) send messages %5: could not allocate send context.

Fields

Name	Description
`Endpoint`	—
`EndpointAddressLength`	—
`EndpointAddress`	—
`SendAddressLength`	—
`SendAddress`	—
`Status`	—

Event ID 1412 — UDP: endpoint %1 (sockaddr=%3) send messages %5: path af failure, status = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (sockaddr=%3) send messages %5: path af failure, status = %6

Fields

Name	Description
`Endpoint`	—
`EndpointAddressLength`	—
`EndpointAddress`	—
`SendAddressLength`	—
`SendAddress`	—
`Status`	—

Event ID 1413 — UDP: endpoint %1 (sockaddr=%3) send messages %5: path missing next hop failure.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (sockaddr=%3) send messages %5: path missing next hop failure.

Fields

Name	Description
`Endpoint`	—
`EndpointAddressLength`	—
`EndpointAddress`	—
`SendAddressLength`	—
`SendAddress`	—
`Status`	—

Event ID 1414 — UDP: endpoint %1 (sockaddr=%3) send messages %5: path next hop address failure.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1 (sockaddr=%3) send messages %5: path next hop address failure.

Fields

Name	Description
`Endpoint`	—
`EndpointAddressLength`	—
`EndpointAddress`	—
`SendAddressLength`	—
`SendAddress`	—
`Status`	—

Event ID 1415 — TCP: Early Retransmission, FACK or RACK, Connection = %1, SndUna = %2, SackIsLostSeq = %3, DupAckCount = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Early Retransmission, FACK or RACK, Connection = %1, SndUna = %2, SackIsLostSeq = %3, DupAckCount = %4

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SackIsLostSeq`	—
`DupAckCount`	—

Event ID 1416 — TCP: Ignoring fastopen SYN option due to limit on concurrent SYN_RCVD fastopen connections, Connection = %1, SynRcvdLimit = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Ignoring fastopen SYN option due to limit on concurrent SYN_RCVD fastopen connections, Connection = %1, SynRcvdLimit = %2

Fields

Name	Description
`Tcb`	—
`SynRcvdLimit`	—

Event ID 1417 — TCP: Failed to update fastopen key state, Location = %1, Status = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Failed to update fastopen key state, Location = %1, Status = %2. Server-side fastopen will be disabled

Fields

Name	Description
`Location`	—
`Status`	—

Event ID 1418 — TCP: Fast Retransmit Send, Connection = %1, BytesToSend = %2, SndNxt = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Fast Retransmit Send, Connection = %1, BytesToSend = %2, SndNxt = %3

Fields

Name	Description
`Tcb`	—
`BytesToSend`	—
`SndNxt`	—

Event ID 1419 — TCP: SACK Retransmit Send, Connection = %1, BytesToSend = %2, SndNxt = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: SACK Retransmit Send, Connection = %1, BytesToSend = %2, SndNxt = %3

Fields

Name	Description
`Tcb`	—
`BytesToSend`	—
`SndNxt`	—

Event ID 1420 — TCP: Limited Transmit Send, Connection = %1, BytesToSend = %2, SndNxt = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Limited Transmit Send, Connection = %1, BytesToSend = %2, SndNxt = %3

Fields

Name	Description
`Tcb`	—
`BytesToSend`	—
`SndNxt`	—

Event ID 1421 — TCP: SACK Retransmit Additional Send, Connection = %1, BytesToSend = %2, SndNxt = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: SACK Retransmit Additional Send, Connection = %1, BytesToSend = %2, SndNxt = %3

Fields

Name	Description
`Tcb`	—
`BytesToSend`	—
`SndNxt`	—

Event ID 1422 — %1: %2message.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

%1: %2message. Type = %3, Code = %4, CompartmentId = %5, SourceAddress = %7, DestAddress = %9

Fields

Name	Description
`IPTransportProtocol`	—
`PathDirection`	—
`IcmpType`	—
`IcmpCode`	—
`CompartmentId`	—
`SourceAddressLength`	—
`SourceAddress`	—
`DestAddressLength`	—
`DestAddress`	—

Event ID 1423 — %1: %2path drop.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

%1: %2path drop. Type = %3, Code = %4, Reason = %5, Status = %6, CompartmentId = %7, SourceAddress = %9, DestAddress = %11

Fields

Name	Description
`IPTransportProtocol`	—
`PathDirection`	—
`IcmpType`	—
`IcmpCode`	—
`DropReason`	—
`Status`	—
`CompartmentId`	—
`SourceAddressLength`	—
`SourceAddress`	—
`DestAddressLength`	—
`DestAddress`	—
`IfIndex`	—

Event ID 1424 — %1: Echo timeout.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

%1: Echo timeout. Status = %4

Fields

Name	Description
`IPTransportProtocol`	—
`PathDirection`	—
`IcmpType`	—
`IcmpCode`	—
`DropReason`	—
`Status`	—
`CompartmentId`	—
`SourceAddressLength`	—
`SourceAddress`	—
`DestAddressLength`	—
`DestAddress`	—

Event ID 1425 — %1 Timer state changed to %3 by Processor %2 Usage = %4 at Tick = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

%1 Timer state changed to %3 by Processor %2 Usage = %4 at Tick = %5

Fields

Name	Description
`Component`	—
`Processor`	—
`CurrentState`	—
`ProcessorUsage`	—
`CurrentTick`	—

Event ID 1426 — TCP: connection %1 send complete %3 bytes at %4 (%2).

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 send complete %3 bytes at %4 (%2).

Fields

Name	Description
`Tcb`	—
`Injected`	—
`NumBytes`	—
`SndNxt`	—
`ActivityID`	—

Event ID 1427 — IP: Compartment creation.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Compartment creation. Compartment = %1, Protocol = %2, Private = %3, Status = %4.

Fields

Name	Description
`CompartmentId`	—
`AddressFamily`	—
`Private`	—
`Status`	—

Event ID 1428 — IP: Compartment deletion.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Compartment deletion. Compartment = %1, Protocol = %2.

Fields

Name	Description
`CompartmentId`	—
`AddressFamily`	—
`Private`	—
`Status`	—

Event ID 1429 — TCP: connection %1: Cumulative Ack event, SeqNo = %5, BytesAcked = %4, CWnd = %2, SndWnd = %3, InRecovery = %6, TimeSinceLastLossMS = %7, CubicCwnd...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Cumulative Ack event, SeqNo = %5, BytesAcked = %4, CWnd = %2, SndWnd = %3, InRecovery = %6, TimeSinceLastLossMS = %7, CubicCwnd = %8, AimdCwnd = %9, K = %10, Wmax = %11, LastWmax = %12, MaxSndWnd = %13.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SndWnd`	—
`BytesAcked`	—
`SeqNo`	—
`InRecovery`	—
`TimeSinceLastLossMS`	—
`CubicCwnd`	—
`AimdCwnd`	—
`K`	—
`Wmax`	—
`LastWmax`	—
`MaxSndWnd`	—
`IsLimitedSlowStart`	—

Event ID 1430 — TCP: connection %1: Duplicate ACK updated cwnd = %2 and updated ssthresh = %3 DupAckCount = %4 SndUna = %5 CwrMax = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Duplicate ACK updated cwnd = %2 and updated ssthresh = %3 DupAckCount = %4 SndUna = %5 CwrMax = %6.

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`DupAckCount`	—
`SeqNo`	—
`CwrMax`	—

Event ID 1431 — IP: Compartment cleanup.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Compartment cleanup. Compartment = %1, Protocol = %2.

Fields

Name	Description
`CompartmentId`	—
`AddressFamily`	—
`Private`	—
`Status`	—

Event ID 1432 — IP: Interface network category state change.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface network category state change. Interface = %1, Compartment = %2 , Protocol = %3, NetworkCategory = %4, DomainNetworkLocation = %5, DomainType = %6, Signature = %7.

Fields

Name	Description
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`NetworkCategory`	—
`DomainNetworkLocation`	—
`DomainType`	—
`NetworkSignature`	—

Event ID 1433 — IP: Interface creation.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface creation. Interface = %1, Compartment = %2, Protocol = %3, PhysicalMediumType = %4, Status = %5.

Fields

Name	Description
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`PhysicalMediumType`	—
`Status`	—

Event ID 1434 — IP: Interface deletion.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface deletion. Interface = %1, Compartment = %2, Protocol = %3.

Fields

Name	Description
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`PhysicalMediumType`	—
`Status`	—

Event ID 1435 — IP: Interface cleanup.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface cleanup. Interface = %1, Compartment = %2, Protocol = %3.

Fields

Name	Description
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`PhysicalMediumType`	—
`Status`	—

Event ID 1436 — IP: SubInterface creation.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: SubInterface creation. SubInterface = %1, Interface = %2, Compartment = %3, Protocol = %4, Status = %5.

Fields

Name	Description
`SubIfIndex`	—
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`Status`	—

Event ID 1437 — IP: SubInterface deletion.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: SubInterface deletion. SubInterface = %1, Interface = %2, Compartment = %3, Protocol = %4.

Fields

Name	Description
`SubIfIndex`	—
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`Status`	—

Event ID 1438 — IP: SubInterface cleanup.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: SubInterface cleanup. SubInterface = %1, Interface = %2, Compartment = %3, Protocol = %4.

Fields

Name	Description
`SubIfIndex`	—
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`Status`	—

Event ID 1439 — IP: Interface change Notification.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface change Notification. Interface = %1, Compartment = %2, Protocol = %3, Reason = %4.

Fields

Name	Description
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`Reason`	—
`State`	—
`NotificationType`	—

Event ID 1440 — IP: Interface internet connectivity status change.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Interface internet connectivity status change. Interface = %1, Compartment = %2, Protocol = %3, OldConnectivityStatus = %4, NewConnectivityStatus = %5.

Fields

Name	Description
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`OldConnectivityStatus`	—
`NewConnectivityStatus`	—

Event ID 1441 — IP: Address change notification.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Address change notification. Address = %2, Interface = %3, Compartment = %4, Protocol = %5, Reason = %6.

Fields

Name	Description
`SourceAddressLength`	—
`SourceAddress`	—
`IfIndex`	—
`CompartmentId`	—
`Protocol`	—
`Reason`	—
`State`	—
`NotificationType`	—
`DadState`	—

Event ID 1442 — IP: Route change notification.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Route change notification. DestinationPrefix = %2/%5, NextHop = %4, Interface = %7, Compartment = %6, NotifyFlags = %8.

Fields

Name	Description
`DestinationPrefixAddressLength`	—
`DestinationPrefix`	—
`NextHopAddressLength`	—
`NextHopAddress`	—
`DestinationPrefixLength`	—
`CompartmentId`	—
`IfIndex`	—
`NotifyFlags`	—
`State`	—
`NotificationType`	—

Event ID 1443 — IP: Neighbor change notification.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Neighbor change notification. IpAddress = %2, DlAddress = %4, Interface = %5, Compartment = %6, State = %7, Reason = %8.

