Microsoft-Quic

181 events across 1 channel

Event	Title	Channel	Sample
1	[ lib] Initialized, PartitionCount=PartitionCount …	Application	N
2	[ lib] Uninitialized	Application	N
3	[ lib] AddRef	Application	N
4	[ lib] Release	Application	N
5	[ lib] Shared server state initializing	Application	N
6	Allocation of 'Desc' failed.	Application	N
7	[ lib] Rundown, PartitionCount=PartitionCount DatapathFeatures=DatapathFeatures.	Application	N
8	[ lib] ERROR, ErrStr.	Application	N
9	[ lib] ERROR, Status, ErrStr.	Application	N
10	[ lib] ASSERT, File:Line - Expression.	Application	N
11	[ api] Enter Type (Handle).	Application	N
12	[ api] Exit	Application	N
13	[ api] Exit Status.	Application	N
14	[ api] Waiting on operation	Application	N
15	[ lib] Perf counters Rundown	Application	Y
16	[ lib] New SendRetryEnabled state, Value.	Application	Y
17	[ lib] Version Major.	Application	Y
18	[ api] Error Status.	Application	N
19	[ lib] Initialized, PartitionCount=PartitionCount.	Application	N
20	[data] Initialized, DatapathFeatures=DatapathFeatures.	Application	N
21	[ lib] Rundown, PartitionCount=PartitionCount.	Application	Y
22	[data] Rundown, DatapathFeatures=DatapathFeatures.	Application	Y
23	[ lib] Initialized	Application	N
1024	[ reg][Registration] Created, AppName=AppName.	Application	N
1025	[ reg][Registration] Destroyed.	Application	N
1026	[ reg][Registration] Cleaning up.	Application	N
1027	[ reg][Registration] Rundown, AppName=AppName.	Application	N
1028	[ reg][Registration] ERROR, ErrStr.	Application	N
1029	[ reg][Registration] ERROR, Status, ErrStr.	Application	N
1030	[ reg][Registration] Shutting down connections, Flags=Flags, …	Application	N
1031	[ reg][Registration] Created, AppName=AppName, ExecProfile=ExecProfile.	Application	N
1032	[ reg][Registration] Rundown, AppName=AppName, ExecProfile=ExecProfile.	Application	Y
2048	[wrkr][Worker] Created, IdealProc=IdealProcessor Owner=Owner.	Application	N
2049	[wrkr][Worker] Start.	Application	N
2050	[wrkr][Worker] Stop.	Application	N
2051	[wrkr][Worker] IsActive = IsActive, Arg = Arg.	Application	N
2052	[wrkr][Worker] QueueDelay = QueueDelay.	Application	N
2053	[wrkr][Worker] Destroyed.	Application	N
2054	[wrkr][Worker] Cleaning up.	Application	N
2055	[wrkr][Worker] ERROR, ErrStr.	Application	N
2056	[wrkr][Worker] ERROR, Status, ErrStr.	Application	N
3072	[cnfg][Configuration] Created, Registration=Registration.	Application	N
3073	[cnfg][Configuration] Destroyed.	Application	N
3074	[cnfg][Configuration] Cleaning up.	Application	N
3076	[cnfg][Configuration] Rundown, Registration=Registration.	Application	N
3077	[cnfg][Configuration] ERROR, ErrStr.	Application	N
3078	[cnfg][Configuration] ERROR, Status, ErrStr.	Application	N
4096	[list][Listener] Created, Registration=Registration.	Application	N
4097	[list][Listener] Destroyed.	Application	N
4098	[list][Listener] Started, Binding=Binding, LocalAddr=Addr, ALPN=Alpn.	Application	N
4099	[list][Listener] Stopped.	Application	N
4100	[list][Listener] Rundown, Registration=Registration.	Application	N
4101	[list][Listener] ERROR, ErrStr.	Application	N
4102	[list][Listener] ERROR, Status, ErrStr.	Application	N
5120	[conn][Connection] Created, IsServer=IsServer, CorrelationId=CorrelationId.	Application	N
5121	[conn][Connection] Destroyed.	Application	N
5122	[conn][Connection] Handshake complete.	Application	N
5123	[conn][Connection] Scheduling: State.	Application	N
5124	[conn][Connection] Execute: Type.	Application	N
5125	[conn][Connection] Execute: Type.	Application	N
5126	[conn][Connection] Execute: Type.	Application	N
5127	[conn][Connection] New Local IP: Addr.	Application	N
5128	[conn][Connection] New Remote IP: Addr.	Application	N
5129	[conn][Connection] Removed Local IP: Addr.	Application	N
5130	[conn][Connection] Removed Remote IP: Addr.	Application	N
5131	[conn][Connection] Assigned worker: Worker.	Application	N
5132	[conn][Connection] Handshake start.	Application	N
5133	[conn][Connection] Registered with Registration.	Application	N
5134	[conn][Connection] Unregistered from Registration.	Application	N
5135	[conn][Connection] Transport Shutdown: ErrorCode (Remote=IsRemoteShutdown) …	Application	N
5136	[conn][Connection] App Shutdown: ErrorCode (Remote=IsRemoteShutdown).	Application	N
5137	[conn][Connection] Initialize complete.	Application	N
5138	[conn][Connection] Handle closed.	Application	N
5139	[conn][Connection] QUIC Version: Value.	Application	N
5140	[conn][Connection] OUT: BytesSent=BytesSent InFlight=BytesInFlight …	Application	N
5141	[conn][Connection] Send Blocked Flags: ReasonFlags.	Application	N
5142	[conn][Connection] IN: BytesRecv=BytesReceived.	Application	N
5143	[conn][Connection] CUBIC: SlowStartThreshold=SlowStartThreshold K=K …	Application	N
5144	[conn][Connection] Congestion event.	Application	N
5145	[conn][Connection] Persistent congestion event.	Application	N
5146	[conn][Connection] Recovery complete.	Application	N
5147	[conn][Connection] Rundown, IsServer=IsServer, CorrelationId=CorrelationId.	Application	N
5148	[conn][Connection] (SeqNum=SequenceNumber) New Source CID: Cid.	Application	N
5149	[conn][Connection] (SeqNum=SequenceNumber) New Destination CID: Cid.	Application	N
5150	[conn][Connection] (SeqNum=SequenceNumber) Removed Source CID: Cid.	Application	N
5151	[conn][Connection] (SeqNum=SequenceNumber) Removed Destination CID: Cid.	Application	N
5152	[conn][Connection] Setting loss detection Type timer for DelayMs us.	Application	N
5153	[conn][Connection] Cancelling loss detection timer.	Application	N
5154	[conn][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason.	Application	N
5155	[conn][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason, Value.	Application	N
5156	[conn][Connection] ERROR, ErrStr.	Application	N
5157	[conn][Connection] ERROR, Status, ErrStr.	Application	N
5158	[conn][Connection] New packet keys created successfully.	Application	N
5159	[conn][Connection] Key phase change (locally initiated=IsLocallyInitiated).	Application	N
5160	[conn][Connection] STATS: SRtt=SmoothedRtt CongestionCount=CongestionCount …	Application	N
5161	[conn][Connection] Shutdown complete, PeerFailedToAcknowledged=Value.	Application	N
5162	[conn][Connection] Read Key Updated, NewValue.	Application	N
5163	[conn][Connection] Write Key Updated, NewValue.	Application	N
5164	[conn][Owner][TX][Number] Type (Length bytes).	Application	N
5165	[conn][Owner][RX][Number] Type (Length bytes).	Application	N
5166	[conn][Owner][TX][Number] Type Lost: Reason.	Application	N
5167	[conn][Owner][TX][Number] Type ACKed.	Application	N
5168	[conn][.	Application	N
5169	[conn][.	Application	N
5170	[conn][.	Application	N
5171	[conn][.	Application	N
5172	[conn][Connection] Queueing send flush, reason=Type.	Application	N
5173	[conn][Connection] OUT: StreamFC=StreamFlowControl …	Application	N
5174	[conn][Connection] STATS: SendTotalPackets=SendTotalPackets …	Application	N
5175	[conn][Connection] Server app accepted resumption ticket.	Application	N
5176	[conn][Connection] VerInfo Available Versions List: Vnl.	Application	N
5177	[conn][Connection] Client VI Received Version List: Vnl.	Application	N
5178	[conn][Connection] Server VI Supported Version List: Vnl.	Application	N
5179	[conn][Connection] Spurious congestion event.	Application	N
5180	[conn][Connection] No Listener for IP address: Addr.	Application	N
5181	[conn][Connection] No listener matching ALPN: Alpn.	Application	N
5182	[conn][Connection] Flushing Send.	Application	N
5183	[conn][Connection] Setting Type, delay=Delay us.	Application	N
5184	[conn][Connection] Canceling Type.	Application	N
5185	[conn][Connection] Type expired.	Application	N
5186	[conn][Connection] BBR: State=BbrState RState=RecoveryState …	Application	N
5187	[conn][Connection] Ecn: IsCapable=IsCapable.	Application	N
5188	[conn][Connection][EncryptLevel] ECN failed: EctCnt EcnEctCounter CeCnt …	Application	N
5189	[conn][Connection] Congestion event IsEcn=IsEcn.	Application	N
5190	[conn][Connection] STATS: SRtt=SmoothedRtt CongestionCount=CongestionCount …	Application	N
5191	[conn][Connection] HyStart: State=HyStartState CongestionWindow=CongestionWindow …	Application	N
5192	[conn][Connection] Recv Count UDP datagrams, Count2 bytes.	Application	N
5193	[conn][Connection] OUT: BytesSent=BytesSent InFlight=BytesInFlight …	Application	N
5194	[conn][Connection] STATS: SRtt=SmoothedRtt CongestionCount=CongestionCount …	Application	N
5195	[conn][Connection] Received APPLICATION_ERROR error, delaying close in …	Application	N
6144	[strm][Stream] Created, Conn=Connection ID=ID IsLocal=IsLocalOwned.	Application	N
6145	[strm][Stream] Destroyed.	Application	N
6146	[strm][Stream] Send Blocked Flags: ReasonFlags.	Application	N
6147	[strm][Stream] Rundown, Conn=Connection ID=ID IsLocal=IsLocalOwned.	Application	N
6148	[strm][Stream] Send State: State.	Application	N
6149	[strm][Stream] Recv State: State.	Application	N
6150	[strm][Stream] ERROR, ErrStr.	Application	N
6151	[strm][Stream] ERROR, Status, ErrStr.	Application	N
6152	[strm][.	Application	N
6153	[strm][.	Application	N
6154	[strm][.	Application	N
6155	[strm][.	Application	N
6156	[strm][Stream] Allocated, Conn=Connection.	Application	N
6157	[strm][Stream] Writing frames to packet ID.	Application	N
6158	[strm][Stream] Processing frame in packet ID.	Application	N
6159	[strm][Stream] Indicating QUIC_STREAM_EVENT_RECEIVE [BufLength bytes, BufCount …	Application	N
6160	[strm][Stream] Receive complete [ID bytes].	Application	N
6161	[strm][Stream] App queuing send [BufLength bytes, BufCount buffers, Flags …	Application	N
6162	[strm][Stream] Done processing frame.	Application	N
6163	[strm][Stream] Receive complete call [ID bytes].	Application	N
7168	[bind][Binding] Created, Udp=Socket LocalAddr=LocalAddr RemoteAddr=RemoteAddr.	Application	N
7169	[bind][Binding] Rundown, Udp=Socket LocalAddr=LocalAddr RemoteAddr=RemoteAddr.	Application	N
7170	[bind][Binding] Destroyed.	Application	N
7171	[bind][Binding] Cleaning up.	Application	N
7172	[bind][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason.	Application	N
7173	[bind][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason, Value.	Application	N
7174	[bind][Binding] ERROR, ErrStr.	Application	N
7175	[bind][Binding] ERROR, Status, ErrStr.	Application	N
7176	[bind][Binding] Execute: Type.	Application	N
8192	[ tls][Connection] ERROR, ErrStr.	Application	N
8193	[ tls][Connection] ERROR, Status, ErrStr.	Application	N
8194	[ tls][.	Application	N
9217	[data][UdpBinding] Send TotalSize bytes in BufferCount buffers …	Application	N
9218	[data][UdpBinding] Recv TotalSize bytes (segment=SegmentSize) Src=LocalAddr …	Application	N
9219	[data][UdpBinding] ERROR, ErrStr.	Application	N
9220	[data][UdpBinding] ERROR, Status, ErrStr.	Application	N
9221	[data][UdpBinding] Created, local=LocalAddr, remote=RemoteAddr.	Application	N
9222	[data][UdpBinding] Destroyed.	Application	N
9223	[data][UdpBinding] Querying route, local=LocalAddr, remote=RemoteAddr.	Application	N
9224	[data][UdpBinding] Query route result: LocalAddr.	Application	N
9225	[data][UdpBinding] Send SegmentSize bytes TCP control packet Flags=TcpFlags …	Application	N
10240	Message.	Application	N
10241	Message.	Application	N
10242	Message.	Application	N
10243	Message.	Application	N
11264	[pack][ID] Created in batch ID2.	Application	N
11265	[pack][ID] Encrypting.	Application	N
11266	[pack][ID] Finalizing.	Application	N
11267	[pack][ID] Batch sent.	Application	N
11268	[pack][ID] Received.	Application	N
11269	[pack][ID] Decrypting.	Application	N

