Microsoft-Windows-Iphlpsvc-Trace

193 events across 5 channels

Event	Title	Channel	Sample
4051	Teredo ServiceType: Forwarding TeredoPacketType packet from Source IP Address to …	Trace	N
4052	Teredo server: Received ReceivedTeredoPacketType from Source IP Address , …	Trace	N
4053	Teredo destination received target, Mapping to IpAddrLength.	Trace	N
4054	Teredo client in state TeredoProtocolState,received bad or invalid packet with …	Trace	N
4055	Teredo client state change: Previous state PreviousTeredoProtocolState, Current …	Trace	N
4056	Teredo client Sending TeredoPacketType packet.	Trace	N
4057	Starting Teredo Offload with: LocalV6:LocalV4 RemoteV6:RemoteV4 …	Trace	N
4058	Description.	Trace	N
4059	Teredo server received bad or invalid packet with Bad or Invalid Packet.	Trace	N
4060	ServiceType MappingType mapping: SocketAddress.	Trace	N
4061	Teredo Primary or Secondary transmitting packet to Destination Address.	Trace	N
4062	Teredo ServiceType received TeredoPacketType packet from Source Ipv6 Address.	Trace	N
4063	Teredo ServiceType received ReceivedTeredoPacketType, sending …	Trace	N
4064	Teredo ServiceType received ReceivedTeredoPacketType, sending …	Trace	N
4065	Teredo Primary or Secondary received packet from Socket Address.	Trace	N
4066	Teredo ServiceType received packet type TeredoPacketType.	Trace	N
4067	Teredo ServiceType transmitting TeredoPacketType packet to Destination Address.	Trace	N
4068	Teredo connectivity initiated by Program.	System	N
4069	Program using Teredo connectivity.	System	N
4070	Program no longer using Teredo connectivity.	System	N
4071	Teredo connectivity ended by Program.	System	N
4150	ProtocolType interface Interface InterfaceState.	Trace	N
4151	ISATAP link local address for interface Interface was Current IPv4 Address, is …	Trace	N
4152	ISATAP potential router interface list has changed.	Trace	N
4153	ProtocolType: Found route to Destination IPv4 Address from interface Interface.	Trace	N
4154	ProtocolType: For InterfaceName, router Router IPv4 Address is Reachable.	Debug	N
4155	For InterfaceName, router name: RouterName, is Resolved.	Debug	N
4157	ProtocolType protocol started.	Trace	N
4158	ProtocolType protocol stopped.	Trace	N
4159	ProtocolType protocol initialized.	Trace	N
4160	ProtocolType protocol uninitialized.	Trace	N
4161	ISATAP found interface InterfaceName to reuse.	Trace	N
4162	ProtocolType: interface InterfaceName address IPv4 Address AddedorDeleted.	Trace	N
4163	6to4: Updating route IP Address/PrefixLen interface InterfaceAlias metric Metric …	Trace	N
4164	6to4: Configuring interface InterfaceAlias with following parameters.	Trace	N
4165	6to4: Routing State changed to New RoutingState from Old RoutingState.	Trace	N
4166	6to4: For interface InterfaceAlias, IPv4 address IP Address was chosen for link …	Trace	N
4167	ProtocolType:Change notification for compartment CompartmentId, …	Trace	N
4168	6to4: Configuring interface Interface Index in compartment CompartmentId with …	Trace	N
4169	Configuring interface InterfaceAlias with address IP Address, lifetime Lifetime, …	Trace	N
4170	ProtocolCallback Callback for ProtocolType.	Trace	N
4171	Teredo Client failed to start due to the following reason: TeredoReasonCode.	Trace	N
4172	Teredo Client stopped due to the following reason: TeredoReasonCode.	Trace	N
4173	6TO4 failed to start due to the following reason: Windows Error Code.	Trace	N
4174	ISATAP router address IsatapRouter was set with status ErrorCode.	Trace	N
4175	NLM found that the network is NetworkType.	Trace	N
4176	Port-Prediction complete with: V4Addr:SourceIPv4Address V4Port:SourcePort.	Trace	N
4177	Teredo operation in action: Action.	Trace	N
4178	Teredo operation started: Teredo_operation_started.	Trace	N
4179	Teredo operation ended: Teredo_operation_ended.	Trace	N
4180	Teredo operation failed: Teredo_operation_failed.	Trace	N
5000	IPHTTPS: InterfaceName:IPHTTPS_InterfaceName InterfaceType:InterfaceType …	Trace	N
5001	IPHTTPS: Interface InterfaceName installation failed.	Trace	N
5002	IPHTTPS: Interface InterfaceName update link address.	Trace	N
5003	IPHTTPS: Client interface InterfaceName configured to use certificate …	Trace	N
5004	IPHTTPS: Interface InterfaceName cleanup complete.	Trace	N
5005	IPHTTPS: Interface InterfaceName firewall exception added.	Trace	N
5006	IPHTTPS: Interface InterfaceName performance counters added.	Trace	N
5007	IPHTTPS: Interface Object Memory allocation failed.	Trace	N
5008	IPHTTPS: Interface InterfaceName Tunnel device IO failed: StatusCode.	Trace	N
5009	IPHTTPS: Interface InterfaceName reusing an previously installed interface.	Trace	N