Fields

Name	Description
`IpAddrLength`	—
`IPAddress`	—
`DlAddrLength`	—
`DLAddress`	—
`IfIndex`	—
`CompartmentId`	—
`NeighborState`	—
`Reason`	—
`NotificationState`	—
`NotificationType`	—

Event ID 1444 — IP: Address DAD state change.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Address DAD state change. Address = %2, Interface = %3, Compartment = %4, OldState = %5, NewState = %6, Reason = %7.

Fields

Name	Description
`SourceAddressLength`	—
`SourceAddress`	—
`IfIndex`	—
`CompartmentId`	—
`OldDadState`	—
`NewDadState`	—
`Reason`	—

Event ID 1445 — IP: Route Dead Gateway Detection state change.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Route Dead Gateway Detection state change. DestinationPrefix = %2/%5, NextHop = %4, Interface = %7, Compartment = %6, OldState = %8, NewState = %9, OldProbeCount = %10, NewProbeCount = %11, OldUnreachablePaths = %12, NewUnreachablePaths = %13, OldMovedPaths = %14, NewMovedPaths = %15, TotalPaths = %16, OldStateChangeTick = %17, NewStateChangeTick = %18, DgdNeedsReset = %19, Reason = %20.

Fields

Name	Description
`DestinationPrefixAddressLength`	—
`DestinationPrefix`	—
`NextHopAddressLength`	—
`NextHopAddress`	—
`DestinationPrefixLength`	—
`CompartmentId`	—
`IfIndex`	—
`OldState`	—
`NewState`	—
`OldProbeCount`	—
`NewProbeCount`	—
`OldUnreachablePaths`	—
`NewUnreachablePaths`	—
`OldMovedPaths`	—
`NewMovedPaths`	—
`TotalPaths`	—
`OldStateChangeTick`	—
`NewStateChangeTick`	—
`DgdNeedsReset`	—
`Reason`	—

Event ID 1446 — IP: Disconnecting TCP connections with Address = %2, Interface = %3, Compartment = %4, SkipLocal = %5, SkipOnLink = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Disconnecting TCP connections with Address = %2, Interface = %3, Compartment = %4, SkipLocal = %5, SkipOnLink = %6.

Fields

Name	Description
`AddressLength`	—
`Address`	—
`IfIndex`	—
`CompartmentId`	—
`SkipLocal`	—
`SkipOnLink`	—

Event ID 1447 — TCP: connection %1: Sending paced chunk of %6 bytes with CWnd = %2, SndWnd = %3, BytesAvailable = %4, BytesOutstanding = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: Sending paced chunk of %6 bytes with CWnd = %2, SndWnd = %3, BytesAvailable = %4, BytesOutstanding = %5

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SndWnd`	—
`BytesAvailable`	—
`BytesOutstanding`	—
`QuantizedAllowance`	—
`Allowance`	—
`OriginalBytesToSend`	—

Event ID 1448 — Fallback: Context = %1, Feature = %2, TraceReason = %3, Confidence = %4, Successes = %5, Failures = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Fallback: Context = %1, Feature = %2, TraceReason = %3, Confidence = %4, Successes = %5, Failures = %6

Fields

Name	Description
`Fallback`	—
`Feature`	—
`Reason`	—
`Confidence`	—
`Successes`	—
`Failures`	—

Event ID 1449 — TCPIP: TCB %1 using fast loopback.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: TCB %1 using fast loopback

Fields

Name	Description
`Tcb`	—

Event ID 1450 — IP: Router information change notification.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Router information change notification. Interface = %1, Compartment = %2, Protocol = %3, Reason = %4.

Fields

Name	Description
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`Reason`	—

Event ID 1451 — IP.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: %1. Interface = %2, Compartment = %3, RouterAddress = %5, DNS Server/Suffix: %7 %8, Lifetime = %9.

Fields

Name	Description
`Event`	—
`Interface`	—
`CompartmentId`	—
`RouterAddrLength`	—
`RouterAddress`	—
`DnsAddrLength`	—
`DNSServerAddress`	—
`DNSSuffix`	—
`Lifetime`	—

Event ID 1452 — IP: Route rundown.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Route rundown. Interface = %1, Compartment = %2, Prefix = %4/%5, NextHop = %7, Metric = %8, State = %9, Origin = %10, Age = %11, ValidLifetime = %12, PreferredLifetime = %13, Flags = %14.

Fields

Name	Description
`Interface`	—
`Compartment`	—
`DestinationPrefixAddressLength`	—
`DestinationPrefix`	—
`DestinationPrefixLength`	—
`NextHopAddressLength`	—
`NextHopAddress`	—
`Metric`	—
`State`	—
`Origin`	—
`Age`	—
`ValidLifetime`	—
`PreferredLifetime`	—
`Flags`	—

Event ID 1453 — TCP: CUBIC ECN event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CUBIC ECN event. Connection %1, CWnd %2, SSThresh = %3, SndUna = %4

Fields

Name	Description
`Tcb`	—
`Cwnd`	—
`SSThresh`	—
`SndUna`	—

Event ID 1454 — INETINSPECT: Owner = %1, InspectHandle = %2, InspectType = %3, Action = %4, Status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

INETINSPECT: Owner = %1, InspectHandle = %2, InspectType = %3, Action = %4, Status = %5

Fields

Name	Description
`Owner`	—
`InspectHandle`	—
`InspectType`	—
`InspectAction`	—
`Status`	—

Event ID 1455 — INETINSPECT: Owner = %1, InspectHandle = %2, InspectType = %3, Action = %4, Status = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

INETINSPECT: Owner = %1, InspectHandle = %2, InspectType = %3, Action = %4, Status = %5

Fields

Name	Description
`Owner`	—
`InspectHandle`	—
`InspectType`	—
`InspectPort`	—
`Status`	—

Event ID 1456 — FallbackCheck: Ctx = %1, Feature = %2, Failed = %3, Succeeeded = %4, InProbe = %5, PathsProbed = %6, Status = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FallbackCheck: Ctx = %1, Feature = %2, Failed = %3, Succeeeded = %4, InProbe = %5, PathsProbed = %6, Status = %7

Fields

Name	Description
`Fallback`	—
`Feature`	—
`Failed`	—
`Succeeded`	—
`InProbe`	—
`PathsProbed`	—
`Status`	—

Event ID 1457 — FallbackUpdate: Ctx = %1, Feature = %2, Failed = %3, Succeeeded = %4, InProbe = %5, PathsProbed = %6, Status = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FallbackUpdate: Ctx = %1, Feature = %2, Failed = %3, Succeeeded = %4, InProbe = %5, PathsProbed = %6, Status = %7

Fields

Name	Description
`Fallback`	—
`Feature`	—
`Failed`	—
`Succeeded`	—
`InProbe`	—
`PathsProbed`	—
`Status`	—

Event ID 1458 — Fallback: Permanently disabling feature, Ctx = %1, Feature = %2, PathsProbed = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Fallback: Permanently disabling feature, Ctx = %1, Feature = %2, PathsProbed = %6

Fields

Name	Description
`Fallback`	—
`Feature`	—
`Failed`	—
`Succeeded`	—
`InProbe`	—
`PathsProbed`	—
`Status`	—

Event ID 1459 — Fallback: Enabling feature for this boot session, Ctx = %1, Feature = %2, PathsProbed = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Fallback: Enabling feature for this boot session, Ctx = %1, Feature = %2, PathsProbed = %6

Fields

Name	Description
`Fallback`	—
`Feature`	—
`Failed`	—
`Succeeded`	—
`InProbe`	—
`PathsProbed`	—
`Status`	—

Event ID 1460 — Fallback: Feature previously disabled, Ctx = %1, Feature = %2, PathsProbed = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Fallback: Feature previously disabled, Ctx = %1, Feature = %2, PathsProbed = %6

Fields

Name	Description
`Fallback`	—
`Feature`	—
`Failed`	—
`Succeeded`	—
`InProbe`	—
`PathsProbed`	—
`Status`	—

Event ID 1461 — TCP Fastopen fallback update: Tcb = %1, FastopenState = %2, DataBytesIn = %3, ShutdownStatus = %4, ProbeStatus = %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP Fastopen fallback update: Tcb = %1, FastopenState = %2, DataBytesIn = %3, ShutdownStatus = %4, ProbeStatus = %5

Fields

Name	Description
`Tcb`	—
`FastopenState`	—
`DataBytesIn`	—
`ShutdownStatus`	—
`ProbeStatus`	—

Event ID 1462 — Disabling feature until connectivity is established: CompartmentId =.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Disabling feature until connectivity is established: CompartmentId =%1, IfIndex = %2, Feature = %3, ConnectivityStatus = %4

Fields

Name	Description
`CompartmentId`	—
`IfIndex`	—
`Feature`	—
`ConnectivityStatus`	—

Event ID 1463 — Disabling %1 for loopback connection.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Disabling %1 for loopback connection

Fields

Name	Description
`Feature`	—

Event ID 1464 — Disabling TCP Fastopen for BaseEndpoint = %1 because an incompatible WFP callout is installed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Disabling TCP Fastopen for BaseEndpoint = %1 because an incompatible WFP callout is installed

Fields

Name	Description
`BaseEndpoint`	—

Event ID 1465 — IP: Setting source constraint for route lookup - Compartment: %1 DstAddr: %3 ConstrainSrcAddr: %5 ConstrainIfIndex: %6 ConstraintFlags: %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Setting source constraint for route lookup - Compartment: %1 DstAddr: %3 ConstrainSrcAddr: %5 ConstrainIfIndex: %6 ConstraintFlags: %7

Fields

Name	Description
`Compartment`	—
`DestinationAddrLength`	—
`DestinationAddress`	—
`ConstrainSourceAddrLength`	—
`ConstrainSourceAddress`	—
`ConstrainInterfaceIndex`	—
`ConstraintFlags`	—
`TransportProtocol`	—
`IcmpType`	—
`IcmpCode`	—

Event ID 1466 — WFP-ALE: RemoteEndPoint Insertion: (local=%2 remote=%3) PartitionId=%4 PartitionNumEntries=%5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: RemoteEndPoint Insertion: (local=%2 remote=%3) PartitionId=%4 PartitionNumEntries=%5

Fields

Name	Description
`AddressLength`	—
`LocalAddress`	—
`RemoteAddress`	—
`PartitionId`	—
`NumEntries`	—

Event ID 1467 — WFP-ALE: RemoteEndPoint Deletion: (local=%2 remote=%3) PartitionId=%4 PartitionNumEntries=%5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: RemoteEndPoint Deletion: (local=%2 remote=%3) PartitionId=%4 PartitionNumEntries=%5

Fields

Name	Description
`AddressLength`	—
`LocalAddress`	—
`RemoteAddress`	—
`PartitionId`	—
`NumEntries`	—

Event ID 1468 — TCP: connection %8 (local=%2 remote=%4) system abort.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4) system abort. PID = %6.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—
`Reason`	—

Event ID 1469 — Disabling %1 due to no next hop.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Disabling %1 due to no next hop

Fields

Name	Description
`Feature`	—

Event ID 1470 — TCP: endpoint (sockaddr=%2) bind failed: wake status = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (sockaddr=%2) bind failed: wake status = %3.