Event ID 1: [ lib] Initialized, PartitionCount=PartitionCount DatapathFeatures=DatapathFeatures.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] Initialized, PartitionCount=PartitionCount DatapathFeatures=DatapathFeatures.

Message #

[ lib] Initialized, PartitionCount=%1 DatapathFeatures=%2

Fields #

Name	Description
`PartitionCount` UInt32
`DatapathFeatures` UInt32

Event ID 2: [ lib] Uninitialized

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] Uninitialized.

Message #

[ lib] Uninitialized

Event ID 3: [ lib] AddRef

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] AddRef.

Message #

[ lib] AddRef

Event ID 4: [ lib] Release

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] Release.

Message #

[ lib] Release

Event ID 5: [ lib] Shared server state initializing

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] Shared server state initializing.

Message #

[ lib] Shared server state initializing

Event ID 6: Allocation of 'Desc' failed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

Allocation of 'Desc' failed. (ByteCount bytes).

Message #

Allocation of '%1' failed. (%2 bytes)

Fields #

Name	Description
`Desc` AnsiString
`ByteCount` UInt64

Event ID 7: [ lib] Rundown, PartitionCount=PartitionCount DatapathFeatures=DatapathFeatures.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] Rundown, PartitionCount=PartitionCount DatapathFeatures=DatapathFeatures.

Message #

[ lib] Rundown, PartitionCount=%1 DatapathFeatures=%2

Fields #

Name	Description
`PartitionCount` UInt32
`DatapathFeatures` UInt32

Event ID 8: [ lib] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] ERROR, ErrStr.

Message #

[ lib] ERROR, %1.

Fields #

Name	Description
`ErrStr` AnsiString

Event ID 9: [ lib] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] ERROR, Status, ErrStr.

Message #

[ lib] ERROR, %1, %2.

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 10: [ lib] ASSERT, File:Line - Expression.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] ASSERT, File:Line - Expression.

Message #

[ lib] ASSERT, %2:%1 - %3.

Fields #

Name	Description
`Line` UInt32
`File` AnsiString
`Expression` AnsiString

Event ID 11: [ api] Enter Type (Handle).

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ api] Enter Type (Handle).

Message #

[ api] Enter %1 (%2).

Fields #

Name	Description
`Type` UInt32
`Handle` Pointer

Event ID 12: [ api] Exit

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ api] Exit.

Message #

[ api] Exit

Event ID 13: [ api] Exit Status.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ api] Exit Status.

Message #

[ api] Exit %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 14: [ api] Waiting on operation

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ api] Waiting on operation.

Message #

[ api] Waiting on operation

Event ID 15: [ lib] Perf counters Rundown

Provider: Microsoft-Quic
Channel: Application
Also via: realtime ETW trace
Level: Informational
Opcode: Global

Description

[ lib] Perf counters Rundown.

Message #

[ lib] Perf counters Rundown

Fields #

Name	Description
`PerfCountersLength` UInt16
`PerfCounters` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Quic",
    "guid": "{FF15E657-4F26-570E-88AB-0796B258D11C}",
    "event_source_name": "",
    "event_id": 15,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 11,
    "keywords": "0x0000000080000000",
    "time_created": "2026-06-02T05:33:02.414+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8392,
      "thread_id": 4800
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PerfCounters": "01000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000010130000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "PerfCountersLength": 256
  },
  "message": ""
}

Event ID 16: [ lib] New SendRetryEnabled state, Value.

Provider: Microsoft-Quic
Channel: Application
Also via: realtime ETW trace
Level: Informational
Opcode: Global

Description

[ lib] New SendRetryEnabled state, Value.

Message #

[ lib] New SendRetryEnabled state, %1

Fields #

Name	Description
`Value` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Quic",
    "guid": "{FF15E657-4F26-570E-88AB-0796B258D11C}",
    "event_source_name": "",
    "event_id": 16,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 11,
    "keywords": "0x0000000080000000",
    "time_created": "2026-06-02T05:33:02.414+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8392,
      "thread_id": 4800
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Value": 0
  },
  "message": ""
}

Event ID 17: [ lib] Version Major.

Provider: Microsoft-Quic
Channel: Application
Also via: realtime ETW trace
Level: Informational
Opcode: Global

Description

[ lib] Version Major.Minor.Patch.Build.

Message #

[ lib] Version %1.%2.%3.%4

Fields #

Name	Description
`Major` UInt32
`Minor` UInt32
`Patch` UInt32
`Build` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Quic",
    "guid": "{FF15E657-4F26-570E-88AB-0796B258D11C}",
    "event_source_name": "",
    "event_id": 17,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 11,
    "keywords": "0x0000000080000000",
    "time_created": "2026-06-02T05:33:02.414+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8392,
      "thread_id": 4800
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Build": 121728554,
    "Major": 2,
    "Minor": 4,
    "Patch": 11
  },
  "message": ""
}

Event ID 18: [ api] Error Status.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ api] Error Status.