5010	IPHTTPS: Interface InterfaceName deleted.	Trace	N
5011	IPHTTPS: Interface InterfaceName media connect indication: Status= StatusCode.	Trace	N
5012	IPHTTPS: Interface InterfaceName media disconnect indication: Status= …	Trace	N
5013	IPHTTPS: Interface InterfaceName deactivated.	Trace	N
5014	IPHTTPS: Adapter InterfaceName uninstalled as it does not have associated …	Trace	N
5015	IPHTTPS: V6 Address change callback.	Trace	N
5016	IPHTTPS: Global connectivity state change.	Trace	N
5017	IPHTTPS: Interface callback.	Trace	N
5018	IPHTTPS: Interface InterfaceName activated.	Trace	N
5019	IPHTTPS: Corp connectivity timer started.	Trace	N
5020	IPHTTPS: Corp connectivity timeout.	Trace	N
5021	IPHTTPS: Network change.	Trace	N
5022	IPHTTPS: Teredo dormancy change.	Trace	N
5023	IPHTTPS: Initialization failed.	Trace	N
5024	IPHTTPS: ND Packet.	Trace	N
5025	IPHTTPS: Client interface is being shutdown.	Trace	N
5026	IPHTTPS: Client IO Reference Object.	Trace	N
5027	IPHTTPS: Client IO Dereference Object.	Trace	N
5028	IPHTTPS: IPHTTPS Client Send Http Request: Status = InterfaceName.	Trace	N
5029	IPHTTPS: IPHTTPS Client Send Receive Response: Status = InterfaceName.	Trace	N
5030	IPHTTPS: IPHTTPS Client Send Http Status Code = InterfaceName.	Trace	N
5031	IPHTTPS: IPHTTPS Client Receive Entity Completion Status = InterfaceName.	Trace	N
5032	IPHTTPS: IPHTTPS Client Send Entity Completion Status = InterfaceName.	Trace	N
5033	IPHTTPS: IPHTTPS Client Scheduling a reconnect after InterfaceName seconds.	Trace	N
5034	IPHTTPS: IPHTTPS Client restarting.	Trace	N
5035	IPHTTPS: IPHTTPS Client restarting due to internet connectivity.	Trace	N
5036	IPHTTPS: IPHTTPS Adding Client address mapping for address InterfaceName.	Trace	N
5037	IPHTTPS: IPHTTPS Removing Client address mapping for address InterfaceName.	Trace	N
5038	IPHTTPS: IPHTTPS Adding Pending packet for address InterfaceName.	Trace	N
5039	IPHTTPS: IPHTTPS Removing Pending packet for address InterfaceName.	Trace	N
5040	IPHTTPS: IPHTTPS Receive client certificate completed.	Trace	N
5041	IPHTTPS: IPHTTPS Send HTTP response completed.	Trace	N
5042	IPHTTPS: IPHTTPS Receive request completed.	Trace	N
5043	IPHTTPS: IPHTTPS Receive entity completed.	Trace	N
5044	IPHTTPS: IPHTTPS Send entity completed.	Trace	N
5045	IPHTTPS: IPHTTPS Dropped packet destined to InterfaceName due to neighbor …	Trace	N
5046	IPHTTPS: IPHTTPS Sending neighbor solicitation for InterfaceName.	Trace	N
5047	IPHTTPS: IPHTTPS Interface Reference Object.	Trace	N
5048	IPHTTPS: IPHTTPS Interface Dereference Object.	Trace	N
5049	IPHTTPS: IPHTTPS Client Interface Reference Object.	Trace	N
5050	IPHTTPS: IPHTTPS Client Interface Dereference Object.	Trace	N
5051	IPHTTPS: IPHTTPS Server Interface Reference Object.	Trace	N
5052	IPHTTPS: IPHTTPS Server Interface Dereference Object.	Trace	N
5053	IPHTTPS: IPHTTPS Client Context Reference Object.	Trace	N
5054	IPHTTPS: IPHTTPS Client Context Dereference Object.	Trace	N
5055	IPHTTPS: Interface InterfaceName installation aborted.	Trace	N
5061	IPHTTPS: Received WMI notification (WmiNotificationType) for interface …	Trace	N
5062	IPHTTPS: Received configuration change notification.	Trace	N
5063	IPHTTPS: IPHTTPS WinHTTP open failed with error code = InterfaceName.	Trace	N
5064	IPHTTPS: IPHTTPS failed to get proxy information; error code = InterfaceName.	Trace	N
5065	IPHTTPS: IPHTTPS proxy information: Access type = InterfaceName; proxy = …	Trace	N
5066	IPHTTPS: Client interface InterfaceName is being shutdown.	Trace	N
5067	IPHTTPS: Sending Duplicate Address Detection Response to client (ClientContext) …	Trace	N
5068	IPHTTPS: Interface canary is Value.	Trace	N
5069	IPHTTPS.	Trace	Y
5100	DNS64: Query of type A from client ClientIP for name QuestionName, received on …	Trace	N
5101	DNS64: Query of type AAAA from client ClientIP for name QuestionName, received …	Trace	N
5102	DNS64: No matching IPv6 prefix found for IPv4 address Translated IPv4 Address, …	Trace	N
5103	DNS64: Configured A query latency value is too high.	Trace	N
5104	DNS64: AAAA response IPv6 Address received after A response IPv4 Address to …	Trace	N
5105	DNS64: DNS64 Module Init Failed with status Value.	Trace	N
5106	DNS64: DNS64 Instance Create Object.	Trace	N
5107	DNS64: DNS64 Instance Delete Object.	Trace	N
5108	DNS64: DNS64 Instance Free Object.	Trace	N
5109	DNS64: DNS64 Instance Reference Object.	Trace	N
5110	DNS64: DNS64 Instance Dereference Object.	Trace	N
5111	DNS64: DNS64 Request Object Create, with instance Object2.	Trace	N