Fields

Name	Description
`Endpoint`	—
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—

Event ID 1471 — UDP: endpoint %4 (sockaddr=%2) bind failed: wake status = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %4 (sockaddr=%2) bind failed: wake status = %3

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`Endpoint`	—

Event ID 1472 — Acquire wake port %2, type=%1, family=%3, IF=%4, compartment=%5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Acquire wake port %2, type=%1, family=%3, IF=%4, compartment=%5

Fields

Name	Description
`AcquireType`	—
`Port`	—
`AddressFamily`	—
`Interface`	—
`Compartment`	—

Event ID 1473 — TCP: Connection %1 reached max SACK queue length.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 reached max SACK queue length

Fields

Name	Description
`Tcb`	—
`Location`	—

Event ID 1474 — TCP: Connection %1 requested fast open.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 requested fast open

Fields

Name	Description
`Tcb`	—

Event ID 1475 — TCP: CUBIC Hystart state change event.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: CUBIC Hystart state change event. Connection %1, State %2, CWnd %3, SSThresh = %4.

Fields

Name	Description
`Tcb`	—
`State`	—
`Cwnd`	—
`SSThresh`	—

Event ID 1476 — IP: Transmitting loopback Nbl %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Transmitting loopback Nbl %1. Interface=%2, Compartment=%3, Src=%6, Dst=%5, Proto=%7.

Fields

Name	Description
`Nbl`	—
`Interface`	—
`Compartment`	—
`AddressLength`	—
`DestinationAddress`	—
`SourceAddress`	—
`IPTransportProtocol`	—

Event ID 1477 — TCP: Connection %1 Summary: DataBytesOut %2 DataBytesIn %3 DataSegmentsOut %4 DataSegmentsIn %5 SegmentsOut %6 SegmentsIn %7 NonRecovDa \ %8 NonRec...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 Summary: DataBytesOut %2 DataBytesIn %3 DataSegmentsOut %4 DataSegmentsIn %5 SegmentsOut %6 SegmentsIn %7 NonRecovDa \   %8 NonRecovDaEpisodes %9 DupAcksIn %10 BytesRetrans %11 Timeouts %12 SpuriousRtoDetections %13 FastRetran %14 MaxSsthresh %15 MaxSsCwnd %16 \   MaxCaCwnd %17 SndLimTransRwin %18 SndLimTimeRwin %19 SndLimBytesRwin %20 SndLimTransCwnd %21 SndLimTimeCwnd %22 SndLimBytesCwnd %23 \   SndLimTransSnd %24 SndLimTimeSnd %25 SndLimBytesSnd %26 ConnectionTimeMs %27 Timestamps %28 RttUs %29 MinRtt %30 MaxRtt %31 SynRetrans %32 CongestionAlgorithm %33 \   State %34 Local %36 Remote %38 CWnd %39 SsThresh %40 RcvWnd %41 RcvBuf %42 SndWnd %43.

Fields

Name	Description
`Tcb`	—
`DataBytesOut`	—
`DataBytesIn`	—
`DataSegmentsOut`	—
`DataSegmentsIn`	—
`SegmentsOut`	—
`SegmentsIn`	—
`NonRecovDa`	—
`NonRecovDaEpisodes`	—
`DupAcksIn`	—
`BytesRetrans`	—
`Timeouts`	—
`SpuriousRtoDetections`	—
`FastRetran`	—
`MaxSsthresh`	—
`MaxSsCwnd`	—
`MaxCaCwnd`	—
`SndLimTransRwin`	—
`SndLimTimeRwin`	—
`SndLimBytesRwin`	—
`SndLimTransCwnd`	—
`SndLimTimeCwnd`	—
`SndLimBytesCwnd`	—
`SndLimTransSnd`	—
`SndLimTimeRSnd`	—
`SndLimBytesRSnd`	—
`ConnectionTimeMs`	—
`TimestampsEnabled`	—
`RttUs`	—
`MinRttUs`	—
`MaxRttUs`	—
`SynRetrans`	—
`CongestionAlgorithm`	—
`State`	—
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`CWnd`	—
`SsThresh`	—
`RcvWnd`	—
`RcvBuf`	—
`SndWnd`	—
`InterfaceIndex`	—
`LocalPort`	—
`IsLoopback`	—

Event ID 1478 — TCPIP: Framing layer %1 (AddressFamily=%2) dropped %4 packet(s) on interface=%3, Reason=%5, Data=%6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Framing layer %1 (AddressFamily=%2) dropped %4 packet(s) on interface=%3, Reason=%5, Data=%6.

Fields

Name	Description
`PathDirection`	—
`AddressFamily`	—
`Interface`	—
`PacketCount`	—
`Reason`	—
`Data`	—

Event ID 1479 — TCP: Connection %1 Transport (Protocol %2, AddressFamily = %3) sent RST with Local = %5, Remote = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 Transport (Protocol %2, AddressFamily = %3) sent RST with Local = %5, Remote = %7. Reason = %8.

Fields

Name	Description
`Tcb`	—
`IPTransportProtocol`	—
`AddressFamily`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`RemoteSockAddrLength`	—
`RemoteSockAddr`	—
`Reason`	—

Event ID 1480 — TCP connection failed with Status = %1, Local = %3, Remote = %5, ProcessId = %6, TcpState = %7 at %8:%9:%10 Reason = %11.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP connection failed with Status = %1, Local = %3, Remote = %5, ProcessId = %6, TcpState = %7 at %8:%9:%10 Reason = %11.

Fields

Name	Description
`Status`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`RemoteSockAddrLength`	—
`RemoteSockAddr`	—
`TcpState`	—
`ProcessId`	—
`Hour`	—
`Minute`	—
`Second`	—
`Reason`	—
`ProcessStartKey`	—

Event ID 1481 — TCP: Connection %1 PRR send SackIsLostSeq %2 SackInFlight %3 SackBytes %4 SackIsLost %5 SsThresh %6 RecoveryFS %7 AckedData %8 BytesInFlight %9 Byt...

Provider: Microsoft-Windows-TCPIP
Channel: Operational

Message

TCP: Connection %1 PRR send SackIsLostSeq %2 SackInFlight %3 SackBytes %4 SackIsLost %5 SsThresh %6 RecoveryFS %7 AckedData %8 BytesInFlight %9 BytesToSend %10 PrrDelivered %11 PrrOut %12.

Fields

Name	Description
`Tcb`	—
`SackIsLostSeq`	—
`SackInFlight`	—
`SackBytes`	—
`SackIsLost`	—
`SsThresh`	—
`HeadSeq`	—
`AckedData`	—
`BytesInFlight`	—
`BytesToSend`	—
`PrrDelivered`	—
`PrrOut`	—

Event ID 1482 — UDP: Endpoint %1 segment message.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Endpoint %1 segment message. SegmentSize = %2 (0 == No Segmentation) MessageLength = %3 HwDatagrams = %4 HwSegments = %5 SwSegments = %6 Status = %7.

Fields

Name	Description
`Endpoint`	—
`SegmentSize`	—
`MessageLength`	—
`HwDatagrams`	—
`HwSegments`	—
`SwSegments`	—
`SubMssSegments`	—
`Status`	—

Event ID 1483 — UDP: Endpoint %1 segmentation offload unavailable.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Endpoint %1 segmentation offload unavailable. Reason = %2 SegmentSize = %3 LocalAddress = %5, RemoteAddress = %7.

Fields

Name	Description
`Endpoint`	—
`FailureReason`	—
`SegmentSize`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`RemoteSockAddrLength`	—
`RemoteSockAddr`	—

Event ID 1484 — TCPIP: Framing layer interface %1 (AddressFamily = %2) failed to bind to its provider.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Framing layer interface %1 (AddressFamily = %2) failed to bind to its provider. Code = %3. Status = %4.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`FailureCode`	—
`Status`	—

Event ID 1485 — TCPIP: OID request from framing layer interface %1 (AddressFamily = %2) failed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: OID request from framing layer interface %1 (AddressFamily = %2) failed. OID = %3. Status = %4.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`OID`	—
`Status`	—

Event ID 1486 — TCPIP received a status indication on interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP received a status indication on interface %1. AddressFamily = %2. NdisStatus = %3.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`NdisStatus`	—

Event ID 1487 — IP: Failed to set socket option.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Failed to set socket option. Level = %1. Option = %2. Status = %3.

Fields

Name	Description
`SocketOptionLevel`	—
`SocketOptionValue`	—
`Status`	—

Event ID 1488 — IP: Failed to set socket IOCTL.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Failed to set socket IOCTL. IOCTL = %1. Status = %2.

Fields

Name	Description
`SocketIoctl`	—
`Status`	—

Event ID 1489 — Failed to process multicast %1 request.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Failed to process multicast %1 request. Address = %2 %6. Source Address = %3 %7. Reason = %8. Status = %9.

Fields

Name	Description
`RequestType`	—
`IPv4Address`	—
`IPv4SourceAddress`	—
`IpAddrLength`	—
`IpSourceAddrLength`	—
`IPv6Address`	—
`IPv6SourceAddress`	—
`FailureReason`	—
`Status`	—

Event ID 1490 — Processed multicast %1 request successfully.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Processed multicast %1 request successfully. Address = %2 %6. Source Address = %3 %7.

Fields

Name	Description
`RequestType`	—
`IPv4Address`	—
`IPv4SourceAddress`	—
`IpAddrLength`	—
`IpSourceAddrLength`	—
`IPv6Address`	—
`IPv6SourceAddress`	—

Event ID 1491 — %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

%1. Interface = %2. Address = %3 %5. Data = %6.

Fields

Name	Description
`MessageType`	—
`IfIndex`	—
`IPv4Address`	—
`IpAddrLength`	—
`IPv6Address`	—
`Data`	—

Event ID 1492 — %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

%1. Interface = %2. Address = %3 %5. Data = %6. Status = %7.

Fields

Name	Description
`MessageType`	—
`IfIndex`	—
`IPv4Address`	—
`IpAddrLength`	—
`IPv6Address`	—
`Data`	—
`Status`	—

Event ID 1493 — Invalid ECN codepoints in reassembly.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Invalid ECN codepoints in reassembly. Ce = %1. Ect0 = %2. Ect1 = %3. NotEct = %4.

Fields

Name	Description
`Ce`	—
`Ect0`	—
`Ect1`	—
`NotEct`	—

Event ID 1494 — Reassembly failure: packets do not add up correctly.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Reassembly failure: packets do not add up correctly.  Interface = %1. Address family = %2.