Message #

[ api] Error %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 19: [ lib] Initialized, PartitionCount=PartitionCount.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] Initialized, PartitionCount=PartitionCount.

Message #

[ lib] Initialized, PartitionCount=%1

Fields #

Name	Description
`PartitionCount` UInt32

Event ID 20: [data] Initialized, DatapathFeatures=DatapathFeatures.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[data] Initialized, DatapathFeatures=DatapathFeatures.

Message #

[data] Initialized, DatapathFeatures=%1

Fields #

Name	Description
`DatapathFeatures` UInt32

Event ID 21: [ lib] Rundown, PartitionCount=PartitionCount.

Provider: Microsoft-Quic
Channel: Application
Also via: realtime ETW trace
Level: Informational
Opcode: Global

Description

[ lib] Rundown, PartitionCount=PartitionCount.

Message #

[ lib] Rundown, PartitionCount=%1

Fields #

Name	Description
`PartitionCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Quic",
    "guid": "{FF15E657-4F26-570E-88AB-0796B258D11C}",
    "event_source_name": "",
    "event_id": 21,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 11,
    "keywords": "0x0000000080000000",
    "time_created": "2026-06-02T05:33:02.414+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8392,
      "thread_id": 4800
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "PartitionCount": 4
  },
  "message": ""
}

Event ID 22: [data] Rundown, DatapathFeatures=DatapathFeatures.

Provider: Microsoft-Quic
Channel: Application
Also via: realtime ETW trace
Level: Informational
Opcode: Global

Description

[data] Rundown, DatapathFeatures=DatapathFeatures.

Message #

[data] Rundown, DatapathFeatures=%1

Fields #

Name	Description
`DatapathFeatures` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Quic",
    "guid": "{FF15E657-4F26-570E-88AB-0796B258D11C}",
    "event_source_name": "",
    "event_id": 22,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 11,
    "keywords": "0x0000000080000000",
    "time_created": "2026-06-02T05:33:02.414+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8392,
      "thread_id": 4800
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DatapathFeatures": 7
  },
  "message": ""
}

Event ID 23: [ lib] Initialized

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[ lib] Initialized.

Message #

[ lib] Initialized

Event ID 1024: [ reg][Registration] Created, AppName=AppName.

Provider: Microsoft-Quic
Channel: Application
Opcode: Registration

Description

[ reg][Registration] Created, AppName=AppName.

Message #

[ reg][%1] Created, AppName=%2

Fields #

Name	Description
`Registration` Pointer
`AppName` AnsiString

Event ID 1025: [ reg][Registration] Destroyed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Registration

Description

[ reg][Registration] Destroyed.

Message #

[ reg][%1] Destroyed

Fields #

Name	Description
`Registration` Pointer

Event ID 1026: [ reg][Registration] Cleaning up.

Provider: Microsoft-Quic
Channel: Application
Opcode: Registration

Description

[ reg][Registration] Cleaning up.

Message #

[ reg][%1] Cleaning up

Fields #

Name	Description
`Registration` Pointer

Event ID 1027: [ reg][Registration] Rundown, AppName=AppName.

Provider: Microsoft-Quic
Channel: Application
Opcode: Registration

Description

[ reg][Registration] Rundown, AppName=AppName.

Message #

[ reg][%1] Rundown, AppName=%2

Fields #

Name	Description
`Registration` Pointer
`AppName` AnsiString

Event ID 1028: [ reg][Registration] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Registration

Description

[ reg][Registration] ERROR, ErrStr.

Message #

[ reg][%1] ERROR, %2.

Fields #

Name	Description
`Registration` Pointer
`ErrStr` AnsiString

Event ID 1029: [ reg][Registration] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Registration

Description

[ reg][Registration] ERROR, Status, ErrStr.

Message #

[ reg][%1] ERROR, %2, %3.

Fields #

Name	Description
`Registration` Pointer
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 1030: [ reg][Registration] Shutting down connections, Flags=Flags, ErrorCode=ErrorCode.

Provider: Microsoft-Quic
Channel: Application
Opcode: Registration

Description

[ reg][Registration] Shutting down connections, Flags=Flags, ErrorCode=ErrorCode.

Message #

[ reg][%1] Shutting down connections, Flags=%2, ErrorCode=%3

Fields #

Name	Description
`Registration` Pointer
`Flags` UInt32
`ErrorCode` UInt64

Event ID 1031: [ reg][Registration] Created, AppName=AppName, ExecProfile=ExecProfile.

Provider: Microsoft-Quic
Channel: Application
Opcode: Registration

Description

[ reg][Registration] Created, AppName=AppName, ExecProfile=ExecProfile.

Message #

[ reg][%1] Created, AppName=%2, ExecProfile=%3

Fields #

Name	Description
`Registration` Pointer
`AppName` AnsiString
`ExecProfile` UInt32

Event ID 1032: [ reg][Registration] Rundown, AppName=AppName, ExecProfile=ExecProfile.

Provider: Microsoft-Quic
Channel: Application
Also via: realtime ETW trace
Level: Informational
Opcode: Registration

Description

[ reg][Registration] Rundown, AppName=AppName, ExecProfile=ExecProfile.

Message #

[ reg][%1] Rundown, AppName=%2, ExecProfile=%3

Fields #

Name	Description
`Registration` Pointer
`AppName` AnsiString
`ExecProfile` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Quic",
    "guid": "{FF15E657-4F26-570E-88AB-0796B258D11C}",
    "event_source_name": "",
    "event_id": 1032,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 12,
    "keywords": "0x0000000080000001",
    "time_created": "2026-06-02T05:33:02.414+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 8392,
      "thread_id": 4800
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AppName": "SMB Client",
    "ExecProfile": 0,
    "Registration": "0xFFFFBD09F28E45F0"
  },
  "message": ""
}

Event ID 2048: [wrkr][Worker] Created, IdealProc=IdealProcessor Owner=Owner.

Provider: Microsoft-Quic
Channel: Application
Opcode: Worker

Description

[wrkr][Worker] Created, IdealProc=IdealProcessor Owner=Owner.

Message #

[wrkr][%1] Created, IdealProc=%2 Owner=%3

Fields #

Name	Description
`Worker` Pointer
`IdealProcessor` UInt16
`Owner` Pointer

Event ID 2049: [wrkr][Worker] Start.

Provider: Microsoft-Quic
Channel: Application
Opcode: Worker

Description

[wrkr][Worker] Start.

Message #

[wrkr][%1] Start

Fields #

Name	Description
`Worker` Pointer

Event ID 2050: [wrkr][Worker] Stop.

Provider: Microsoft-Quic
Channel: Application
Opcode: Worker

Description

[wrkr][Worker] Stop.

Message #

[wrkr][%1] Stop

Fields #

Name	Description
`Worker` Pointer

Event ID 2051: [wrkr][Worker] IsActive = IsActive, Arg = Arg.

Provider: Microsoft-Quic
Channel: Application
Opcode: Worker

Description

[wrkr][Worker] IsActive = IsActive, Arg = Arg.

Message #

[wrkr][%1] IsActive = %2, Arg = %3

Fields #

Name	Description
`Worker` Pointer
`IsActive` UInt8
`Arg` UInt32

Event ID 2052: [wrkr][Worker] QueueDelay = QueueDelay.

Provider: Microsoft-Quic
Channel: Application
Opcode: Worker

Description

[wrkr][Worker] QueueDelay = QueueDelay.

Message #

[wrkr][%1] QueueDelay = %2

Fields #

Name	Description
`Worker` Pointer
`QueueDelay` UInt32

Event ID 2053: [wrkr][Worker] Destroyed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Worker

Description

[wrkr][Worker] Destroyed.

Message #

[wrkr][%1] Destroyed

Fields #

Name	Description
`Worker` Pointer

Event ID 2054: [wrkr][Worker] Cleaning up.

Provider: Microsoft-Quic
Channel: Application
Opcode: Worker

Description

[wrkr][Worker] Cleaning up.

Message #

[wrkr][%1] Cleaning up

Fields #

Name	Description
`Worker` Pointer

Event ID 2055: [wrkr][Worker] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Worker

Description

[wrkr][Worker] ERROR, ErrStr.

Message #

[wrkr][%1] ERROR, %2.

Fields #

Name	Description
`Worker` Pointer
`ErrStr` AnsiString

Event ID 2056: [wrkr][Worker] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Worker

Description

[wrkr][Worker] ERROR, Status, ErrStr.

Message #

[wrkr][%1] ERROR, %2, %3.

Fields #

Name	Description
`Worker` Pointer
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 3072: [cnfg][Configuration] Created, Registration=Registration.

Provider: Microsoft-Quic
Channel: Application
Opcode: Configuration

Description

[cnfg][Configuration] Created, Registration=Registration.

Message #

[cnfg][%1] Created, Registration=%2

Fields #

Name	Description
`Configuration` Pointer
`Registration` Pointer

Event ID 3073: [cnfg][Configuration] Destroyed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Configuration

Description

[cnfg][Configuration] Destroyed.

Message #

[cnfg][%1] Destroyed

Fields #

Name	Description
`Configuration` Pointer

Event ID 3074: [cnfg][Configuration] Cleaning up.

Provider: Microsoft-Quic
Channel: Application
Opcode: Configuration

Description

[cnfg][Configuration] Cleaning up.