5112	DNS64: DNS64 Request Object Free.	Trace	N
5113	DNS64: DNS64 Request Reference Object.	Trace	N
5114	DNS64: DNS64 Request Dereference Object.	Trace	N
5115	DNS64: DNS64 Request Processing - request Object with query type Value for name …	Trace	N
5116	DNS64: DNS64 Request Processing - request Object completed with response code …	Trace	N
5117	DNS64: DNS64 Request Processing - request Object cancelled.	Trace	N
5118	DNS64: DNS64 Request Processing - AAAA query issued for request Object, …	Trace	N
5119	DNS64: DNS64 Request Processing - AAAA query issued for request Object completed …	Trace	N
5120	DNS64: DNS64 Request Processing - AAAA query cancelled for request Object.	Trace	N
5121	DNS64: DNS64 Request Processing - A query issued for request Object, DnsQueryEx …	Trace	N
5122	DNS64: DNS64 Request Processing - A query issued for request Object completed …	Trace	N
5123	DNS64: DNS64 Request Processing - A query cancelled for request Object.	Trace	N
5124	DNS64: DNS64 Request Processing - A query timer started for request Object.	Trace	N
5125	DNS64: DNS64 Request Processing - A query timer fired for request Object with …	Trace	N
5126	DNS64: DNS64 Request Processing - Forwarded query issued for request Object, …	Trace	N
5127	DNS64: DNS64 Request Processing - Forwarded query issued for request Object …	Trace	N
5128	DNS64: DNS64 Request Processing - Forwarded query cancelled for request Object.	Trace	N
5129	DNS64: DNS64 Request Processing - Processing locally PTR query matched …	Trace	N
5130	DNS64: DNS64 Request Processing - Copying records from AAAA query results for …	Trace	N
5131	DNS64: DNS64 Request Processing - Synthesizing records from A query results for …	Trace	N
5132	DNS64: DNS64 Request Processing - Merging records from A query results for …	Trace	N
5133	DNS64: DNS64 Request Processing - Copying records from AAAA query results to …	Trace	N
5200	Connectivity Platform operation in action: {Action}.	Iphlpsvc Etw Channel	N
5201	Connectivity Platform operation started: {Action}.	Iphlpsvc Etw Channel	N
5202	Connectivity Platform operation ended: {Action}.	Iphlpsvc Etw Channel	N
5203	Connectivity Platform operation failed: {Action}.	Iphlpsvc Etw Channel	N
5300	HA: {Action} started.	Iphlpsvc Etw Channel	N
5301	HA: {Action} failed with status {Status}.	Iphlpsvc Etw Channel	N
5302	HA: HEP discovery succeeded; found {Count} addresses.	Iphlpsvc Etw Channel	N
5303	HA: Connection attempt failed; retrying {Count} more times.	Iphlpsvc Etw Channel	N
5304	HA: Successfully connected to network {Network ID}.	Iphlpsvc Etw Channel	N
5401	PROXYMGR: Reason: notifying providers of event: Event.	Trace	N
5402	PROXYMGR: Reason: notifying clients of event: Event.	Trace	N
5403	PROXYMGR: PROXYMGR failed with status Action.	Trace	N
5404	PROXYMGR.	Trace	N
5501	DA MULTISITE: Configuring site SiteName selected based on SiteSelectionMethod.	Trace	N
5502	DA MULTISITE: Configured AD site name, status Status.	Trace	N
5503	DA MULTISITE: Added a prefix to the prefix policy table, status Status.	Trace	N
5504	DA MULTISITE: Configured IPHTTPS to use profile IphttpsProfileName, status …	Trace	N
5505	DA MULTISITE: Configured Teredo to use server TeredoServerIp, status Status.	Trace	N
5506	DA MULTISITE: Removed configuration for site SiteName.	Trace	N
5508	DA MULTISITE: Site ProbingSiteName is selected based on probing.	Trace	N
5509	DA MULTISITE: Name resolution for multisite FQDN Message started with error code …	Trace	N
5510	DA MULTISITE: Name resolution for multisite FQDN Action cancelled.	Trace	N
5511	DA MULTISITE: Name resolution for multisite FQDN Message completed with error …	Trace	N
5512	DA MULTISITE: No potentially reachable site record found for the IP address …	Trace	N
5513	DA MULTISITE: Site probing preparation finished with Value site probes prepared.	Trace	N
5514	DA MULTISITE: Site probing prepared for URL SiteUrl at timestamp Timestamp.	Trace	N
5515	DA MULTISITE: Site probing started for URL SiteUrl with error code ErrorCode at …	Trace	N
5516	DA MULTISITE: Site probing cancelled for URL Action.	Trace	N
5517	DA MULTISITE: Site probe for URL SiteUrl completed with error code ErrorCode, …	Trace	N
5518	DA MULTISITE: Timer expired in state Value.	Trace	N
5519	DASTMGR.	Trace	N
5550	ISATAP.	Trace	N
5600	6to4.	Trace	N
5607	DA MULTISITE: Corporate connectivity has been indicated in Delay milliseconds or …	Trace	N
5650	COMMON.	Trace	N
5651	ERROR.	Trace	N
5652	Action.	Trace	N
5653	FSM.	Trace	N
5654	Action.	Trace	N
5655	PortProxy: PortProxy.	Trace	N
5656	CLATMGR:	Operational	N
5656	CLATMGR.	Trace	N
5657	Event ID 5657	Operational	N