Fields

Name	Description
`InterfaceIndex`	—
`AddressFamily`	—

Event ID 1495 — Reassembly failure: failed to restore IPSec packet history.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Reassembly failure: failed to restore IPSec packet history.  Interface = %1. Address family = %2. Status = %3.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`Status`	—

Event ID 1496 — Could not transfer %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Could not transfer %1.  Interface = %2. Address family = %3.

Fields

Name	Description
`FragmentContextDirection`	—
`IfIndex`	—
`AddressFamily`	—

Event ID 1497 — Attempting to %1 the multicast group at FL.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Attempting to %1 the multicast group at FL.  Interface = %2. Address = %3 %5. Data = %6. Status = %7.

Fields

Name	Description
`GroupChangeType`	—
`IfIndex`	—
`IPv4Address`	—
`IpAddrLength`	—
`IPv6Address`	—
`Data`	—
`Status`	—

Event ID 1498 — Failed to update address list at FL.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Failed to update address list at FL. Interface = %1. Address Family = %2. Status = %3.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`Status`	—

Event ID 1499 — Too many DAD failures, so will not create temporary address.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Too many DAD failures, so will not create temporary address. Interface = %1. Address = %2 %4.

Fields

Name	Description
`IfIndex`	—
`IPv4Address`	—
`IpAddrLength`	—
`IPv6Address`	—

Event ID 1500 — Failed to address interface; deleting it.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Failed to address interface; deleting it. Interface = %1. Status = %2.

Fields

Name	Description
`IfIndex`	—
`Status`	—

Event ID 1501 — Failed to reach default gateway after reconnect; cleaning settings.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Failed to reach default gateway after reconnect; cleaning settings.  Interface = %1.

Fields

Name	Description
`IfIndex`	—

Event ID 1502 — Failed to sync interface with registry.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Failed to sync interface with registry.  Interface = %1. Field = %2. Status = %3.

Fields

Name	Description
`IfIndex`	—
`Field`	—
`Status`	—

Event ID 1503 — Failed to %1 an active reference on the interface.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Failed to %1 an active reference on the interface.  Interface = %2. Reference Reason = %3. Status = %4.

Fields

Name	Description
`Release`	—
`IfIndex`	—
`Subtask`	—
`Status`	—

Event ID 1504 — Redirect path hijack for destination %2 %3 from %5 %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Redirect path hijack for destination %2 %3 from %5 %6. Interface = %1.

Fields

Name	Description
`IfIndex`	—
`IPv4DestinationAddress`	—
`IPv4NextHop`	—
`IpAddrLength`	—
`IPv6DestinationAddress`	—
`IPv6NextHop`	—

Event ID 1505 — Redirect path rate limit for IPv6 source address %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Redirect path rate limit for IPv6 source address %3. Interface = %1.

Fields

Name	Description
`IfIndex`	—
`IpAddrLength`	—
`IPv6Address`	—

Event ID 1506 — Dropped %2 fragment.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Dropped %2 fragment. Interface = %3. Reason = %1.

Fields

Name	Description
`Release`	—
`AddressFamily`	—
`IfIndex`	—

Event ID 1507 — Reassembly timeout.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Reassembly timeout. Interface = %1. Id = %2. Source Address = %3 %6.  Destination Address = %4 %7.

Fields

Name	Description
`IfIndex`	—
`ReassemblyId`	—
`IPv4SourceAddress`	—
`IPv4DestinationAddress`	—
`IpAddrLength`	—
`IPv6SourceAddress`	—
`IPv6DestinationAddress`	—

Event ID 1508 — Invalid IP option.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Invalid IP option. Option = %3. Level = %2. Reason = %1.

Fields

Name	Description
`Reason`	—
`SocketLevel`	—
`SocketOption`	—

Event ID 1509 — Invalid IP hop-by-hop option.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Invalid IP hop-by-hop option.  Option = %2. Reason = %1.

Fields

Name	Description
`Reason`	—
`Option`	—

Event ID 1510 — Invalid IP hop-by-hop option.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Invalid IP hop-by-hop option.  Option = %2. Reason = %1.

Fields

Name	Description
`Reason`	—
`Option`	—

Event ID 1511 — Invalid IP routing header option.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Invalid IP routing header option. Reason = %1.

Fields

Name	Description
`Reason`	—

Event ID 1512 — Invalid IP routing header option.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Invalid IP routing header option. Reason = %1.

Fields

Name	Description
`Reason`	—

Event ID 1513 — This option cannot be specified by the user

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

This option cannot be specified by the user

Fields

Name	Description
`Reason`	—

Event ID 1514 — TCP: interface %1: received potential RSC status indication.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: interface %1: received potential RSC status indication. Current IPv4 State = %2, Offload IPv4 State = %3, Current IPv6 State = %4, Offload IPv6 State = %5.

Fields

Name	Description
`IfIndex`	—
`TcpRscEnabledIpv4`	—
`OffloadRscEnabledIpv4`	—
`TcpRscEnabledIpv6`	—
`OffloadRscEnabledIpv6`	—

Event ID 1515 — UDP: endpoint %1: URO SCU received.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %1: URO SCU received. SegCount = %2, SegSize = %3, DataLength = %4.

Fields

Name	Description
`Endpoint`	—
`SegCount`	—
`SegSize`	—
`DataLength`	—

Event ID 1516 — TCP software RSC global disabled mask = %1, UDP software URO global disabled mask = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP software RSC global disabled mask = %1, UDP software URO global disabled mask = %2.

Fields

Name	Description
`TcpRscDisabledMask`	—
`UdpUroDisabledMask`	—

Event ID 1517 — UDP: Global parameters updated for Address Family %1: DisableUro = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: Global parameters updated for Address Family %1: DisableUro = %2.

Fields

Name	Description
`AddressFamily`	—
`DisableUro`	—
`DisableUso`	—

Event ID 1518 — IP: IPSNPI client rundown.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: IPSNPI client rundown. %3 Interface = %1, Compartment = %2, Client = %4.

Fields

Name	Description
`IfIndex`	—
`CompartmentId`	—
`AddressFamily`	—
`ClientName`	—

Event ID 1519 — TCPIP: Process with PID=.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Process with PID=%1, ProcessSeqNum=%7 acquired port tracker reservation of type %3, Protocol %4 for %6 ports starting at %5 with status = %2.

Fields

Name	Description
`ProcessId`	—
`Status`	—
`ReservationType`	—
`IPTransportProtocol`	—
`StartPort`	—
`NumberOfPorts`	—
`ProcessSequenceNumber`	—

Event ID 1520 — Illegal tunnel.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Illegal tunnel. Interface: %1, Tunnel type: %2. Reason: %3.

Fields

Name	Description
`IfIndex`	—
`TunnelType`	—
`Reason`	—

Event ID 1521 — Framing: Interface change in progress.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: Interface change in progress. Interface: %1. Address Family: %2. Current progress: %3. Status: %4.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`CurrentProgress`	—
`NtStatus`	—

Event ID 1522 — Framing: Isolation is not supported on this network adapter.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: Isolation is not supported on this network adapter. Interface: %1. Address Family: %2. Reason: %3.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`Reason`	—

Event ID 1523 — Framing: Failed to set pattern.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: Failed to set pattern. Interface: %1. Address Family: %2. Pattern type: %3. Status: %4.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`FailureType`	—
`NtStatus`	—

Event ID 1524 — Framing: Interface management request.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: Interface management request. Interface: %1. Address Family: %2. Request code: %3. Status: %4.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`FlicCode`	—
`NtStatus`	—

Event ID 1525 — Framing: WOL capabilities update in progress.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: WOL capabilities update in progress. Interface: %1. Address Family: %2. Current progress: %3. Status: %4.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`CurrentProgress`	—
`NtStatus`	—

Event ID 1526 — Framing: A PNP event has been indicated.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: A PNP event has been indicated. Interface: %1. Address Family: %2. Compartment: %3. Event: %4. Data: %5.

Fields

Name	Description
`IfIndex`	—
`AddressFamily`	—
`Compartment`	—
`Event`	—
`Data`	—

Event ID 1527 — Framing: interface rundown: Interface = %1, Luid = %2, Address family = %3, Compartment = %4, Isolation mode = %5, Isolation ID = %6, DL address = ...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: interface rundown: Interface = %1, Luid = %2, Address family = %3, Compartment = %4, Isolation mode = %5, Isolation ID = %6, DL address = %8, Interface type = %9, Physical medium type = %10, SW RSC/URO applicable = %11, SW RSC enabled = %12, Alias = %13.

Fields

Name	Description
`IfIndex`	—
`IfLuid`	—
`AddressFamily`	—
`Compartment`	—
`IsolationMode`	—
`IsolalationId`	—
`DlAddrLength`	—
`DLAddress`	—
`InterfaceType`	—
`PhysicalMediumType`	—
`SwRscUroApplicable`	—
`SwRscEnabled`	—
`IfAlias`	—
`SwUroEnabled`	—

Event ID 1528 — RAW: endpoint %1 (Proto = %2, LocalAddress = %6, RemoteAddress = %8) sending %3 messages and a total of %4 bytes.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RAW: endpoint %1 (Proto = %2, LocalAddress = %6, RemoteAddress = %8) sending %3 messages and a total of %4 bytes.

Fields

Name	Description
`Endpoint`	—
`IPTransportProtocol`	—
`NumMessages`	—
`NumBytes`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`RemoteSockAddrLength`	—
`RemoteSockAddr`	—

Event ID 1529 — RAW: endpoint %1 (Proto = %2, LocalAddress = %6, RemoteAddress = %8) delivering %4 bytes.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RAW: endpoint %1 (Proto = %2, LocalAddress = %6, RemoteAddress = %8) delivering %4 bytes.

Fields

Name	Description
`Endpoint`	—
`IPTransportProtocol`	—
`NumMessages`	—
`NumBytes`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`RemoteSockAddrLength`	—
`RemoteSockAddr`	—

Event ID 1530 — RAW: endpoint %1 (Proto = %2, LocalAddress = %4, RemoteAddress = %6) send failed with reason = %7 status = %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RAW: endpoint %1 (Proto = %2, LocalAddress = %4, RemoteAddress = %6) send failed with reason = %7 status = %8.

Fields

Name	Description
`Endpoint`	—
`IPTransportProtocol`	—
`EndpointAddressLength`	—
`EndpointAddress`	—
`SendAddressLength`	—
`SendAddress`	—
`Reason`	—
`Status`	—

Event ID 1531 — RAW: endpoint %1 (Family = %2, Proto = %3, Compartment = %4, PID = %5, ProcessSeqNum = %6) created.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RAW: endpoint %1 (Family = %2, Proto = %3, Compartment = %4, PID = %5, ProcessSeqNum = %6) created.