Message #

[cnfg][%1] Cleaning up

Fields #

Name	Description
`Configuration` Pointer

Event ID 3076: [cnfg][Configuration] Rundown, Registration=Registration.

Provider: Microsoft-Quic
Channel: Application
Opcode: Configuration

Description

[cnfg][Configuration] Rundown, Registration=Registration.

Message #

[cnfg][%1] Rundown, Registration=%2

Fields #

Name	Description
`Configuration` Pointer
`Registration` Pointer

Event ID 3077: [cnfg][Configuration] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Configuration

Description

[cnfg][Configuration] ERROR, ErrStr.

Message #

[cnfg][%1] ERROR, %2.

Fields #

Name	Description
`Configuration` Pointer
`ErrStr` AnsiString

Event ID 3078: [cnfg][Configuration] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Configuration

Description

[cnfg][Configuration] ERROR, Status, ErrStr.

Message #

[cnfg][%1] ERROR, %2, %3.

Fields #

Name	Description
`Configuration` Pointer
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 4096: [list][Listener] Created, Registration=Registration.

Provider: Microsoft-Quic
Channel: Application
Opcode: Listener

Description

[list][Listener] Created, Registration=Registration.

Message #

[list][%1] Created, Registration=%2

Fields #

Name	Description
`Listener` Pointer
`Registration` Pointer

Event ID 4097: [list][Listener] Destroyed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Listener

Description

[list][Listener] Destroyed.

Message #

[list][%1] Destroyed

Fields #

Name	Description
`Listener` Pointer

Event ID 4098: [list][Listener] Started, Binding=Binding, LocalAddr=Addr, ALPN=Alpn.

Provider: Microsoft-Quic
Channel: Application
Opcode: Listener

Description

[list][Listener] Started, Binding=Binding, LocalAddr=Addr, ALPN=Alpn.

Message #

[list][%1] Started, Binding=%2, LocalAddr=%4, ALPN=%6

Fields #

Name	Description
`Listener` Pointer
`Binding` Pointer
`AddrLength` UInt8
`Addr` Binary
`AlpnLength` UInt8
`Alpn` Binary

Event ID 4099: [list][Listener] Stopped.

Provider: Microsoft-Quic
Channel: Application
Opcode: Listener

Description

[list][Listener] Stopped.

Message #

[list][%1] Stopped

Fields #

Name	Description
`Listener` Pointer

Event ID 4100: [list][Listener] Rundown, Registration=Registration.

Provider: Microsoft-Quic
Channel: Application
Opcode: Listener

Description

[list][Listener] Rundown, Registration=Registration.

Message #

[list][%1] Rundown, Registration=%2

Fields #

Name	Description
`Listener` Pointer
`Registration` Pointer

Event ID 4101: [list][Listener] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Listener

Description

[list][Listener] ERROR, ErrStr.

Message #

[list][%1] ERROR, %2.

Fields #

Name	Description
`Listener` Pointer
`ErrStr` AnsiString

Event ID 4102: [list][Listener] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Listener

Description

[list][Listener] ERROR, Status, ErrStr.

Message #

[list][%1] ERROR, %2, %3.

Fields #

Name	Description
`Listener` Pointer
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 5120: [conn][Connection] Created, IsServer=IsServer, CorrelationId=CorrelationId.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Created, IsServer=IsServer, CorrelationId=CorrelationId.

Message #

[conn][%1] Created, IsServer=%2, CorrelationId=%3

Fields #

Name	Description
`Connection` Pointer
`IsServer` UInt32
`CorrelationId` UInt64

Event ID 5121: [conn][Connection] Destroyed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Destroyed.

Message #

[conn][%1] Destroyed

Fields #

Name	Description
`Connection` Pointer

Event ID 5122: [conn][Connection] Handshake complete.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Handshake complete.

Message #

[conn][%1] Handshake complete

Fields #

Name	Description
`Connection` Pointer

Event ID 5123: [conn][Connection] Scheduling: State.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Scheduling: State.

Message #

[conn][%1] Scheduling: %2

Fields #

Name	Description
`Connection` Pointer
`State` UInt32

Event ID 5124: [conn][Connection] Execute: Type.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Execute: Type.

Message #

[conn][%1] Execute: %2

Fields #

Name	Description
`Connection` Pointer
`Type` UInt32

Event ID 5125: [conn][Connection] Execute: Type.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Execute: Type.

Message #

[conn][%1] Execute: %2

Fields #

Name	Description
`Connection` Pointer
`Type` UInt32

Event ID 5126: [conn][Connection] Execute: Type.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Execute: Type.

Message #

[conn][%1] Execute: %2

Fields #

Name	Description
`Connection` Pointer
`Type` UInt32

Event ID 5127: [conn][Connection] New Local IP: Addr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] New Local IP: Addr.

Message #

[conn][%1] New Local IP: %3

Fields #

Name	Description
`Connection` Pointer
`AddrLength` UInt8
`Addr` Binary

Event ID 5128: [conn][Connection] New Remote IP: Addr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] New Remote IP: Addr.

Message #

[conn][%1] New Remote IP: %3

Fields #

Name	Description
`Connection` Pointer
`AddrLength` UInt8
`Addr` Binary

Event ID 5129: [conn][Connection] Removed Local IP: Addr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Removed Local IP: Addr.

Message #

[conn][%1] Removed Local IP: %3

Fields #

Name	Description
`Connection` Pointer
`AddrLength` UInt8
`Addr` Binary

Event ID 5130: [conn][Connection] Removed Remote IP: Addr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Removed Remote IP: Addr.

Message #

[conn][%1] Removed Remote IP: %3

Fields #

Name	Description
`Connection` Pointer
`AddrLength` UInt8
`Addr` Binary

Event ID 5131: [conn][Connection] Assigned worker: Worker.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Assigned worker: Worker.

Message #

[conn][%1] Assigned worker: %2

Fields #

Name	Description
`Connection` Pointer
`Worker` Pointer

Event ID 5132: [conn][Connection] Handshake start.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Handshake start.

Message #

[conn][%1] Handshake start

Fields #

Name	Description
`Connection` Pointer

Event ID 5133: [conn][Connection] Registered with Registration.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Registered with Registration.

Message #

[conn][%1] Registered with %2

Fields #

Name	Description
`Connection` Pointer
`Registration` Pointer

Event ID 5134: [conn][Connection] Unregistered from Registration.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Unregistered from Registration.

Message #

[conn][%1] Unregistered from %2

Fields #

Name	Description
`Connection` Pointer
`Registration` Pointer

Event ID 5135: [conn][Connection] Transport Shutdown: ErrorCode (Remote=IsRemoteShutdown) (QS=IsQuicStatus).

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Transport Shutdown: ErrorCode (Remote=IsRemoteShutdown) (QS=IsQuicStatus).

Message #

[conn][%1] Transport Shutdown: %2 (Remote=%3) (QS=%4)

Fields #

Name	Description
`Connection` Pointer
`ErrorCode` UInt64
`IsRemoteShutdown` UInt8
`IsQuicStatus` UInt8

Event ID 5136: [conn][Connection] App Shutdown: ErrorCode (Remote=IsRemoteShutdown).

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] App Shutdown: ErrorCode (Remote=IsRemoteShutdown).

Message #

[conn][%1] App Shutdown: %2 (Remote=%3)

Fields #

Name	Description
`Connection` Pointer
`ErrorCode` UInt64
`IsRemoteShutdown` UInt8

Event ID 5137: [conn][Connection] Initialize complete.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Initialize complete.

Message #

[conn][%1] Initialize complete

Fields #

Name	Description
`Connection` Pointer

Event ID 5138: [conn][Connection] Handle closed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Handle closed.

Message #

[conn][%1] Handle closed

Fields #

Name	Description
`Connection` Pointer

Event ID 5139: [conn][Connection] QUIC Version: Value.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] QUIC Version: Value.

Message #

[conn][%1] QUIC Version: %2

Fields #

Name	Description
`Connection` Pointer
`Value` UInt32

Event ID 5140: [conn][Connection] OUT: BytesSent=BytesSent InFlight=BytesInFlight InFlightMax=BytesInFlightMax CWnd=CongestionWindow SSThresh=SlowStartThreshold ConnFC=ConnectionFlowControl ISB=IdealBytes PostedB...

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] OUT: BytesSent=BytesSent InFlight=BytesInFlight InFlightMax=BytesInFlightMax CWnd=CongestionWindow SSThresh=SlowStartThreshold ConnFC=ConnectionFlowControl ISB=IdealBytes PostedBytes=PostedBytes SRtt=SmoothedRtt.

Message #

[conn][%1] OUT: BytesSent=%2 InFlight=%3 InFlightMax=%4 CWnd=%5 SSThresh=%6 ConnFC=%7 ISB=%8 PostedBytes=%9 SRtt=%10

Fields #

Name	Description
`Connection` Pointer
`BytesSent` UInt64
`BytesInFlight` UInt32
`BytesInFlightMax` UInt32
`CongestionWindow` UInt32
`SlowStartThreshold` UInt32
`ConnectionFlowControl` UInt64
`IdealBytes` UInt64
`PostedBytes` UInt64
`SmoothedRtt` UInt32

Event ID 5141: [conn][Connection] Send Blocked Flags: ReasonFlags.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Send Blocked Flags: ReasonFlags.