Event ID 4051: Teredo ServiceType: Forwarding TeredoPacketType packet from Source IP Address to Destination IP Address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo ServiceType: Forwarding TeredoPacketType packet from Source IP Address to Destination IP Address.

Message #

Teredo %2: Forwarding %3 packet from %4 to %5.

Fields #

Name	Description
`IpAddrLength` UInt32
`ServiceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`TeredoPacketType` UInt32
`SourceIPAddress` Binary
`DestinationIPAddress` Binary

Event ID 4052: Teredo server: Received ReceivedTeredoPacketType from Source IP Address , Sending SentTeredoPacketType to Destination IP Address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo server: Received ReceivedTeredoPacketType from Source IP Address , Sending SentTeredoPacketType to Destination IP Address.

Message #

Teredo server: Received %2 from %3 , Sending %4 to %5.

Fields #

Name	Description
`IpAddrLength` UInt32
`ReceivedTeredoPacketType` UInt32
`SourceIPAddress` Binary
`SentTeredoPacketType` UInt32
`DestinationIPAddress` Binary

Event ID 4053: Teredo destination received target, Mapping to IpAddrLength.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo destination received target, Mapping to IpAddrLength.

Message #

Teredo %2 received %3, Mapping to %4.
 source: %5, destination: %6, target: %7.

Fields #

Name	Description
`IpAddrLength` UInt32
`ServiceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`ReceivedTeredoPacketType` UInt32
`MappedTeredoPacketType` UInt32
`SourceIPAddress` Binary
`DestinationIPAddress` Binary
`TargetIPAddress` Binary

Event ID 4054: Teredo client in state TeredoProtocolState,received bad or invalid packet with Bad or Invalid Packet.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo client in state TeredoProtocolState,received bad or invalid packet with Bad or Invalid Packet.

Message #

Teredo client in state %1,received bad or invalid packet with %2.

Fields #

Name	Description
`TeredoProtocolState` UInt32
`BadorInvalidPacket` UInt32

Event ID 4055: Teredo client state change: Previous state PreviousTeredoProtocolState, Current state CurrentTeredoProtocolState.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo client state change: Previous state PreviousTeredoProtocolState, Current state CurrentTeredoProtocolState.

Message #

Teredo client state change: Previous state %1, Current state %2.

Fields #

Name	Description
`PreviousTeredoProtocolState` UInt32
`CurrentTeredoProtocolState` UInt32

Event ID 4056: Teredo client Sending TeredoPacketType packet.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo client Sending TeredoPacketType packet.

Message #

Teredo client Sending %1 packet.

Fields #

Name	Description
`TeredoPacketType` UInt32

Event ID 4057: Starting Teredo Offload with: LocalV6:LocalV4 RemoteV6:RemoteV4 LocalV4:LocalPort RemoteV4:RemotePort LocalPort:IpAddrV4Length RemotePort:IpAddrV6Length.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Starting Teredo Offload with.

Message #

Starting Teredo Offload with: 
LocalV6:%3 RemoteV6:%4 
LocalV4:%5 RemoteV4:%6 
LocalPort:%7 RemotePort:%8.

Fields #

Name	Description
`IpAddrV4Length` UInt32
`IpAddrV6Length` UInt32
`SourceIpv6Address` Binary
`DestinationIPv6Address` Binary
`SourceIPv4Address` UInt32
`DestinationIPv4Address` UInt32
`SourcePort` UInt16
`DestinationPort` UInt16

Event ID 4058: Description.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Message #

%1

Fields #

Name	Description
`Description` UnicodeString

Event ID 4059: Teredo server received bad or invalid packet with Bad or Invalid Packet.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo server received bad or invalid packet with Bad or Invalid Packet.

Message #

Teredo server received bad or invalid packet with %1.

Fields #

Name	Description
`BadorInvalidPacket` UInt32

Event ID 4060: ServiceType MappingType mapping: SocketAddress.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ServiceType MappingType mapping: SocketAddress.

Message #

%2 %3 mapping: %4.

Fields #

Name	Description
`SockAddrLength` UInt32
`ServiceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`MappingType` UInt32
`SocketAddress` Binary

Event ID 4061: Teredo Primary or Secondary transmitting packet to Destination Address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo Primary or Secondary transmitting packet to Destination Address.

Message #

Teredo %2 transmitting packet to %3.

Fields #

Name	Description
`AddrLength` UInt32
`PrimaryorSecondary` UnicodeString
`DestinationAddress` Binary

Event ID 4062: Teredo ServiceType received TeredoPacketType packet from Source Ipv6 Address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo ServiceType received TeredoPacketType packet from Source Ipv6 Address.

Message #

Teredo %2 received %3 packet from %4.

Fields #

Name	Description
`AddrLength` UInt32
`ServiceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`TeredoPacketType` UInt32
`SourceIpv6Address` Binary

Event ID 4063: Teredo ServiceType received ReceivedTeredoPacketType, sending MappedTeredoPacketType to Destination IP Address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo ServiceType received ReceivedTeredoPacketType, sending MappedTeredoPacketType to Destination IP Address.

Message #

Teredo %2 received %3, sending %4 to %5.

Fields #

Name	Description
`IpAddrLength` UInt32
`ServiceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`ReceivedTeredoPacketType` UInt32
`MappedTeredoPacketType` UInt32
`DestinationIPAddress` Binary

Event ID 4064: Teredo ServiceType received ReceivedTeredoPacketType, sending MappedTeredoPacketType to Destination IP Address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo ServiceType received ReceivedTeredoPacketType, sending MappedTeredoPacketType to Destination IP Address.

Message #

Teredo %2 received %3, sending %4 to %5.