Fields

Name	Description
`Endpoint`	—
`AddressFamily`	—
`IPTransportProtocol`	—
`Compartment`	—
`ProcessId`	—
`ProcessSequenceNumber`	—
`Reason`	—
`Status`	—

Event ID 1532 — RAW: endpoint (Family = %2, Proto = %3, Compartment = %4, PID = %5, ProcessSeqNum = %6) create failed with reason %7 status %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RAW: endpoint (Family = %2, Proto = %3, Compartment = %4, PID = %5, ProcessSeqNum = %6) create failed with reason %7 status %8.

Fields

Name	Description
`Endpoint`	—
`AddressFamily`	—
`IPTransportProtocol`	—
`Compartment`	—
`ProcessId`	—
`ProcessSequenceNumber`	—
`Reason`	—
`Status`	—

Event ID 1533 — RAW: endpoint %1 (Proto = %2, LocalAddress = %4) bound.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RAW: endpoint %1 (Proto = %2, LocalAddress = %4) bound.

Fields

Name	Description
`Endpoint`	—
`IPTransportProtocol`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`Reason`	—
`Status`	—

Event ID 1534 — RAW: endpoint %1 (Proto = %2, LocalAddress = %4) bind failed with reason %5 status %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RAW: endpoint %1 (Proto = %2, LocalAddress = %4) bind failed with reason %5 status %6.

Fields

Name	Description
`Endpoint`	—
`IPTransportProtocol`	—
`LocalSockAddrLength`	—
`LocalSockAddr`	—
`Reason`	—
`Status`	—

Event ID 1535 — RAW: endpoint %1 closed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

RAW: endpoint %1 closed.

Fields

Name	Description
`Endpoint`	—

Event ID 1536 — TCPIP: Error processing router advertisement on interface index %1 - Preferred lifetime of %2 should not be greater than the valid lifetime of %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Error processing router advertisement on interface index %1 - Preferred lifetime of %2 should not be greater than the valid lifetime of %3.

Fields

Name	Description
`IfIndex`	—
`PreferredLifetime`	—
`ValidLifetime`	—

Event ID 1537 — TCPIP: Error processing router advertisement on interface index %1 - Prefix length of %2 and identifier of %3 must add up to the size of an IPv6 ad...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Error processing router advertisement on interface index %1 - Prefix length of %2 and identifier of %3 must add up to the size of an IPv6 address (128 bits).

Fields

Name	Description
`IfIndex`	—
`PrefixLength`	—
`IdentifierLength`	—

Event ID 1538 — TCPIP: An ARP request was dropped on interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: An ARP request was dropped on interface %1. Physical address = %3, IP source address = %4, IP target address = %5, Reason = %6.

Fields

Name	Description
`IfIndex`	—
`DlAddrLength`	—
`DlSourceAddress`	—
`IpSourceAddress`	—
`IpTargetAddress`	—
`DropReason`	—

Event ID 1539 — TCPIP: An ARP reply was dropped on interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: An ARP reply was dropped on interface %1. Physical address = %3, IP source address = %4, Directed to this interface = %5, Reason = %6.

Fields

Name	Description
`IfIndex`	—
`DlAddrLength`	—
`DlSourceAddress`	—
`IpSourceAddress`	—
`Directed`	—
`DropReason`	—

Event ID 1540 — TCPIP: No handler found for an %1 packet with upper layer protocol %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: No handler found for an %1 packet with upper layer protocol %2

Fields

Name	Description
`AddressFamily`	—
`IPTransportProtocol`	—

Event ID 1541 — TCPIP: Handler for upper layer protocol %2 for an %1 packet returned with error %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Handler for upper layer protocol %2 for an %1 packet returned with error %3

Fields

Name	Description
`AddressFamily`	—
`IPTransportProtocol`	—
`Status`	—

Event ID 1542 — IP: neighbor rundown: Interface = %1, Compartment = %2, IpAddress = %4, DlAddress = %6, State = %7, LastReachable = %8 ms, IsUnreachable = %9, Flag...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: neighbor rundown: Interface = %1, Compartment = %2, IpAddress = %4, DlAddress = %6, State = %7, LastReachable = %8 ms, IsUnreachable = %9, Flags = %10.

Fields

Name	Description
`IfIndex`	—
`CompartmentId`	—
`IpAddrLength`	—
`IPAddress`	—
`DlAddrLength`	—
`DLAddress`	—
`NeighborState`	—
`LastReachableInMs`	—
`IsUnreachable`	—
`Flags`	—

Event ID 1543 — TCPIP: An ARP request was dropped on interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: An ARP request was dropped on interface %1. Physical address = %3, IP source address = %4, IP target address = %5, Reason = %6.

Fields

Name	Description
`IfIndex`	—
`DlAddrLength`	—
`DlSourceAddress`	—
`IpSourceAddress`	—
`IpTargetAddress`	—
`DropReason`	—

Event ID 1544 — Endpoint %1 socket option set with level %2, name %3, value %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Endpoint %1 socket option set with level %2, name %3, value %5.

Fields

Name	Description
`Endpoint`	—
`Level`	—
`Name`	—
`Length`	—
`Value`	—

Event ID 1545 — TCP: connection = %1 RACK timeout expired.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 RACK timeout expired. SndUna = %2, SndMax = %3, SackedBytes = %4, LossDetected = %5, InRecovery = %6.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`SackedBytes`	—
`LossDetected`	—
`InRecovery`	—

Event ID 1546 — TCP: connection = %1 armed RACK timer.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 armed RACK timer. SndUna = %2, SndMax = %3, SackedBytes = %4, LossDetected = %5, InRecovery = %6, DeltaTicks = %7.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`SackedBytes`	—
`LossDetected`	—
`InRecovery`	—
`DeltaTicks`	—

Event ID 1547 — TCP: connection = %1 received a SACK block.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 received a SACK block. SndUna = %2, SndMax = %3, Ack = %4, SLE = %5, SRE = %6.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`Ack`	—
`SLE`	—
`SRE`	—

Event ID 1548 — TCP: connection = %1 received a SACK.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 received a SACK. SndUna = %2, SndMax = %3, Ack = %4, SackedBytes = %5, LossDetected = %6, InRecovery = %7, NumSackBlocks = %8, DSackCount = %9, NewSackInfo = %10, RecoveryMax = %11.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`Ack`	—
`SackedBytes`	—
`LossDetected`	—
`InRecovery`	—
`NumSackBlocks`	—
`DSackCount`	—
`NewSackInfo`	—
`RecoveryMax`	—
`NewSackedBytes`	—

Event ID 1549 — TCP: connection = %1 enabled send tracker.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 enabled send tracker.

Fields

Name	Description
`Tcb`	—

Event ID 1550 — TCP: connection = %1 send tracker acked a transmit.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 send tracker acked a transmit. AckNo = %2, Start = %3, End = %4, Timestamp = %5, EverTransmitted = %6, SackedBytes = %7, BytesInFlight = %8.

Fields

Name	Description
`Tcb`	—
`AckNo`	—
`Start`	—
`End`	—
`Timestamps`	—
`EverRetransmitted`	—
`SackedBytes`	—
`BytesInFlight`	—
`State`	—

Event ID 1551 — TCP: connection = %1 send tracker enqueued a transmit.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 send tracker enqueued a transmit. Start = %2, End = %3, Timestamp = %4, SackedBytes = %5, BytesInFlight = %6.

Fields

Name	Description
`Tcb`	—
`Start`	—
`End`	—
`Timestamps`	—
`SackedBytes`	—
`BytesInFlight`	—
`NoNewTransmitCreated`	—

Event ID 1552 — TCP: connection = %1 send tracker marked a transmit as lost.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 send tracker marked a transmit as lost. Start = %2, End = %3, Timestamp = %4, EverTransmitted = %5, InFlightCount = %6, SackedBytes = %7, BytesInFlight = %8.

Fields

Name	Description
`Tcb`	—
`Start`	—
`End`	—
`Timestamps`	—
`EverRetransmitted`	—
`InFlightCount`	—
`SackedBytes`	—
`BytesInFlight`	—

Event ID 1553 — TCP: accept redirection: original listener = %1, redirected listener = %2, succeeded = %3, redirected = %4, codepath = %5, local address = %6, remo...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: accept redirection: original listener = %1, redirected listener = %2, succeeded = %3, redirected = %4, codepath = %5, local address = %6, remote address = %7, redirected address = %8

Fields

Name	Description
`OriginalListener`	—
`RedirectedListener`	—
`Succeeded`	—
`Redirected`	—
`CodePath`	—
`SockAddrLength`	—
`LocalSockAddr`	—
`RemoteSockAddr`	—
`RedirectSockAddr`	—

Event ID 1554 — TCP: connection = %1 dropped a SACK block due to SACK limit reached.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 dropped a SACK block due to SACK limit reached. SndUna = %2, SndMax = %3, Ack = %4, SLE = %5, SRE = %6, NumSackedTransmits = %7, limit = %8.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`Ack`	—
`SLE`	—
`SRE`	—
`NumSackTransmits`	—
`Limit`	—

Event ID 1555 — TCP: connection %1 terminated by NSI.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 terminated by NSI. State = %2, PID = %3, ProcessSeqNum = %4, Shutdown = %5.

Fields

Name	Description
`Tcb`	—
`State`	—
`Pid`	—
`ProcessStartKey`	—
`Shutdown`	—

Event ID 1556 — TCP: connection = %1 rate-based pacing timeout expired.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 rate-based pacing timeout expired. SndUna = %2, SndMax = %3, PacingAllowance = %4 B, PacingRate = %5 B/ms.

Fields

Name	Description
`Tcb`	—
`SndUna`	—
`SndMax`	—
`PacingAllowance`	—
`PacingRate`	—

Event ID 1557 — TCP RLedbat connection = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP RLedbat connection = %1. Type = %2, SSThresh = %3, Wnd = %4, WndWs = %5, DrainedBytes = %6, ReceiveHigh = %7, TsHigh = %8, LastRollOverTimeMs = %9, EndReductionTimeMs = %10, MinDelaySampleMs = %11, MinBaseDelayMs = %12

Fields

Name	Description
`Tcb`	—
`EventType`	—
`SsThresh`	—
`Wnd`	—
`WndWs`	—
`DrainedBytes`	—
`ReceiveHigh`	—
`TsHigh`	—
`LastRollOverTimeMs`	—
`EndReductionTimeMs`	—
`MinDelaySampleMs`	—
`MinBaseDelayMs`	—

Event ID 1558 — UDP: endpoint %5 rebind initiated: current address = %2, modified address = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %5 rebind initiated: current address = %2, modified address = %4

Fields

Name	Description
`CurrentLocalAddressLength`	—
`CurrentLocalAddress`	—
`ModifiedLocalAddressLength`	—
`ModifiedLocalAddress`	—
`Endpoint`	—
`Status`	—
`EndpointRestored`	—

Event ID 1559 — UDP: endpoint %5 rebind failed: current address = %2, modified address = %4, port-switch status = %6, endpoint-restored = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint %5 rebind failed: current address = %2, modified address = %4, port-switch status = %6, endpoint-restored = %7

Fields

Name	Description
`CurrentLocalAddressLength`	—
`CurrentLocalAddress`	—
`ModifiedLocalAddressLength`	—
`ModifiedLocalAddress`	—
`Endpoint`	—
`Status`	—
`EndpointRestored`	—

Event ID 1560 — TCP: endpoint %5 rebind initiated: current address = %2, modified address = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint %5 rebind initiated: current address = %2, modified address = %4

Fields

Name	Description
`CurrentLocalAddressLength`	—
`CurrentLocalAddress`	—
`ModifiedLocalAddressLength`	—
`ModifiedLocalAddress`	—
`Endpoint`	—
`Status`	—
`EndpointRestored`	—

Event ID 1561 — TCP: endpoint %5 rebind failed: current address = %2, modified address = %4, port-switch status = %6, endpoint-restored = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint %5 rebind failed: current address = %2, modified address = %4, port-switch status = %6, endpoint-restored = %7

Fields

Name	Description
`CurrentLocalAddressLength`	—
`CurrentLocalAddress`	—
`ModifiedLocalAddressLength`	—
`ModifiedLocalAddress`	—
`Endpoint`	—
`Status`	—
`EndpointRestored`	—

Event ID 1562 — TCP: endpoint (PID=%4 ProcessSeqNum=%7) create failed: access denied.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: endpoint (PID=%4 ProcessSeqNum=%7) create failed: access denied.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1563 — UDP: endpoint (PID=%3 ProcessSeqNum=%6) create failed: access denied.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: endpoint (PID=%3 ProcessSeqNum=%6) create failed: access denied.