Message #

[conn][%1] Send Blocked Flags: %2

Fields #

Name	Description
`Connection` Pointer
`ReasonFlags` UInt8

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5141
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5141

Event ID 5142: [conn][Connection] IN: BytesRecv=BytesReceived.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] IN: BytesRecv=BytesReceived.

Message #

[conn][%1] IN: BytesRecv=%2

Fields #

Name	Description
`Connection` Pointer
`BytesReceived` UInt64

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5142

Event ID 5143: [conn][Connection] CUBIC: SlowStartThreshold=SlowStartThreshold K=K WindowMax=WindowMax WindowLastMax=WindowLastMax.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] CUBIC: SlowStartThreshold=SlowStartThreshold K=K WindowMax=WindowMax WindowLastMax=WindowLastMax.

Message #

[conn][%1] CUBIC: SlowStartThreshold=%2 K=%3 WindowMax=%4 WindowLastMax=%5

Fields #

Name	Description
`Connection` Pointer
`SlowStartThreshold` UInt32
`K` UInt32
`WindowMax` UInt32
`WindowLastMax` UInt32

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5143
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5143

Event ID 5144: [conn][Connection] Congestion event.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Congestion event.

Message #

[conn][%1] Congestion event

Fields #

Name	Description
`Connection` Pointer

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5144
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5144

Event ID 5145: [conn][Connection] Persistent congestion event.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Persistent congestion event.

Message #

[conn][%1] Persistent congestion event

Fields #

Name	Description
`Connection` Pointer

Event ID 5146: [conn][Connection] Recovery complete.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Recovery complete.

Message #

[conn][%1] Recovery complete

Fields #

Name	Description
`Connection` Pointer

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5146

Event ID 5147: [conn][Connection] Rundown, IsServer=IsServer, CorrelationId=CorrelationId.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Rundown, IsServer=IsServer, CorrelationId=CorrelationId.

Message #

[conn][%1] Rundown, IsServer=%2, CorrelationId=%3

Fields #

Name	Description
`Connection` Pointer
`IsServer` UInt32
`CorrelationId` UInt64

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5147

Event ID 5148: [conn][Connection] (SeqNum=SequenceNumber) New Source CID: Cid.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] (SeqNum=SequenceNumber) New Source CID: Cid.

Message #

[conn][%1] (SeqNum=%2) New Source CID: %4

Fields #

Name	Description
`Connection` Pointer
`SequenceNumber` UInt64
`CidLength` UInt8
`Cid` Binary

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5148
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5148

Event ID 5149: [conn][Connection] (SeqNum=SequenceNumber) New Destination CID: Cid.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] (SeqNum=SequenceNumber) New Destination CID: Cid.

Message #

[conn][%1] (SeqNum=%2) New Destination CID: %4

Fields #

Name	Description
`Connection` Pointer
`SequenceNumber` UInt64
`CidLength` UInt8
`Cid` Binary

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5149
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5149

Event ID 5150: [conn][Connection] (SeqNum=SequenceNumber) Removed Source CID: Cid.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] (SeqNum=SequenceNumber) Removed Source CID: Cid.

Message #

[conn][%1] (SeqNum=%2) Removed Source CID: %4

Fields #

Name	Description
`Connection` Pointer
`SequenceNumber` UInt64
`CidLength` UInt8
`Cid` Binary

Event ID 5151: [conn][Connection] (SeqNum=SequenceNumber) Removed Destination CID: Cid.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] (SeqNum=SequenceNumber) Removed Destination CID: Cid.

Message #

[conn][%1] (SeqNum=%2) Removed Destination CID: %4

Fields #

Name	Description
`Connection` Pointer
`SequenceNumber` UInt64
`CidLength` UInt8
`Cid` Binary

Event ID 5152: [conn][Connection] Setting loss detection Type timer for DelayMs us.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Setting loss detection Type timer for DelayMs us. (ProbeCount=ProbeCount).

Message #

[conn][%1] Setting loss detection %2 timer for %3 us. (ProbeCount=%4)

Fields #

Name	Description
`Connection` Pointer
`Type` UInt8
`DelayMs` UInt32
`ProbeCount` UInt16

Event ID 5153: [conn][Connection] Cancelling loss detection timer.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Cancelling loss detection timer.

Message #

[conn][%1] Cancelling loss detection timer.

Fields #

Name	Description
`Connection` Pointer

Event ID 5154: [conn][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason.

Message #

[conn][%1] DROP packet Dst=%3 Src=%5 Reason=%6.

Fields #

Name	Description
`Owner` Pointer
`LocalAddrLength` UInt8
`LocalAddr` Binary
`RemoteAddrLength` UInt8
`RemoteAddr` Binary
`Reason` AnsiString

Event ID 5155: [conn][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason, Value.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason, Value.

Message #

[conn][%1] DROP packet Dst=%4 Src=%6 Reason=%7, %2.

Fields #

Name	Description
`Owner` Pointer
`Value` UInt64
`LocalAddrLength` UInt8
`LocalAddr` Binary
`RemoteAddrLength` UInt8
`RemoteAddr` Binary
`Reason` AnsiString

Event ID 5156: [conn][Connection] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] ERROR, ErrStr.

Message #

[conn][%1] ERROR, %2.

Fields #

Name	Description
`Connection` Pointer
`ErrStr` AnsiString

Event ID 5157: [conn][Connection] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] ERROR, Status, ErrStr.

Message #

[conn][%1] ERROR, %2, %3.

Fields #

Name	Description
`Connection` Pointer
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 5158: [conn][Connection] New packet keys created successfully.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] New packet keys created successfully.

Message #

[conn][%1] New packet keys created successfully.

Fields #

Name	Description
`Connection` Pointer

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5158
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5158

Event ID 5159: [conn][Connection] Key phase change (locally initiated=IsLocallyInitiated).

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Key phase change (locally initiated=IsLocallyInitiated).

Message #

[conn][%1] Key phase change (locally initiated=%2).

Fields #

Name	Description
`Connection` Pointer
`IsLocallyInitiated` UInt8

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5159
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5159

Event ID 5160: [conn][Connection] STATS: SRtt=SmoothedRtt CongestionCount=CongestionCount PersistentCongestionCount=PersistentCongestionCount SendTotalBytes=SendTotalBytes RecvTotalBytes=RecvTotalBytes Congestion...

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] STATS: SRtt=SmoothedRtt CongestionCount=CongestionCount PersistentCongestionCount=PersistentCongestionCount SendTotalBytes=SendTotalBytes RecvTotalBytes=RecvTotalBytes CongestionWindow=CongestionWindow Cc=Cc.

Message #

[conn][%1] STATS: SRtt=%2 CongestionCount=%3 PersistentCongestionCount=%4 SendTotalBytes=%5 RecvTotalBytes=%6 CongestionWindow=%7 Cc=%8

Fields #

Name	Description
`Connection` Pointer
`SmoothedRtt` UInt32
`CongestionCount` UInt32
`PersistentCongestionCount` UInt32
`SendTotalBytes` UInt64
`RecvTotalBytes` UInt64
`CongestionWindow` UInt32
`Cc` AnsiString

Event ID 5161: [conn][Connection] Shutdown complete, PeerFailedToAcknowledged=Value.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Shutdown complete, PeerFailedToAcknowledged=Value.

Message #

[conn][%1] Shutdown complete, PeerFailedToAcknowledged=%2.

Fields #

Name	Description
`Connection` Pointer
`Value` UInt8

Event ID 5162: [conn][Connection] Read Key Updated, NewValue.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Read Key Updated, NewValue.

Message #

[conn][%1] Read Key Updated, %2.

Fields #

Name	Description
`Connection` Pointer
`NewValue` UInt8

Event ID 5163: [conn][Connection] Write Key Updated, NewValue.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Write Key Updated, NewValue.

Message #

[conn][%1] Write Key Updated, %2.

Fields #

Name	Description
`Connection` Pointer
`NewValue` UInt8

Event ID 5164: [conn][Owner][TX][Number] Type (Length bytes).

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Owner][TX][Number] Type (Length bytes).

Message #

[conn][%1][TX][%2] %3 (%4 bytes)

Fields #

Name	Description
`Owner` Pointer
`Number` UInt64
`Type` UInt8
`Length` UInt16

Event ID 5165: [conn][Owner][RX][Number] Type (Length bytes).

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Owner][RX][Number] Type (Length bytes).

Message #

[conn][%1][RX][%2] %3 (%4 bytes)

Fields #

Name	Description
`Owner` Pointer
`Number` UInt64
`Type` UInt8
`Length` UInt16

Event ID 5166: [conn][Owner][TX][Number] Type Lost: Reason.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Owner][TX][Number] Type Lost: Reason.

Message #

[conn][%1][TX][%2] %3 Lost: %4

Fields #

Name	Description
`Owner` Pointer
`Number` UInt64
`Type` UInt8
`Reason` UInt8

Event ID 5167: [conn][Owner][TX][Number] Type ACKed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Owner][TX][Number] Type ACKed.