Fields #

Name	Description
`AddrLength` UInt32
`ServiceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`ReceivedTeredoPacketType` UInt32
`MappedTeredoPacketType` UInt32
`DestinationIPAddress` Binary

Event ID 4065: Teredo Primary or Secondary received packet from Socket Address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo Primary or Secondary received packet from Socket Address.

Message #

Teredo %2 received packet from %3.

Fields #

Name	Description
`AddrLength` UInt32
`PrimaryorSecondary` UnicodeString
`SocketAddress` Binary

Event ID 4066: Teredo ServiceType received packet type TeredoPacketType.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo ServiceType received packet type TeredoPacketType.

Message #

Teredo %2 received packet type %3;
 with source %4 destination %5 target %6.

Fields #

Name	Description
`AddrLength` UInt32
`ServiceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`TeredoPacketType` UInt32
`SourceIpv6Address` Binary
`DestinationIPAddress` Binary
`TargetIPAddress` Binary

Event ID 4067: Teredo ServiceType transmitting TeredoPacketType packet to Destination Address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo ServiceType transmitting TeredoPacketType packet to Destination Address.

Message #

Teredo %2 transmitting %3 packet to %4.

Fields #

Name	Description
`AddrLength` UInt32
`ServiceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`TeredoPacketType` UInt32
`DestinationAddress` Binary

Event ID 4068: Teredo connectivity initiated by Program.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: System
Opcode: Info

Description

Teredo connectivity initiated by Program.

Message #

Teredo connectivity initiated by %1

Fields #

Name	Description
`Program` UnicodeString

Event ID 4069: Program using Teredo connectivity.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: System
Opcode: Info

Description

Program using Teredo connectivity.

Message #

%1 using Teredo connectivity

Fields #

Name	Description
`Program` UnicodeString

Event ID 4070: Program no longer using Teredo connectivity.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: System
Opcode: Info

Description

Program no longer using Teredo connectivity.

Message #

%1 no longer using Teredo connectivity

Fields #

Name	Description
`Program` UnicodeString

Event ID 4071: Teredo connectivity ended by Program.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: System
Opcode: Info

Description

Teredo connectivity ended by Program.

Message #

Teredo connectivity ended by %1

Fields #

Name	Description
`Program` UnicodeString

Event ID 4150: ProtocolType interface Interface InterfaceState.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ProtocolType interface Interface InterfaceState.

Message #

%1 interface %2 %3.

Fields #

Name	Description
`ProtocolType` UInt32
`Interface` UnicodeString
`InterfaceState` UInt32

Event ID 4151: ISATAP link local address for interface Interface was Current IPv4 Address, is New IPv4 Address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ISATAP link local address for interface Interface was Current IPv4 Address, is New IPv4 Address.

Message #

ISATAP link local address for interface %2 was %3, is %4.

Fields #

Name	Description
`AddrLength` UInt32
`Interface` UnicodeString
`CurrentIPv4Address` UInt32
`NewIPv4Address` UInt32

Event ID 4152: ISATAP potential router interface list has changed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ISATAP potential router interface list has changed.

Message #

ISATAP potential router interface list has changed.

Event ID 4153: ProtocolType: Found route to Destination IPv4 Address from interface Interface.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ProtocolType: Found route to Destination IPv4 Address from interface Interface.

Message #

%2: Found route to %3 from interface %4.
Source = %5, Next Hop = %6.

Fields #

Name	Description
`AddrLength` UInt32
`ProtocolType` UInt32
`DestinationIPv4Address` UInt32
`Interface` UnicodeString
`SourceIPv4Address` UInt32
`NextHopIPv4Address` UInt32

Event ID 4154: ProtocolType: For InterfaceName, router Router IPv4 Address is Reachable.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Debug
Opcode: Info

Description

ProtocolType: For InterfaceName, router Router IPv4 Address is Reachable.

Message #

%2: For %3, router %4 is %5.

Fields #

Name	Description
`AddrLength` UInt32
`ProtocolType` UInt32
`InterfaceName` UnicodeString
`RouterIPv4Address` UInt32
`Reachable` UInt32

Event ID 4155: For InterfaceName, router name: RouterName, is Resolved.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Debug
Opcode: Info

Description

For InterfaceName, router name: RouterName, is Resolved. Router IPv4 Address.

Message #

For %2, router name: %3, is %4. %5.

Fields #

Name	Description
`AddrLength` UInt32
`InterfaceName` UnicodeString
`RouterName` UnicodeString
`Resolved` UInt32
`RouterIPv4Address` UInt32

Event ID 4157: ProtocolType protocol started.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ProtocolType protocol started.

Message #

%1 protocol started.

Fields #

Name	Description
`ProtocolType` UInt32

Event ID 4158: ProtocolType protocol stopped.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ProtocolType protocol stopped.

Message #

%1 protocol stopped.

Fields #

Name	Description
`ProtocolType` UInt32

Event ID 4159: ProtocolType protocol initialized.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ProtocolType protocol initialized.

Message #

%1 protocol initialized.

Fields #

Name	Description
`ProtocolType` UInt32

Event ID 4160: ProtocolType protocol uninitialized.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ProtocolType protocol uninitialized.

Message #

%1 protocol uninitialized.

Fields #

Name	Description
`ProtocolType` UInt32

Event ID 4161: ISATAP found interface InterfaceName to reuse.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ISATAP found interface InterfaceName to reuse.

Message #

ISATAP found interface %1 to reuse.

Fields #

Name	Description
`InterfaceName` UnicodeString

Event ID 4162: ProtocolType: interface InterfaceName address IPv4 Address AddedorDeleted.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ProtocolType: interface InterfaceName address IPv4 Address AddedorDeleted.

Message #

%2: interface %5 address %4 %3.