Fields

Name	Description
`Endpoint`	—
`Status`	—
`ProcessId`	—
`CompartmentId`	—
`AddressFamily`	—
`ProcessStartKey`	—

Event ID 1564 — TCP: connection %8 (local=%2 remote=%4 PID=%6 ProcessSeqNum=%9) connect failed: access denied.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %8 (local=%2 remote=%4 PID=%6 ProcessSeqNum=%9) connect failed: access denied.

Fields

Name	Description
`LocalAddressLength`	—
`LocalAddress`	—
`RemoteAddressLength`	—
`RemoteAddress`	—
`Status`	—
`ProcessId`	—
`Compartment`	—
`Tcb`	—
`ProcessStartKey`	—

Event ID 1565 — TCP: Congestion state changed for connection = %1 from OldState = %2 to NewState = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Congestion state changed for connection = %1 from OldState = %2 to NewState = %3.

Fields

Name	Description
`Tcb`	—
`OldState`	—
`NewState`	—

Event ID 1566 — TCP: connection = %1 detected reordering.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 detected reordering. MaxReorderingBytes = %2, Fack = %3, EndSeq = %4.

Fields

Name	Description
`Tcb`	—
`MaxReorderingBytes`	—
`Fack`	—
`EndSeq`	—

Event ID 1577 — TCP: connection = %1 updated reownd.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 updated reownd. Multiplier = %2, Persist = %3, Reownd = %4, ReorderingSeen = %5, DSackSeenOnLatestAck = %6, InLossRecovery = %7, DupAckCountReached = %8, DSackRound = %9, DSackRoundValid = %10.

Fields

Name	Description
`Tcb`	—
`Multiplier`	—
`Persist`	—
`Reownd`	—
`ReorderingSeen`	—
`DSackSeenOnLatestAck`	—
`InLossRecovery`	—
`DupAckCountReached`	—
`DSackRound`	—
`DSackRoundValid`	—

Event ID 1578 — IP: Injecting NBL %1 on send path.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Injecting NBL %1 on send path. Family = %2, Compartment = %3, Protocol = %5

Fields

Name	Description
`Nbl`	—
`AddressFamily`	—
`CompartmentId`	—
`Interface`	—
`IPTransportProtocol`	—

Event ID 1579 — IP: Injecting NBL %1 on raw send path.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Injecting NBL %1 on raw send path. Family = %2, Compartment = %3

Fields

Name	Description
`Nbl`	—
`AddressFamily`	—
`CompartmentId`	—
`Interface`	—
`IPTransportProtocol`	—

Event ID 1580 — IP: Injecting NBL %1 on receive path.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Injecting NBL %1 on receive path. Family = %2, Compartment = %3, Interface = %4

Fields

Name	Description
`Nbl`	—
`AddressFamily`	—
`CompartmentId`	—
`Interface`	—
`IPTransportProtocol`	—

Event ID 1581 — IP: Injecting NBL %1 on forward path.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Injecting NBL %1 on forward path. Family = %2, Compartment = %3, Interface = %4

Fields

Name	Description
`Nbl`	—
`AddressFamily`	—
`CompartmentId`	—
`Interface`	—
`IPTransportProtocol`	—

Event ID 1582 — IP: Indication filtered because destination interface %1 is not contained in IF list.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Indication filtered because destination interface %1 is not contained in IF list

Fields

Name	Description
`IfIndex`	—

Event ID 1583 — BBR2: TCB %1 bbr_bw %2 min_rtt_us %3 mode %4 cycle_idx %5 CWnd %6 PacingRate %7 BytesSent %8 SRtt %9.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

BBR2: TCB %1 bbr_bw %2 min_rtt_us %3 mode %4 cycle_idx %5 CWnd %6 PacingRate %7 BytesSent %8 SRtt %9

Fields

Name	Description
`Tcb`	—
`bbr_bw`	—
`min_rtt_us`	—
`mode`	—
`cycle_idx`	—
`CWnd`	—
`PacingRate`	—
`BytesSent`	—
`SRtt`	—

Event ID 1584 — TCP: connection = %1 send tracker marked a transmit as rexmit.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 send tracker marked a transmit as rexmit. Start = %2, End = %3, Timestamp = %4, InFlightCount = %5, SackedBytes = %6, BytesInFlight = %7.

Fields

Name	Description
`Tcb`	—
`Start`	—
`End`	—
`Timestamps`	—
`InFlightCount`	—
`SackedBytes`	—
`BytesInFlight`	—

Event ID 1585 — TCP: connection = %1 send tracker update RACK info.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 send tracker update RACK info. RackXmitTimeStampValid = %2, RackXmitTimeStampInUs = %3, RackEndSeq = %4, RackRttInUs = %5, NowInUs = %6, TimeStampInUs = %7.

Fields

Name	Description
`Tcb`	—
`RackXmitTimeStampValid`	—
`RackXmitTimeStampInUs`	—
`RackEndSeq`	—
`RackRttInUs`	—
`NowInUs`	—
`TimeStampInUs`	—

Event ID 1586 — IP: Prefix sharing now %4 on Interface = %3, Compartment = %2, Family = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Prefix sharing now %4 on Interface = %3, Compartment = %2, Family = %1. Updating shared prefixes and resetting autoconfigured state, such as addresses and routes.

Fields

Name	Description
`AddressFamily`	—
`CompartmentId`	—
`Interface`	—
`PrefixSharing`	—

Event ID 1587 — TCP: connection %1 received a careful ACK.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 received a careful ACK. ThAck = %2, SndUna = %3, SndMax = %4, RecoveryMax = %5, SndWnd = %6, SndWndChanged = %7, SackUpdated = %8, State = %9, CongestionState = %10, F-RTO = %11.

Fields

Name	Description
`Tcb`	—
`ThAck`	—
`SndUna`	—
`SndMax`	—
`RecoveryMax`	—
`SndWnd`	—
`SndWndChanged`	—
`SackUpdated`	—
`TcpState`	—
`CongestionState`	—
`Frto`	—

Event ID 1588 — IP: Forwarding tag on Interface = %3, Compartment = %2, Family = %1 changed from %4 to %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Forwarding tag on Interface = %3, Compartment = %2, Family = %1 changed from %4 to %5.

Fields

Name	Description
`AddressFamily`	—
`CompartmentId`	—
`Interface`	—
`OldForwardingTag`	—
`NewForwardingTag`	—

Event ID 1589 — TCP: AF %1, RssEnabled = %2 .

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: AF %1, RssEnabled = %2 .

Fields

Name	Description
`AddressFamily`	—
`RssEnabled`	—

Event ID 1590 — TCP: connection = %1 send completion failed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection = %1 send completion failed. NBL = %2, Status = %3.

Fields

Name	Description
`Tcb`	—
`Nbl`	—
`Status`	—

Event ID 1591 — TCPIP: Alloc hooks setup: Status = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Alloc hooks setup: Status = %1.

Fields

Name	Description
`Status`	—

Event ID 1592 — IP: Neighbor with IpAddress = %3 DlAddress = %5 on Interface = %1 was reset while in state %6 due to Reason = %7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Neighbor with IpAddress = %3 DlAddress = %5 on Interface = %1 was reset while in state %6 due to Reason = %7.

Fields

Name	Description
`Interface`	—
`IpAddrLength`	—
`IPAddress`	—
`DlAddrLength`	—
`DLAddress`	—
`OldNeighborState`	—
`ResetReason`	—
`CompartmentId`	—

Event ID 1593 — TCP: Global timer fired, Processor = %1, Tick = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Global timer fired, Processor = %1, Tick = %2

Fields

Name	Description
`Processor`	—
`Tick`	—

Event ID 1594 — TCP: Global timer armed, NextToExpire = %1, Period = %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Global timer armed, NextToExpire = %1, Period = %2

Fields

Name	Description
`NextToExpire`	—
`Period`	—

Event ID 1595 — TCP: Global timer cancelled

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Global timer cancelled

Event ID 1596 — TCP: Updating Fastopen Key

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Updating Fastopen Key

Event ID 1597 — TCP: paused receive buffer growth for high memory usage, AF = %1, TCB = %2, TotalBytesBuffered = %3, UpperLimit = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: paused receive buffer growth for high memory usage, AF = %1, TCB = %2, TotalBytesBuffered = %3, UpperLimit = %4

Fields

Name	Description
`AddressFamily`	—
`Tcb`	—
`TotalBytesBuffered`	—
`UpperLimit`	—

Event ID 1598 — IP: Autoconfigured address creation failed due to autoconfiguration limit, Address = %5 %7 %6, Interface = %1, Compartment = %2, Protocol = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Autoconfigured address creation failed due to autoconfiguration limit, Address = %5 %7 %6, Interface = %1, Compartment = %2, Protocol = %3

Fields

Name	Description
`Interface`	—
`CompartmentId`	—
`Protocol`	—
`IpAddrLength`	—
`IPv4Address`	—
`IPv6Address`	—
`IPProtocol`	—

Event ID 1599 — IP: Autoconfigured route creation failed due to autoconfiguration limit, DestinationPrefix = %9 %11 %7 /%6, Nexthop = %10 %11 %8, Interface = %1, C...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Autoconfigured route creation failed due to autoconfiguration limit, DestinationPrefix = %9 %11 %7 /%6, Nexthop = %10 %11 %8, Interface = %1, Compartment = %2, Protocol = %3

Fields

Name	Description
`Interface`	—
`CompartmentId`	—
`Protocol`	—
`DestinationPrefixAddressLength`	—
`NextHopAddressLength`	—
`DestinationPrefixLength`	—
`DestinationPrefix`	—
`NextHopAddress`	—
`IPv4DestinationPrefix`	—
`IPv4NextHopAddress`	—
`IPProtocol`	—

Event ID 1600 — IP: Policy based routing failed - Compartment: %1 DstAddr: %3 SrcAddr: %5 TransProto: %6 IcmpType: %7 IcmpCode: %8 PolicySrcAddr: %10 PolicyNextHop...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Policy based routing failed - Compartment: %1 DstAddr: %3 SrcAddr: %5 TransProto: %6 IcmpType: %7 IcmpCode: %8 PolicySrcAddr: %10 PolicyNextHopAddr: %12 PolicyIfIndex: %13 FailureReason: %14 Status: %15

Fields

Name	Description
`Compartment`	—
`DestinationAddrLength`	—
`DestinationAddress`	—
`SourceAddrLength`	—
`SourceAddress`	—
`TransportProtocol`	—
`IcmpType`	—
`IcmpCode`	—
`PolicySourceAddrLength`	—
`PolicySourceAddress`	—
`PolicyNextHopAddrLength`	—
`PolicyNextHopAddress`	—
`PolicyInterfaceLuid`	—
`FailureReason`	—
`Status`	—

Event ID 1601 — TCP: connection %1 in %2 received NBL %4 in FastPath = %3 Seq = %5 Ack = %6 Flags = %7 RSC = %8 CoalescedSegCount = %9 RscTcpTimestampDelta = %10 E...