Message #

[conn][%1][TX][%2] %3 ACKed

Fields #

Name	Description
`Owner` Pointer
`Number` UInt64
`Type` UInt8

Event ID 5168: [conn][.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Message

Message #

[conn][%1] %2

Fields #

Name	Description
`Connection` Pointer
`Message` AnsiString

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5168
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5168

Event ID 5169: [conn][.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Message

Message #

[conn][%1] %2

Fields #

Name	Description
`Connection` Pointer
`Message` AnsiString

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5169

Event ID 5170: [conn][.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Message

Message #

[conn][%1] %2

Fields #

Name	Description
`Connection` Pointer
`Message` AnsiString

References #

Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5170

Event ID 5171: [conn][.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Message

Message #

[conn][%1] %2

Fields #

Name	Description
`Connection` Pointer
`Message` AnsiString

Event ID 5172: [conn][Connection] Queueing send flush, reason=Type.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Queueing send flush, reason=Type.

Message #

[conn][%1] Queueing send flush, reason=%2

Fields #

Name	Description
`Connection` Pointer
`Type` UInt32

Event ID 5173: [conn][Connection] OUT: StreamFC=StreamFlowControl StreamSendWindow=StreamSendWindow.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] OUT: StreamFC=StreamFlowControl StreamSendWindow=StreamSendWindow.

Message #

[conn][%1] OUT: StreamFC=%2 StreamSendWindow=%3

Fields #

Name	Description
`Connection` Pointer
`StreamFlowControl` UInt64
`StreamSendWindow` UInt64

Event ID 5174: [conn][Connection] STATS: SendTotalPackets=SendTotalPackets SendSuspectedLostPackets=SendSuspectedLostPackets SendSpuriousLostPackets=SendSpuriousLostPackets RecvTotalPackets=RecvTotalPackets RecvR...

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][] STATS: SendTotalPackets= SendSuspectedLostPackets= SendSpuriousLostPackets= RecvTotalPackets= RecvReorderedPackets= RecvDroppedPackets= RecvDuplicatePackets= RecvDecryptionFailures=.

Message #

[conn][%1] STATS: SendTotalPackets=%2 SendSuspectedLostPackets=%3 SendSpuriousLostPackets=%4 RecvTotalPackets=%5 RecvReorderedPackets=%6 RecvDroppedPackets=%7 RecvDuplicatePackets=%8 RecvDecryptionFailures=%9

Fields #

Name	Description
`Connection` Pointer
`SendTotalPackets` UInt64
`SendSuspectedLostPackets` UInt64
`SendSpuriousLostPackets` UInt64
`RecvTotalPackets` UInt64
`RecvReorderedPackets` UInt64
`RecvDroppedPackets` UInt64
`RecvDuplicatePackets` UInt64
`RecvDecryptionFailures` UInt64

Event ID 5175: [conn][Connection] Server app accepted resumption ticket.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Server app accepted resumption ticket.

Message #

[conn][%1] Server app accepted resumption ticket

Fields #

Name	Description
`Connection` Pointer

Event ID 5176: [conn][Connection] VerInfo Available Versions List: Vnl.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] VerInfo Available Versions List: Vnl.

Message #

[conn][%1] VerInfo Available Versions List: %3

Fields #

Name	Description
`Connection` Pointer
`VnlLength` UInt8
`Vnl` Binary

Event ID 5177: [conn][Connection] Client VI Received Version List: Vnl.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Client VI Received Version List: Vnl.

Message #

[conn][%1] Client VI Received Version List: %3

Fields #

Name	Description
`Connection` Pointer
`VnlLength` UInt8
`Vnl` Binary

Event ID 5178: [conn][Connection] Server VI Supported Version List: Vnl.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Server VI Supported Version List: Vnl.

Message #

[conn][%1] Server VI Supported Version List: %3

Fields #

Name	Description
`Connection` Pointer
`VnlLength` UInt8
`Vnl` Binary

Event ID 5179: [conn][Connection] Spurious congestion event.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Spurious congestion event.

Message #

[conn][%1] Spurious congestion event

Fields #

Name	Description
`Connection` Pointer

Event ID 5180: [conn][Connection] No Listener for IP address: Addr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] No Listener for IP address: Addr.

Message #

[conn][%1] No Listener for IP address: %3

Fields #

Name	Description
`Connection` Pointer
`AddrLength` UInt8
`Addr` Binary

Event ID 5181: [conn][Connection] No listener matching ALPN: Alpn.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] No listener matching ALPN: Alpn.

Message #

[conn][%1] No listener matching ALPN: %3

Fields #

Name	Description
`Connection` Pointer
`AlpnLength` UInt8
`Alpn` Binary

Event ID 5182: [conn][Connection] Flushing Send.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Flushing Send. Allowance=Value bytes.

Message #

[conn][%1] Flushing Send. Allowance=%2 bytes

Fields #

Name	Description
`Connection` Pointer
`Value` UInt32

Event ID 5183: [conn][Connection] Setting Type, delay=Delay us.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Setting Type, delay=Delay us.

Message #

[conn][%1] Setting %2, delay=%3 us

Fields #

Name	Description
`Connection` Pointer
`Type` UInt8
`Delay` UInt64

Event ID 5184: [conn][Connection] Canceling Type.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Canceling Type.

Message #

[conn][%1] Canceling %2

Fields #

Name	Description
`Connection` Pointer
`Type` UInt8

Event ID 5185: [conn][Connection] Type expired.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Type expired.

Message #

[conn][%1] %2 expired

Fields #

Name	Description
`Connection` Pointer
`Type` UInt8

Event ID 5186: [conn][Connection] BBR: State=BbrState RState=RecoveryState CongestionWindow=CongestionWindow BytesInFlight=BytesInFlight BytesInFlightMax=BytesInFlightMax MinRttEst=EstMinRtt EstBw=EstBw AppLimite...

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] BBR: State=BbrState RState=RecoveryState CongestionWindow=CongestionWindow BytesInFlight=BytesInFlight BytesInFlightMax=BytesInFlightMax MinRttEst=EstMinRtt EstBw=EstBw AppLimited=IsAppLimited.

Message #

[conn][%1] BBR: State=%2 RState=%3 CongestionWindow=%4 BytesInFlight=%5 BytesInFlightMax=%6 MinRttEst=%7 EstBw=%8 AppLimited=%9

Fields #

Name	Description
`Connection` Pointer
`BbrState` UInt32
`RecoveryState` UInt32
`CongestionWindow` UInt32
`BytesInFlight` UInt32
`BytesInFlightMax` UInt32
`EstMinRtt` UInt64
`EstBw` UInt64
`IsAppLimited` UInt32

Event ID 5187: [conn][Connection] Ecn: IsCapable=IsCapable.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Ecn: IsCapable=IsCapable.

Message #

[conn][%1] Ecn: IsCapable=%2

Fields #

Name	Description
`Connection` Pointer
`IsCapable` UInt32

Event ID 5188: [conn][Connection][EncryptLevel] ECN failed: EctCnt EcnEctCounter CeCnt EcnCeCounter TxEct NumPacketsSentWithEct DeltaSum EctCeDeltaSum State State.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection][EncryptLevel] ECN failed: EctCnt EcnEctCounter CeCnt EcnCeCounter TxEct NumPacketsSentWithEct DeltaSum EctCeDeltaSum State State.

Message #

[conn][%1][%2] ECN failed: EctCnt %3 CeCnt %4 TxEct %5 DeltaSum %6 State %7

Fields #

Name	Description
`Connection` Pointer
`EncryptLevel` UInt32
`EcnEctCounter` UInt64
`EcnCeCounter` UInt64
`NumPacketsSentWithEct` UInt64
`EctCeDeltaSum` Int64
`State` UInt8

Event ID 5189: [conn][Connection] Congestion event IsEcn=IsEcn.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Congestion event IsEcn=IsEcn.

Message #

[conn][%1] Congestion event IsEcn=%2

Fields #

Name	Description
`Connection` Pointer
`IsEcn` UInt8

Event ID 5190: [conn][Connection] STATS: SRtt=SmoothedRtt CongestionCount=CongestionCount PersistentCongestionCount=PersistentCongestionCount SendTotalBytes=SendTotalBytes RecvTotalBytes=RecvTotalBytes Congestion...

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

Message #

[conn][%1] STATS: SRtt=%2 CongestionCount=%3 PersistentCongestionCount=%4 SendTotalBytes=%5 RecvTotalBytes=%6 CongestionWindow=%7 Cc=%8 EcnCongestionCount=%9

Fields #

Name	Description
`Connection` Pointer
`SmoothedRtt` UInt32
`CongestionCount` UInt32
`PersistentCongestionCount` UInt32
`SendTotalBytes` UInt64
`RecvTotalBytes` UInt64
`CongestionWindow` UInt32
`Cc` AnsiString
`EcnCongestionCount` UInt32

Event ID 5191: [conn][Connection] HyStart: State=HyStartState CongestionWindow=CongestionWindow SlowStartThreshold=SlowStartThreshold.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] HyStart: State=HyStartState CongestionWindow=CongestionWindow SlowStartThreshold=SlowStartThreshold.