Fields #

Name	Description
`AddrLength` UInt32
`ProtocolType` UInt32
`AddedorDeleted` UInt32
`IPv4Address` UInt32
`InterfaceName` UnicodeString

Event ID 4163: 6to4: Updating route IP Address/PrefixLen interface InterfaceAlias metric Metric lifetime PreferredLifetime/ValidLifeTime publish Publish.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

6to4: Updating route IP Address/PrefixLen interface InterfaceAlias metric Metric lifetime PreferredLifetime/ValidLifeTime publish Publish.

Message #

6to4: Updating route %2/%3 interface %4 metric %5 lifetime %6/%7 publish %8.

Fields #

Name	Description
`AddrLength` UInt32
`IPAddress` Binary
`PrefixLen` UInt64
`InterfaceAlias` UnicodeString
`Metric` UInt32
`PreferredLifetime` UInt32
`ValidLifeTime` UInt32
`Publish` Boolean

Event ID 4164: 6to4: Configuring interface InterfaceAlias with following parameters.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

6to4: Configuring interface InterfaceAlias with following parameters.

Message #

6to4: Configuring interface %1 with following parameters:
ICS PrivateInterface = %2 AdvertiseDefaultRoute = %3 Advertises = %4 Forwards = %5 NTStatus = %6.

Fields #

Name	Description
`InterfaceAlias` UnicodeString
`IcsPrivateInterface` Boolean
`AdvertiseDefaultRoute` Boolean
`Advertises` Boolean
`Forwards` Boolean
`Status` UInt64	NTSTATUS reference

Event ID 4165: 6to4: Routing State changed to New RoutingState from Old RoutingState.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

6to4: Routing State changed to New RoutingState from Old RoutingState.

Message #

6to4: Routing State changed to %1 from %2.

Fields #

Name	Description
`NewRoutingState` UInt32
`OldRoutingState` UInt32

Event ID 4166: 6to4: For interface InterfaceAlias, IPv4 address IP Address was chosen for link layer address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

6to4: For interface InterfaceAlias, IPv4 address IP Address was chosen for link layer address.

Message #

6to4: For interface %1, IPv4 address %2 was chosen for link layer address.

Fields #

Name	Description
`InterfaceAlias` UnicodeString
`IPAddress` UInt32

Event ID 4167: ProtocolType:Change notification for compartment CompartmentId, HaveGlobalIPv6Address = HaveGlobalIpv6Address, ICS Enabled = ICS Enabled, GlobalIPv4AddressCount = GlobalIPv4AddressCount.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ProtocolType:Change notification for compartment CompartmentId, HaveGlobalIPv6Address = HaveGlobalIpv6Address, ICS Enabled = ICS Enabled, GlobalIPv4AddressCount = GlobalIPv4AddressCount.

Message #

%1:Change notification for compartment %2, HaveGlobalIPv6Address = %3, ICS Enabled =  %4, GlobalIPv4AddressCount = %5.

Fields #

Name	Description
`ProtocolType` UInt32
`CompartmentId` UInt32
`HaveGlobalIpv6Address` Boolean
`ICSEnabled` Boolean
`GlobalIPv4AddressCount` UInt64

Event ID 4168: 6to4: Configuring interface Interface Index in compartment CompartmentId with routing state RoutingState.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

6to4: Configuring interface Interface Index in compartment CompartmentId with routing state RoutingState.

Message #

6to4: Configuring interface %1 in compartment %2 with routing state %3.

Fields #

Name	Description
`InterfaceIndex` UInt64
`CompartmentId` UInt32
`RoutingState` UInt32

Event ID 4169: Configuring interface InterfaceAlias with address IP Address, lifetime Lifetime, prefix PrefixConf suffix SuffixConf.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Configuring interface InterfaceAlias with address IP Address, lifetime Lifetime, prefix PrefixConf suffix SuffixConf.

Message #

Configuring interface %2 with address %3, lifetime %4, prefix %5 suffix %6.

Fields #

Name	Description
`AddrLength` UInt32
`InterfaceAlias` UnicodeString
`IPAddress` Binary
`Lifetime` UInt64
`PrefixConf` UInt64
`SuffixConf` UInt64

Event ID 4170: ProtocolCallback Callback for ProtocolType.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ProtocolCallback Callback for ProtocolType.

Message #

%1 Callback for %2.

Fields #

Name	Description
`ProtocolCallback` UInt32
`ProtocolType` UInt32

Event ID 4171: Teredo Client failed to start due to the following reason: TeredoReasonCode.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo Client failed to start due to the following reason: TeredoReasonCode.

Message #

Teredo Client failed to start due to the following reason: %1.

Fields #

Name	Description
`TeredoReasonCode` UInt32

Event ID 4172: Teredo Client stopped due to the following reason: TeredoReasonCode.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo Client stopped due to the following reason: TeredoReasonCode.

Message #

Teredo Client stopped due to the following reason: %1.

Fields #

Name	Description
`TeredoReasonCode` UInt32

Event ID 4173: 6TO4 failed to start due to the following reason: Windows Error Code.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

6TO4 failed to start due to the following reason: Windows Error Code.

Message #

6TO4 failed to start due to the following reason: %1.

Fields #

Name	Description
`WindowsErrorCode` UInt32

Event ID 4174: ISATAP router address IsatapRouter was set with status ErrorCode.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ISATAP router address IsatapRouter was set with status ErrorCode.

Message #

ISATAP router address %1 was set with status %2.

Fields #

Name	Description
`IsatapRouter` UnicodeString
`ErrorCode` UInt32

Event ID 4175: NLM found that the network is NetworkType.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

NLM found that the network is NetworkType.