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 in %2 received NBL %4 in FastPath = %3 Seq = %5 Ack = %6 Flags = %7 RSC = %8 CoalescedSegCount = %9 RscTcpTimestampDelta = %10 EcnCePresent = %11.

Fields

Name	Description
`Tcb`	—
`NewState`	—
`FastPath`	—
`NBL`	—
`ThSeq`	—
`ThAck`	—
`ThFlags`	—
`RSC`	—
`CoalescedSegCount`	—
`RscTcpTimestampDelta`	—
`EcnCePresent`	—

Event ID 1602 — TCP: connection %1 process fast RX batch SegmentCount = %2 NumBytes = %3 NblHead = %4 NblTail = %5 Inspect = %6.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 process fast RX batch SegmentCount = %2 NumBytes = %3 NblHead = %4 NblTail = %5 Inspect = %6.

Fields

Name	Description
`Tcb`	—
`SegmentCount`	—
`NumBytes`	—
`NblHead`	—
`NblTail`	—
`Inspect`	—

Event ID 1603 — TCP: connection %1 in %2 %3 disconnect DataLength=%4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 in %2 %3 disconnect DataLength=%4.

Fields

Name	Description
`Tcb`	—
`State`	—
`Injected`	—
`DataLength`	—

Event ID 1604 — NDKPI Disconnect Event CallbackEx: DisconnectEventContext %1 ProviderDisconnectReason %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Disconnect Event CallbackEx: DisconnectEventContext %1 ProviderDisconnectReason %2

Fields

Name	Description
`DisconnectEventContext`	—
`ProviderDisconnectReason`	—

Event ID 1605 — NDKPI AcceptEx: RequestContext %6 Connector %1 QP %2 IRD %3 ORD %4 PrivateDataLength %7 DisconnectEventContext %5.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI AcceptEx: RequestContext %6 Connector %1 QP %2 IRD %3 ORD %4 PrivateDataLength %7 DisconnectEventContext %5

Fields

Name	Description
`NdkConnector`	—
`NdkQp`	—
`IRD`	—
`ORD`	—
`DisconnectEventContext`	—
`RequestContext`	—
`PrivateDataLength`	—

Event ID 1606 — NDKPI CompleteConnectEx: RequestContext %3 Connector %1 DisconnectEventContext %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI CompleteConnectEx: RequestContext %3 Connector %1 DisconnectEventContext %2

Fields

Name	Description
`NdkConnector`	—
`DisconnectEventContext`	—
`RequestContext`	—

Event ID 1607 — NDKPI Open Adapter Version Override: IF_INDEX %7 ProviderSupportedNDKVersion {%1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Open Adapter Version Override: IF_INDEX %7 ProviderSupportedNDKVersion {%1.%2} FlConfiguredNdkpiVersion {%3.%4} ActualSupportedVersion {%5.%6}

Fields

Name	Description
`ProviderSupportedNDKVersionMajor`	—
`ProviderSupportedNDKVersionMinor`	—
`FlConfiguredNdkpiVersionMajor`	—
`FlConfiguredNdkpiVersionMinor`	—
`ActualSupportedNDKVersionMajor`	—
`ActualSupportedNDKVersionMinor`	—
`IF_INDEX`	—

Event ID 1608 — Fl Reload Registry Config: Override Status: %5 OldFlConfiguredVersion {%1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Fl Reload Registry Config: Override Status: %5 OldFlConfiguredVersion {%1.%2} NewFlConfiguredVersion {%3.%4}

Fields

Name	Description
`OldFlVersionMajor`	—
`OldFlVersionMinor`	—
`NewFlVersionMajor`	—
`NewFlVersionMinor`	—
`OverrideStatus`	—

Event ID 1609 — NDKPI Open Adapter: Unexpected version returned by provider, IF_INDEX %5 ProviderSupportedNDKVersion {%1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

NDKPI Open Adapter: Unexpected version returned by provider, IF_INDEX %5 ProviderSupportedNDKVersion {%1.%2} ConsumerSpecifiedVersion {%3.%4}

Fields

Name	Description
`ProviderSupportedNDKVersionMajor`	—
`ProviderSupportedNDKVersionMinor`	—
`ConsumerSpecifiedNdkpiVersionMajor`	—
`ConsumerSpecifiedNdkpiVersionMinor`	—
`IF_INDEX`	—

Event ID 1610 — TCPIP: Disconnected Standby traffic.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Disconnected Standby traffic. Event = %1 AddressFamily = %2

Fields

Name	Description
`StandbyEvent`	—
`AddressFamily`	—

Event ID 1611 — TCPIP: Disconnected Standby (DS) transition detected.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Disconnected Standby (DS) transition detected. IsSystemInDs=%1

Fields

Name	Description
`DSState`	—

Event ID 1612 — ResetResolve API call: ProcessName %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

ResetResolve API call: ProcessName %1

Fields

Name	Description
`API`	—

Event ID 1613 — USO global disabled mask = %1.

Provider: Microsoft-Windows-TCPIP
Channel: Operational

Message

USO global disabled mask = %1.

Fields

Name	Description
`UdpUsoDisabledMask`	—

Event ID 1614 — Framing: SW URO %1, HW URO %2.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Framing: SW URO %1, HW URO %2

Fields

Name	Description
`SwUroEnabled`	—
`HwUroEnabled`	—

Event ID 1615 — Tcpip Power Policy set to.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Tcpip Power Policy set to: %1

Fields

Name	Description
`PowerPolicy`	—

Event ID 1616 — Router Solicitation sent.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Router Solicitation sent. Interface: %1, Reason: %2, Tcpip Power Policy: %3

Fields

Name	Description
`InterfaceIndex`	—
`RouterSolicitationReason`	—
`PowerPolicy`	—

Event ID 1617 — Router Solicitation requested on dormant interface.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Router Solicitation requested on dormant interface. Interface: %1, Reason: %2, Tcpip Power Policy: %3

Fields

Name	Description
`InterfaceIndex`	—
`RouterSolicitationReason`	—
`PowerPolicy`	—

Event ID 1618 — IP: Route lifetime refresh.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Route lifetime refresh. Interface = %1, Protocol = %2, Compartment = %3, Prefix = %5/%6, NextHop = %8, Metric = %9, Origin = %10, CurrentTime = %11, Old BaseTime = %12, Old ValidTime = %13, Old PreferredTime = %14, New BaseTime = %15, New ValidTime = %16, New PreferredTime = %17.

Fields

Name	Description
`Interface`	—
`Protocol`	—
`Compartment`	—
`DestinationPrefixAddressLength`	—
`DestinationPrefix`	—
`DestinationPrefixLength`	—
`NextHopAddressLength`	—
`NextHopAddress`	—
`Metric`	—
`Origin`	—
`CurrentTime`	—
`OldBasetime`	—
`OldValidTime`	—
`OldPreferredTime`	—
`NewBasetime`	—
`NewValidTime`	—
`NewPreferredTime`	—

Event ID 1619 — IP: Constraint computation (unused) - Source address %2 is preferred over %3 for Destination %4 in Compartment %5, Reason: %8.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Constraint computation (unused) - Source address %2 is preferred over %3 for Destination %4 in Compartment %5, Reason: %8 (Rule %6.%7).

Fields

Name	Description
`IpAddrLength`	—
`PreferredSourceIPAddress`	—
`NonPreferredSourceIPAddress`	—
`DestinationIPAddress`	—
`CompartmentId`	—
`Rule`	—
`RuleExtension`	—
`RuleName`	—

Event ID 1620 — WFP-ALE: RemoteEndPoint Cleanup: (local=%2 remote=%3) currentTick=%4 lastTick=%5 lifeTime=%6 LifetimeFactor=%7.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

WFP-ALE: RemoteEndPoint Cleanup: (local=%2 remote=%3) currentTick=%4 lastTick=%5 lifeTime=%6 LifetimeFactor=%7

Fields

Name	Description
`AddressLength`	—
`LocalAddress`	—
`RemoteAddress`	—
`CurrentTick`	—
`LastTick`	—
`LifeTime`	—
`LifetimeFactor`	—

Event ID 1621 — FL: Virtual interface creation.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: Virtual interface creation. Interface = %1, Family = %2, CompartmentGuid = %3, CompartmentId = %4, IsolationMode = %5, IsolationId = %6, Origin = %7, VirtualIfLuid = %8, VirtualIfIndex = %9

Fields

Name	Description
`IfLuid`	—
`AddressFamily`	—
`CompartmentGuid`	—
`CompartmentId`	—
`IsolationMode`	—
`IsolalationId`	—
`Origin`	—
`VirtualIfLuid`	—
`VirtualIfIndex`	—

Event ID 1622 — FL: Virtual interface deletion.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: Virtual interface deletion. Interface = %1, Family = %2, CompartmentGuid = %3, CompartmentId = %4, IsolationMode = %5, IsolationId = %6, Origin = %7, VirtualIfLuid = %8, VirtualIfIndex = %9

Fields

Name	Description
`IfLuid`	—
`AddressFamily`	—
`CompartmentGuid`	—
`CompartmentId`	—
`IsolationMode`	—
`IsolalationId`	—
`Origin`	—
`VirtualIfLuid`	—
`VirtualIfIndex`	—

Event ID 1623 — Tcpip Power Policy Standby-to-Full-Power transition detected.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

Tcpip Power Policy Standby-to-Full-Power transition detected. Lifetimes adjusted for Interface:%1, DestinationPrefix:%3/%4, NextHopAddress:%6, EnteredStandbySystemTickCount:%7, CurrentTickCount:%8, ValidLifetimeHighWaterTickCount:%9

Fields

Name	Description
`InterfaceIndex`	—
`DestinationPrefixAddressLength`	—
`DestinationPrefix`	—
`DestinationPrefixLength`	—
`NextHopAddressLength`	—
`NextHopAddress`	—
`EnteredStandbySystemTickCount`	—
`CurrentTickCount`	—
`ValidLifetimeHighWaterTickCount`	—

Event ID 1624 — TCP: connection %1: flow label refreshed, old = %2 new = %3.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: flow label refreshed, old = %2 new = %3.