Message #

[conn][%1] HyStart: State=%2 CongestionWindow=%3 SlowStartThreshold=%4

Fields #

Name	Description
`Connection` Pointer
`HyStartState` UInt32
`CongestionWindow` UInt32
`SlowStartThreshold` UInt32

Event ID 5192: [conn][Connection] Recv Count UDP datagrams, Count2 bytes.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Recv Count UDP datagrams, Count2 bytes.

Message #

[conn][%1] Recv %2 UDP datagrams, %3 bytes

Fields #

Name	Description
`Connection` Pointer
`Count` UInt32
`Count2` UInt32

Event ID 5193: [conn][Connection] OUT: BytesSent=BytesSent InFlight=BytesInFlight CWnd=CongestionWindow ConnFC=ConnectionFlowControl ISB=IdealBytes PostedBytes=PostedBytes SRtt=SmoothedRtt 1Way=OneWayDelay.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] OUT: BytesSent=BytesSent InFlight=BytesInFlight CWnd=CongestionWindow ConnFC=ConnectionFlowControl ISB=IdealBytes PostedBytes=PostedBytes SRtt=SmoothedRtt 1Way=OneWayDelay.

Message #

[conn][%1] OUT: BytesSent=%2 InFlight=%3 CWnd=%4 ConnFC=%5 ISB=%6 PostedBytes=%7 SRtt=%8 1Way=%9

Fields #

Name	Description
`Connection` Pointer
`BytesSent` UInt64
`BytesInFlight` UInt32
`CongestionWindow` UInt32
`ConnectionFlowControl` UInt64
`IdealBytes` UInt64
`PostedBytes` UInt64
`SmoothedRtt` UInt64
`OneWayDelay` UInt64

Event ID 5194: [conn][Connection] STATS: SRtt=SmoothedRtt CongestionCount=CongestionCount PersistentCongestionCount=PersistentCongestionCount SendTotalBytes=SendTotalBytes RecvTotalBytes=RecvTotalBytes Congestion...

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

Message #

[conn][%1] STATS: SRtt=%2 CongestionCount=%3 PersistentCongestionCount=%4 SendTotalBytes=%5 RecvTotalBytes=%6 CongestionWindow=%7 Cc=%8 EcnCongestionCount=%9

Fields #

Name	Description
`Connection` Pointer
`SmoothedRtt` UInt64
`CongestionCount` UInt32
`PersistentCongestionCount` UInt32
`SendTotalBytes` UInt64
`RecvTotalBytes` UInt64
`CongestionWindow` UInt32
`Cc` AnsiString
`EcnCongestionCount` UInt32

Event ID 5195: [conn][Connection] Received APPLICATION_ERROR error, delaying close in expectation of a 1-RTT CONNECTION_CLOSE frame.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[conn][Connection] Received APPLICATION_ERROR error, delaying close in expectation of a 1-RTT CONNECTION_CLOSE frame.

Message #

[conn][%1] Received APPLICATION_ERROR error, delaying close in expectation of a 1-RTT CONNECTION_CLOSE frame.

Fields #

Name	Description
`Connection` Pointer

Event ID 6144: [strm][Stream] Created, Conn=Connection ID=ID IsLocal=IsLocalOwned.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Created, Conn=Connection ID=ID IsLocal=IsLocalOwned.

Message #

[strm][%1] Created, Conn=%2 ID=%3 IsLocal=%4

Fields #

Name	Description
`Stream` Pointer
`Connection` Pointer
`ID` UInt64
`IsLocalOwned` UInt8

Event ID 6145: [strm][Stream] Destroyed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Destroyed.

Message #

[strm][%1] Destroyed

Fields #

Name	Description
`Stream` Pointer

Event ID 6146: [strm][Stream] Send Blocked Flags: ReasonFlags.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Send Blocked Flags: ReasonFlags.

Message #

[strm][%1] Send Blocked Flags: %2

Fields #

Name	Description
`Stream` Pointer
`ReasonFlags` UInt8

Event ID 6147: [strm][Stream] Rundown, Conn=Connection ID=ID IsLocal=IsLocalOwned.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Rundown, Conn=Connection ID=ID IsLocal=IsLocalOwned.

Message #

[strm][%1] Rundown, Conn=%2 ID=%3 IsLocal=%4

Fields #

Name	Description
`Stream` Pointer
`Connection` Pointer
`ID` UInt64
`IsLocalOwned` UInt8

Event ID 6148: [strm][Stream] Send State: State.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Send State: State.

Message #

[strm][%1] Send State: %2

Fields #

Name	Description
`Stream` Pointer
`State` UInt8

Event ID 6149: [strm][Stream] Recv State: State.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Recv State: State.

Message #

[strm][%1] Recv State: %2

Fields #

Name	Description
`Stream` Pointer
`State` UInt8

Event ID 6150: [strm][Stream] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] ERROR, ErrStr.

Message #

[strm][%1] ERROR, %2.

Fields #

Name	Description
`Stream` Pointer
`ErrStr` AnsiString

Event ID 6151: [strm][Stream] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] ERROR, Status, ErrStr.

Message #

[strm][%1] ERROR, %2, %3.

Fields #

Name	Description
`Stream` Pointer
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 6152: [strm][.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Message

Message #

[strm][%1] %2

Fields #

Name	Description
`Stream` Pointer
`Message` AnsiString

Event ID 6153: [strm][.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Message

Message #

[strm][%1] %2

Fields #

Name	Description
`Stream` Pointer
`Message` AnsiString

Event ID 6154: [strm][.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Message

Message #

[strm][%1] %2

Fields #

Name	Description
`Stream` Pointer
`Message` AnsiString

Event ID 6155: [strm][.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Message

Message #

[strm][%1] %2

Fields #

Name	Description
`Stream` Pointer
`Message` AnsiString

Event ID 6156: [strm][Stream] Allocated, Conn=Connection.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Allocated, Conn=Connection.

Message #

[strm][%1] Allocated, Conn=%2

Fields #

Name	Description
`Stream` Pointer
`Connection` Pointer

Event ID 6157: [strm][Stream] Writing frames to packet ID.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Writing frames to packet ID.

Message #

[strm][%1] Writing frames to packet %2

Fields #

Name	Description
`Stream` Pointer
`ID` UInt64

Event ID 6158: [strm][Stream] Processing frame in packet ID.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Processing frame in packet ID.

Message #

[strm][%1] Processing frame in packet %2

Fields #

Name	Description
`Stream` Pointer
`ID` UInt64

Event ID 6159: [strm][Stream] Indicating QUIC_STREAM_EVENT_RECEIVE [BufLength bytes, BufCount buffers, Flags flags].

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Indicating QUIC_STREAM_EVENT_RECEIVE [BufLength bytes, BufCount buffers, Flags flags].

Message #

[strm][%1] Indicating QUIC_STREAM_EVENT_RECEIVE [%2 bytes, %3 buffers, %4 flags]

Fields #

Name	Description
`Stream` Pointer
`BufLength` UInt64
`BufCount` UInt32
`Flags` UInt32

Event ID 6160: [strm][Stream] Receive complete [ID bytes].

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Receive complete [ID bytes].

Message #

[strm][%1] Receive complete [%2 bytes]

Fields #

Name	Description
`Stream` Pointer
`ID` UInt64

Event ID 6161: [strm][Stream] App queuing send [BufLength bytes, BufCount buffers, Flags flags].

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] App queuing send [BufLength bytes, BufCount buffers, Flags flags].

Message #

[strm][%1] App queuing send [%2 bytes, %3 buffers, %4 flags]

Fields #

Name	Description
`Stream` Pointer
`BufLength` UInt64
`BufCount` UInt32
`Flags` UInt32

Event ID 6162: [strm][Stream] Done processing frame.

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Done processing frame.

Message #

[strm][%1] Done processing frame

Fields #

Name	Description
`Stream` Pointer

Event ID 6163: [strm][Stream] Receive complete call [ID bytes].

Provider: Microsoft-Quic
Channel: Application
Opcode: Stream

Description

[strm][Stream] Receive complete call [ID bytes].

Message #

[strm][%1] Receive complete call [%2 bytes]

Fields #

Name	Description
`Stream` Pointer
`ID` UInt64

Event ID 7168: [bind][Binding] Created, Udp=Socket LocalAddr=LocalAddr RemoteAddr=RemoteAddr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Binding

Description

[bind][Binding] Created, Udp=Socket LocalAddr=LocalAddr RemoteAddr=RemoteAddr.

Message #

[bind][%1] Created, Udp=%2 LocalAddr=%4 RemoteAddr=%6

Fields #

Name	Description
`Binding` Pointer
`Socket` Pointer
`LocalAddrLength` UInt8
`LocalAddr` Binary
`RemoteAddrLength` UInt8
`RemoteAddr` Binary

Event ID 7169: [bind][Binding] Rundown, Udp=Socket LocalAddr=LocalAddr RemoteAddr=RemoteAddr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Binding

Description

[bind][Binding] Rundown, Udp=Socket LocalAddr=LocalAddr RemoteAddr=RemoteAddr.

Message #

[bind][%1] Rundown, Udp=%2 LocalAddr=%4 RemoteAddr=%6

Fields #

Name	Description
`Binding` Pointer
`Socket` Pointer
`LocalAddrLength` UInt8
`LocalAddr` Binary
`RemoteAddrLength` UInt8
`RemoteAddr` Binary

Event ID 7170: [bind][Binding] Destroyed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Binding

Description

[bind][Binding] Destroyed.