Message #

NLM found that the network is %1.

Fields #

Name	Description
`NetworkType` UInt32

Event ID 4176: Port-Prediction complete with: V4Addr:SourceIPv4Address V4Port:SourcePort.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Port-Prediction complete with: V4Addr:SourceIPv4Address V4Port:SourcePort.

Message #

Port-Prediction complete with: V4Addr:%1 V4Port:%2 
LowerValue:%3 UpperValue:%4 
PortPredicted:%5.

Fields #

Name	Description
`SourceIPv4Address` UInt32
`SourcePort` UInt16
`UpperValue` UInt16
`LowerValue` UInt16
`PortPredicted` UInt16

Event ID 4177: Teredo operation in action: Action.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo operation in action: Action.

Message #

Teredo operation in action: %1.

Fields #

Name	Description
`Action` UnicodeString

Event ID 4178: Teredo operation started: Teredo_operation_started.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo operation started: Teredo_operation_started.

Message #

Teredo operation started: %1.

Fields #

Name	Description
`Action` UnicodeString

Event ID 4179: Teredo operation ended: Teredo_operation_ended.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo operation ended: Teredo_operation_ended.

Message #

Teredo operation ended: %1.

Fields #

Name	Description
`Action` UnicodeString

Event ID 4180: Teredo operation failed: Teredo_operation_failed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Teredo operation failed: Teredo_operation_failed.

Message #

Teredo operation failed: %1.

Fields #

Name	Description
`Action` UnicodeString

Event ID 5000: IPHTTPS: InterfaceName:IPHTTPS_InterfaceName InterfaceType:InterfaceType RegistryState:RegistryState CurrentState:CurrentState URL:URL AuthenticationMode:AuthenticationMode.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: InterfaceName:IPHTTPS_InterfaceName InterfaceType:InterfaceType RegistryState:RegistryState CurrentState:CurrentState URL:URL AuthenticationMode:AuthenticationMode.

Message #

IPHTTPS: InterfaceName:%1 InterfaceType:%2 RegistryState:%3 CurrentState:%4 URL:%5 AuthenticationMode:%6

Fields #

Name	Description
`InterfaceName` UnicodeString
`InterfaceType` UInt32
`RegistryState` UInt32
`CurrentState` UInt32
`URL` UnicodeString
`AuthenticationMode` UInt32

Event ID 5001: IPHTTPS: Interface InterfaceName installation failed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName installation failed. Status = StatusCode.

Message #

IPHTTPS: Interface %1 installation failed. Status = %2

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5002: IPHTTPS: Interface InterfaceName update link address.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName update link address. Status = StatusCode.

Message #

IPHTTPS: Interface %1 update link address. Status = %2

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5003: IPHTTPS: Client interface InterfaceName configured to use certificate CertificateCN with preference = Preference.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Client interface InterfaceName configured to use certificate CertificateCN with preference = Preference.

Message #

IPHTTPS: Client interface %1 configured to use certificate %2 with preference = %3

Fields #

Name	Description
`InterfaceName` UnicodeString
`CertificateCN` UnicodeString
`Preference` UInt32

Event ID 5004: IPHTTPS: Interface InterfaceName cleanup complete.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName cleanup complete.

Message #

IPHTTPS: Interface %1 cleanup complete

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5005: IPHTTPS: Interface InterfaceName firewall exception added.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName firewall exception added. Status = StatusCode.

Message #

IPHTTPS: Interface %1 firewall exception added. Status = %2

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5006: IPHTTPS: Interface InterfaceName performance counters added.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName performance counters added. Status = StatusCode.

Message #

IPHTTPS: Interface %1 performance counters added. Status = %2

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5007: IPHTTPS: Interface Object Memory allocation failed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface Object Memory allocation failed.

Message #

IPHTTPS: Interface %1 Memory allocation failed

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5008: IPHTTPS: Interface InterfaceName Tunnel device IO failed: StatusCode.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName Tunnel device IO failed: StatusCode.

Message #

IPHTTPS: Interface %1 Tunnel device IO failed: %2

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5009: IPHTTPS: Interface InterfaceName reusing an previously installed interface.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName reusing an previously installed interface.

Message #

IPHTTPS: Interface %1 reusing an previously installed interface

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5010: IPHTTPS: Interface InterfaceName deleted.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName deleted.

Message #

IPHTTPS: Interface %1 deleted

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5011: IPHTTPS: Interface InterfaceName media connect indication: Status= StatusCode.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName media connect indication: Status= StatusCode.

Message #

IPHTTPS: Interface %1 media connect indication: Status= %2

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5012: IPHTTPS: Interface InterfaceName media disconnect indication: Status= StatusCode.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName media disconnect indication: Status= StatusCode.

Message #

IPHTTPS: Interface %1 media disconnect indication: Status= %2

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5013: IPHTTPS: Interface InterfaceName deactivated.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName deactivated.

Message #

IPHTTPS: Interface %1 deactivated.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5014: IPHTTPS: Adapter InterfaceName uninstalled as it does not have associated registry configuration.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Adapter InterfaceName uninstalled as it does not have associated registry configuration.Status = StatusCode.

Message #

IPHTTPS: Adapter %1 uninstalled as it does not have associated registry configuration.Status = %2

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5015: IPHTTPS: V6 Address change callback.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: V6 Address change callback. Address = Address Added = Added LimitedConnectivity = LimitedConnectivity.