Fields

Name	Description
`Tcb`	—
`OldFlowLabel`	—
`NewFlowLabel`	—

Event ID 1625 — TCP: Connection %1 send idle triggered.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: Connection %1 send idle triggered. OldCwnd = %2, NewCwnd = %3, CurrentTick = %5, IdleTick = %6, RTO = %7

Fields

Name	Description
`Tcb`	—
`OldCwnd`	—
`NewCwnd`	—
`Processor`	—
`CurrentTick`	—
`IdleTick`	—
`Rto`	—

Event ID 1626 — TCP: connection %1: bytes limited by sender = %2 receiver = %3 congestion = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1: bytes limited by sender = %2 receiver = %3 congestion = %4.

Fields

Name	Description
`Tcb`	—
`SenderLimitedBytes`	—
`ReceiverLimitedBytes`	—
`CongestionLimitedBytes`	—

Event ID 1627 — UDP: %2 scheduled HW URO to be %3 on interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: %2 scheduled HW URO to be %3 on interface %1. CurrentState:%4. Last scheduled state: %5

Fields

Name	Description
`IfLuid`	—
`ChangeReason`	—
`NewUroState`	—
`CurrentUroState`	—
`LastScheduledState`	—
`FailureReasonFlags`	—

Event ID 1628 — UDP: %2 %3 HW URO on interface %1.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

UDP: %2 %3 HW URO on interface %1. Status: %4

Fields

Name	Description
`IfLuid`	—
`ChangeReason`	—
`NewUroState`	—
`Status`	—
`FailureReasonFlags`	—

Event ID 1629 — FL: FLSNPI client attach.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: FLSNPI client attach. Client: %1, AddressFamily: %2, NpiVersion: %3, NblContextSize: %4, FailureReason: %5, Status: %6.

Fields

Name	Description
`ClientName`	—
`AddressFamily`	—
`ClientNpiVersion`	—
`NblContextSize`	—
`FailureReason`	—
`Status`	—

Event ID 1630 — FL: FLSNPI client detach.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: FLSNPI client detach. Client: %1, AddressFamily: %2.

Fields

Name	Description
`ClientName`	—
`AddressFamily`	—

Event ID 1631 — FL: FLSNPI client interface attach.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: FLSNPI client interface attach. Client: %1, AddressFamily: %2, CompartmentId: %3, IfIndex: %4, VirtualIfId: %5, Flags: %6, FailureReason: %7, Status: %8.

Fields

Name	Description
`ClientName`	—
`AddressFamily`	—
`CompartmentId`	—
`IfIndex`	—
`VirtualIfId`	—
`Flags`	—
`FailureReason`	—
`Status`	—

Event ID 1632 — FL: FLSNPI client interface detach.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: FLSNPI client interface detach. Client: %1,  AddressFamily: %2, CompartmentId: %3, IfIndex: %4, VirtualIfId: %5, Flags: %8, FailureReason: %6, Status: %7.

Fields

Name	Description
`ClientName`	—
`AddressFamily`	—
`CompartmentId`	—
`IfIndex`	—
`VirtualIfId`	—
`FailureReason`	—
`Status`	—
`Flags`	—

Event ID 1633 — FL: FLSNPI datapath failure.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: FLSNPI datapath failure. Operation: %1, AddressFamily: %2, Direction: %3, Client:%4, CompartmentId: %5, IfIndex: %6, VirtualIfId: %7, Flags: %8, InjectIfIndex: %11, FailureReason: %9, Status: %10

Fields

Name	Description
`Operation`	—
`AddressFamily`	—
`PathDirection`	—
`ClientName`	—
`CompartmentId`	—
`IfIndex`	—
`VirtualIfId`	—
`Flags`	—
`FailureReason`	—
`Status`	—
`InjectionIfIndex`	—

Event ID 1634 — FL: FLSNPI client silent drop.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: FLSNPI client silent drop. Direction: %1, AddressFamily:%2, Client: %3, CompartmentId: %4, IfIndex: %5, VirtualIfId: %6, PacketCount: %7.

Fields

Name	Description
`PathDirection`	—
`AddressFamily`	—
`ClientName`	—
`CompartmentId`	—
`InterfaceIndex`	—
`VirtualIfId`	—
`PacketCount`	—

Event ID 1635 — FL: FLSNPI indication stats.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: FLSNPI indication  stats. Direction: %1, AddressFamily:%2, CompartmentId: %3, IfIndex: %4, VirtualIfId: %5, PacketsIndicated: %6, PacketsReturned: %7, PacketsInjected: %8, PacketsCloned: %9, PacketsClonedForSplitNB: %10, PacketsDropped: %11, PacketsSilentlyDropped: %12.

Fields

Name	Description
`Direction`	—
`AddressFamily`	—
`CompartmentId`	—
`InterfaceIndex`	—
`VirtualIfId`	—
`PacketsIndicated`	—
`PacketsReturned`	—
`PacketsInjected`	—
`PacketsCloned`	—
`PacketsClonedWithNBSplit`	—
`PacketsDropped`	—
`PacketsSilentlyDropped`	—

Event ID 1636 — TCPIP: Current Power Policy.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCPIP: Current Power Policy : %1.

Fields

Name	Description
`PowerPolicy`	—

Event ID 1637 — TCP: connection %1 send acked %2 bytes starting from %3 ActivityID = %4.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

TCP: connection %1 send acked %2 bytes starting from %3 ActivityID = %4.

Fields

Name	Description
`Tcb`	—
`NumBytes`	—
`SndNxt`	—
`ActivityID`	—
`SndLimBytesSnd`	—
`SndLimBytesRwin`	—
`SndLimBytesCwnd`	—
`CWnd`	—
`SRtt`	—
`LossRecoveryEpisodes`	—
`RtoEpisodes`	—
`PtoEpisodes`	—

Event ID 1638 —

Provider: Microsoft-Windows-TCPIP
Channel: Operational

Fields

Name	Description
`Event`	—
`Interface`	—
`CompartmentId`	—
`RouterAddrLength`	—
`RouterAddress`	—
`PrefixAddrLength`	—
`Prefix`	—
`PrefixLength`	—
`Lifetime`	—

Event ID 1638 — IP.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: %1. Interface = %2, Compartment = %3, RouterAddress = %5, Prefix = %7/%8, Lifetime = %9.

Fields

Name	Description
`Event`	—
`Interface`	—
`CompartmentId`	—
`RouterAddrLength`	—
`RouterAddress`	—
`PrefixAddrLength`	—
`Prefix`	—
`PrefixLength`	—
`Lifetime`	—

Event ID 1639 —

Provider: Microsoft-Windows-TCPIP
Channel: Operational

Fields

Name	Description
`CompartmentId`	—
`AddressFamily`	—
`RoutingEpoch`	—

Event ID 1639 — IP: Destination cache invalidated.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Destination cache invalidated. Compartment = %1, Family = %2, RoutingEpoch = %3.

Fields

Name	Description
`CompartmentId`	—
`AddressFamily`	—
`RoutingEpoch`	—

Event ID 1640 —

Provider: Microsoft-Windows-TCPIP
Channel: Operational

Fields

Name	Description
`NsiAction`	—
`AddressFamily`	—
`IfLuid`	—
`CompartmentGuid`	—
`VirtualIfId`	—
`IsolationMode`	—
`Status`	—
`FailureReason`	—

Event ID 1640 — FL: Virtual interface set failed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: Virtual interface set failed. NsiAction = %1, Family %2, IfLuid = %3, CompartmentGuid = %4, VirtualIfId = %5, IsolationMode = %6, Status = %7, Reason = %8

Fields

Name	Description
`NsiAction`	—
`AddressFamily`	—
`IfLuid`	—
`CompartmentGuid`	—
`VirtualIfId`	—
`IsolationMode`	—
`Status`	—
`FailureReason`	—

Event ID 1641 —

Provider: Microsoft-Windows-TCPIP
Channel: Operational

Fields

Name	Description
`NsiAction`	—
`AddressFamily`	—
`IfLuid`	—
`CompartmentGuid`	—
`VirtualIfId`	—
`IsolationMode`	—
`Status`	—
`FailureReason`	—

Event ID 1641 — FL: Virtual interface get failed.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

FL: Virtual interface get failed. NsiAction = %1, Family %2, IfLuid = %3, CompartmentGuid = %4, VirtualIfId = %5, IsolationMode = %6, Status = %7, Reason = %8

Fields

Name	Description
`NsiAction`	—
`AddressFamily`	—
`IfLuid`	—
`CompartmentGuid`	—
`VirtualIfId`	—
`IsolationMode`	—
`Status`	—
`FailureReason`	—

Event ID 1642 —

Provider: Microsoft-Windows-TCPIP
Channel: Operational

Fields

Name	Description
`InterfaceIndex`	—
`InterfaceGuid`	—
`CompartmentId`	—
`AddressLength`	—
`SourceIpAddress`	—
`PrefixValue`	—
`PrefixLength`	—
`ValidLifetime`	—
`PreferredLifetime`	—
`FlagsValue`	—
`IsRoute`	—
`IsSitePrefix`	—
`IsRouterAddress`	—
`IsAutonomous`	—
`IsOnLink`	—

Event ID 1642 — IP: Received Prefix Option in Router Advertisement.

Provider: Microsoft-Windows-TCPIP
Channel: Diagnostic

Message

IP: Received Prefix Option in Router Advertisement. Interface(Index/GUID) = %1/%2, Compartment = %3, SourceIpAddress = %5, Prefix(Value/Length) = %6/%7, Lifetimes(Valid/Preferred) = %8/%9, Flags = %10 (Route = %11, SitePrefix = %12, RouterAddress = %13, Autonomous = %14, OnLink = %15)

Fields

Name	Description
`InterfaceIndex`	—
`InterfaceGuid`	—
`CompartmentId`	—
`AddressLength`	—
`SourceIpAddress`	—
`PrefixValue`	—
`PrefixLength`	—
`ValidLifetime`	—
`PreferredLifetime`	—
`FlagsValue`	—
`IsRoute`	—
`IsSitePrefix`	—
`IsRouterAddress`	—
`IsAutonomous`	—
`IsOnLink`	—