Message #

[bind][%1] Destroyed

Fields #

Name	Description
`Binding` Pointer

Event ID 7171: [bind][Binding] Cleaning up.

Provider: Microsoft-Quic
Channel: Application
Opcode: Binding

Description

[bind][Binding] Cleaning up.

Message #

[bind][%1] Cleaning up

Fields #

Name	Description
`Binding` Pointer

Event ID 7172: [bind][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason.

Provider: Microsoft-Quic
Channel: Application
Opcode: Binding

Description

[bind][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason.

Message #

[bind][%1] DROP packet Dst=%3 Src=%5 Reason=%6.

Fields #

Name	Description
`Owner` Pointer
`LocalAddrLength` UInt8
`LocalAddr` Binary
`RemoteAddrLength` UInt8
`RemoteAddr` Binary
`Reason` AnsiString

Event ID 7173: [bind][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason, Value.

Provider: Microsoft-Quic
Channel: Application
Opcode: Binding

Description

[bind][Owner] DROP packet Dst=LocalAddr Src=RemoteAddr Reason=Reason, Value.

Message #

[bind][%1] DROP packet Dst=%4 Src=%6 Reason=%7, %2.

Fields #

Name	Description
`Owner` Pointer
`Value` UInt64
`LocalAddrLength` UInt8
`LocalAddr` Binary
`RemoteAddrLength` UInt8
`RemoteAddr` Binary
`Reason` AnsiString

Event ID 7174: [bind][Binding] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Binding

Description

[bind][Binding] ERROR, ErrStr.

Message #

[bind][%1] ERROR, %2.

Fields #

Name	Description
`Binding` Pointer
`ErrStr` AnsiString

Event ID 7175: [bind][Binding] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Binding

Description

[bind][Binding] ERROR, Status, ErrStr.

Message #

[bind][%1] ERROR, %2, %3.

Fields #

Name	Description
`Binding` Pointer
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 7176: [bind][Binding] Execute: Type.

Provider: Microsoft-Quic
Channel: Application
Opcode: Binding

Description

[bind][Binding] Execute: Type.

Message #

[bind][%1] Execute: %2

Fields #

Name	Description
`Binding` Pointer
`Type` UInt32

Event ID 8192: [ tls][Connection] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[ tls][Connection] ERROR, ErrStr.

Message #

[ tls][%1] ERROR, %2.

Fields #

Name	Description
`Connection` Pointer
`ErrStr` AnsiString

Event ID 8193: [ tls][Connection] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[ tls][Connection] ERROR, Status, ErrStr.

Message #

[ tls][%1] ERROR, %2, %3.

Fields #

Name	Description
`Connection` Pointer
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 8194: [ tls][.

Provider: Microsoft-Quic
Channel: Application
Opcode: Connection

Description

[ tls][Connection] Message

Message #

[ tls][%1] %2

Fields #

Name	Description
`Connection` Pointer
`Message` AnsiString

Event ID 9217: [data][UdpBinding] Send TotalSize bytes in BufferCount buffers (segment=SegmentSize) Dst=RemoteAddr Src=LocalAddr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Datapath

Description

[data][UdpBinding] Send TotalSize bytes in BufferCount buffers (segment=SegmentSize) Dst=RemoteAddr Src=LocalAddr.

Message #

[data][%1] Send %2 bytes in %3 buffers (segment=%4) Dst=%6 Src=%8

Fields #

Name	Description
`UdpBinding` Pointer
`TotalSize` UInt32
`BufferCount` UInt8
`SegmentSize` UInt16
`RemoteAddrLength` UInt8
`RemoteAddr` Binary
`LocalAddrLength` UInt8
`LocalAddr` Binary

Event ID 9218: [data][UdpBinding] Recv TotalSize bytes (segment=SegmentSize) Src=LocalAddr Dst=RemoteAddr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Datapath

Description

[data][UdpBinding] Recv TotalSize bytes (segment=SegmentSize) Src=LocalAddr Dst=RemoteAddr.

Message #

[data][%1] Recv %2 bytes (segment=%3) Src=%5 Dst=%7

Fields #

Name	Description
`UdpBinding` Pointer
`TotalSize` UInt32
`SegmentSize` UInt16
`LocalAddrLength` UInt8
`LocalAddr` Binary
`RemoteAddrLength` UInt8
`RemoteAddr` Binary

Event ID 9219: [data][UdpBinding] ERROR, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Datapath

Description

[data][UdpBinding] ERROR, ErrStr.

Message #

[data][%1] ERROR, %2.

Fields #

Name	Description
`UdpBinding` Pointer
`ErrStr` AnsiString

Event ID 9220: [data][UdpBinding] ERROR, Status, ErrStr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Datapath

Description

[data][UdpBinding] ERROR, Status, ErrStr.

Message #

[data][%1] ERROR, %2, %3.

Fields #

Name	Description
`UdpBinding` Pointer
`Status` UInt32	NTSTATUS reference
`ErrStr` AnsiString

Event ID 9221: [data][UdpBinding] Created, local=LocalAddr, remote=RemoteAddr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Datapath

Description

[data][UdpBinding] Created, local=LocalAddr, remote=RemoteAddr.

Message #

[data][%1] Created, local=%3, remote=%5

Fields #

Name	Description
`UdpBinding` Pointer
`LocalAddrLength` UInt8
`LocalAddr` Binary
`RemoteAddrLength` UInt8
`RemoteAddr` Binary

Event ID 9222: [data][UdpBinding] Destroyed.

Provider: Microsoft-Quic
Channel: Application
Opcode: Datapath

Description

[data][UdpBinding] Destroyed.

Message #

[data][%1] Destroyed

Fields #

Name	Description
`UdpBinding` Pointer

Event ID 9223: [data][UdpBinding] Querying route, local=LocalAddr, remote=RemoteAddr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Datapath

Description

[data][UdpBinding] Querying route, local=LocalAddr, remote=RemoteAddr.

Message #

[data][%1] Querying route, local=%3, remote=%5

Fields #

Name	Description
`UdpBinding` Pointer
`LocalAddrLength` UInt8
`LocalAddr` Binary
`RemoteAddrLength` UInt8
`RemoteAddr` Binary

Event ID 9224: [data][UdpBinding] Query route result: LocalAddr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Datapath

Description

[data][UdpBinding] Query route result: LocalAddr.

Message #

[data][%1] Query route result: %3

Fields #

Name	Description
`UdpBinding` Pointer
`LocalAddrLength` UInt8
`LocalAddr` Binary

Event ID 9225: [data][UdpBinding] Send SegmentSize bytes TCP control packet Flags=TcpFlags Dst=RemoteAddr Src=LocalAddr.

Provider: Microsoft-Quic
Channel: Application
Opcode: Datapath

Description

[data][UdpBinding] Send SegmentSize bytes TCP control packet Flags=TcpFlags Dst=RemoteAddr Src=LocalAddr.

Message #

[data][%1] Send %2 bytes TCP control packet Flags=%3 Dst=%5 Src=%7

Fields #

Name	Description
`UdpBinding` Pointer
`SegmentSize` UInt32
`TcpFlags` UInt8
`RemoteAddrLength` UInt8
`RemoteAddr` Binary
`LocalAddrLength` UInt8
`LocalAddr` Binary

Event ID 10240: Message.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

Message

Message #

%1

Fields #

Name	Description
`Message` AnsiString

Event ID 10241: Message.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

Message

Message #

%1

Fields #

Name	Description
`Message` AnsiString

Event ID 10242: Message.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

Message

Message #

%1

Fields #

Name	Description
`Message` AnsiString

Event ID 10243: Message.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

Message

Message #

%1

Fields #

Name	Description
`Message` AnsiString

Event ID 11264: [pack][ID] Created in batch ID2.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[pack][ID] Created in batch ID2.

Message #

[pack][%1] Created in batch %2

Fields #

Name	Description
`ID` UInt64
`ID2` UInt64

Event ID 11265: [pack][ID] Encrypting.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[pack][ID] Encrypting.

Message #

[pack][%1] Encrypting

Fields #

Name	Description
`ID` UInt64

Event ID 11266: [pack][ID] Finalizing.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[pack][ID] Finalizing.

Message #

[pack][%1] Finalizing

Fields #

Name	Description
`ID` UInt64

Event ID 11267: [pack][ID] Batch sent.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[pack][ID] Batch sent.

Message #

[pack][%1] Batch sent

Fields #

Name	Description
`ID` UInt64

Event ID 11268: [pack][ID] Received.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[pack][ID] Received.

Message #

[pack][%1] Received

Fields #

Name	Description
`ID` UInt64

Event ID 11269: [pack][ID] Decrypting.

Provider: Microsoft-Quic
Channel: Application
Opcode: Global

Description

[pack][ID] Decrypting.

Message #

[pack][%1] Decrypting

Fields #

Name	Description
`ID` UInt64

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {FF15E657-4F26-570E-88AB-0796B258D11C}

Defined in msquic.sys, the binary that emits these events.

Observed on:

Win11-26200.6584, sample captured from a live trace, binary version 2.5.1.126760398, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 2.4.14.128972089, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 2.5.1.126760398, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)