none
IP packet drop reason RRS feed

  • Question

  • I've TCPIP.SYS dropping a packets (that I re-injected in my WFP callout driver). ETW logs show:

    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    	<System>
    		<Provider Name="Microsoft-Windows-TCPIP" Guid="{2f07e2ee-15db-40f1-90ef-9d7ba282188a}" />
    		<EventID>1215</EventID>
    		<Version>0</Version>
    		<Level>5</Level>
    		<Task>1215</Task>
    		<Opcode>0</Opcode>
    		<Keywords>0x8000018200000080</Keywords>
    		<TimeCreated SystemTime="2017-07-03T12:43:33.048281700-0700" />
    		<Correlation ActivityID="{2f07e2ee-15db-40f1-90ef-9d7ba282188a}" />
    		<Execution ProcessID="4" ThreadID="852" ProcessorID="0" KernelTime="0" UserTime="0" />
    		<Channel>Microsoft-Windows-TCPIP/Diagnostic</Channel>
    		<Computer />
    	</System>
    	<EventData>
    		<Data Name="IPTransportProtocol">       1</Data>
    		<Data Name="AddressFamily">       2</Data>
    		<Data Name="Source IPv4 Address">10.10.10.1</Data>
    		<Data Name="Dest IPv4 Address">208.201.227.68</Data>
    		<Data Name="IPv6SourceIpAddrLength">       0</Data>
    		<Data Name="IPv6 Source Address"></Data>
    		<Data Name="IPv6DestIpAddrLength">       0</Data>
    		<Data Name="IPv6 Dest Address"></Data>
    		<Data Name="Reason">     267</Data>
    		<Data Name="PacketCount">       1</Data>
    		<Data Name="IPProtocol">       4</Data>
    	</EventData>
    	<RenderingInfo Culture="en-US">
    		<Level>Verbose </Level>
    		<Opcode>Info </Opcode>
    		<Keywords>
    			<Keyword>ut:TcpipDiagnosis</Keyword>
    			<Keyword>ut:ReceivePath</Keyword>
    			<Keyword>ut:Global</Keyword>
    			<Keyword>ut:Dropped</Keyword>
    		</Keywords>
    		<Task>TcpipNetworkPacketDrops</Task>
    		<Message>TCPIP: Network layer (Protocol ICMP , AddressFamily = IPV4 ) dropped 1 packet(s). SourceAddress = 10.10.10.1    . DestAddress = 208.201.227.68    . Reason = 267. </Message>
    		<Channel>Microsoft-Windows-TCPIP/Diagnostic</Channel>
    	</RenderingInfo>
    </Event>
    

    Question: what is REASON=267?

    Thank you

    Monday, July 3, 2017 9:19 PM