Message #

IPHTTPS: V6 Address change callback. Address = %2 Added = %3 LimitedConnectivity = %4

Fields #

Name	Description
`InterfaceIndex` UInt32
`Address` UnicodeString
`Added` Boolean
`LimitedConnectivity` Boolean

Event ID 5016: IPHTTPS: Global connectivity state change.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Global connectivity state change. GlobalAddressCount = GlobalIpv6AddressCount Ipv4Connectivity = Ipv4Connectivity Ipv6Connectivity = Ipv6Connectivity CorpConnectivity = CorpConnectivity.

Message #

IPHTTPS: Global connectivity state change. GlobalAddressCount = %1 Ipv4Connectivity = %2 Ipv6Connectivity = %3 CorpConnectivity = %4

Fields #

Name	Description
`GlobalIpv6AddressCount` UInt32
`Ipv4Connectivity` Boolean
`Ipv6Connectivity` Boolean
`CorpConnectivity` Boolean

Event ID 5017: IPHTTPS: Interface callback.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface callback. Index = InterfaceIndex Added = Added LimitedConnectivity = LimitedConnectivity.

Message #

IPHTTPS: Interface callback. Index = %1 Added = %3 LimitedConnectivity = %4

Fields #

Name	Description
`InterfaceIndex` UInt32
`Address` UnicodeString
`Added` Boolean
`LimitedConnectivity` Boolean

Event ID 5018: IPHTTPS: Interface InterfaceName activated.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName activated.

Message #

IPHTTPS: Interface %1 activated.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5019: IPHTTPS: Corp connectivity timer started.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Corp connectivity timer started. Due time = DueTime (100ns units).

Message #

IPHTTPS: Corp connectivity timer started. Due time = %1 (100ns units).

Fields #

Name	Description
`DueTime` UInt32

Event ID 5020: IPHTTPS: Corp connectivity timeout.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Corp connectivity timeout.

Message #

IPHTTPS: Corp connectivity timeout.

Fields #

Name	Description
`DueTime` UInt32

Event ID 5021: IPHTTPS: Network change.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Network change. Network GUID = NetworkGuid Added = Added.

Message #

IPHTTPS: Network change. Network GUID = %1 Added = %2

Fields #

Name	Description
`NetworkGuid` GUID
`Added` Boolean

Event ID 5022: IPHTTPS: Teredo dormancy change.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Teredo dormancy change. New State = CurrentTeredoProtocolState.

Message #

IPHTTPS: Teredo dormancy change. New State = %1

Fields #

Name	Description
`CurrentTeredoProtocolState` UInt32

Event ID 5023: IPHTTPS: Initialization failed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Initialization failed. Status = InterfaceName.

Message #

IPHTTPS: Initialization failed. Status = %1

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5024: IPHTTPS: ND Packet.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: ND Packet. Packet type = PacketType, Target Address = TargetAddress, Prefix = Prefix, Default Router = DefaultRouter.

Message #

IPHTTPS: ND Packet. Packet type = %1, Target Address = %2, Prefix = %3, Default Router = %4.

Fields #

Name	Description
`PacketType` UInt32
`TargetAddress` UnicodeString
`Prefix` UnicodeString
`DefaultRouter` Boolean

Event ID 5025: IPHTTPS: Client interface is being shutdown.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Client interface is being shutdown.

Message #

IPHTTPS: Client interface is being shutdown.

Event ID 5026: IPHTTPS: Client IO Reference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Client IO Reference Object.

Message #

IPHTTPS: Client IO Reference %1.

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5027: IPHTTPS: Client IO Dereference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Client IO Dereference Object.

Message #

IPHTTPS: Client IO Dereference %1.

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5028: IPHTTPS: IPHTTPS Client Send Http Request: Status = InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Send Http Request: Status = InterfaceName.

Message #

IPHTTPS: %1 Client Send Http Request: Status = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5029: IPHTTPS: IPHTTPS Client Send Receive Response: Status = InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Send Receive Response: Status = InterfaceName.

Message #

IPHTTPS: %1 Client Send Receive Response: Status = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5030: IPHTTPS: IPHTTPS Client Send Http Status Code = InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Send Http Status Code = InterfaceName.

Message #

IPHTTPS: %1 Client Send Http Status Code = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5031: IPHTTPS: IPHTTPS Client Receive Entity Completion Status = InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Receive Entity Completion Status = InterfaceName.

Message #

IPHTTPS: %1 Client Receive Entity Completion Status = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5032: IPHTTPS: IPHTTPS Client Send Entity Completion Status = InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Send Entity Completion Status = InterfaceName.

Message #

IPHTTPS: %1 Client Send Entity Completion Status = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5033: IPHTTPS: IPHTTPS Client Scheduling a reconnect after InterfaceName seconds.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Scheduling a reconnect after InterfaceName seconds.

Message #

IPHTTPS: %1 Client Scheduling a reconnect after %2 seconds.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5034: IPHTTPS: IPHTTPS Client restarting.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client restarting.

Message #

IPHTTPS: %1 Client restarting.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5035: IPHTTPS: IPHTTPS Client restarting due to internet connectivity.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client restarting due to internet connectivity.

Message #

IPHTTPS: %1 Client restarting due to internet connectivity.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5036: IPHTTPS: IPHTTPS Adding Client address mapping for address InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Adding Client address mapping for address InterfaceName.

Message #

IPHTTPS: %1 Adding Client address mapping for address %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`Address` UnicodeString

Event ID 5037: IPHTTPS: IPHTTPS Removing Client address mapping for address InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Removing Client address mapping for address InterfaceName.

Message #

IPHTTPS: %1 Removing Client address mapping for address %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`Address` UnicodeString

Event ID 5038: IPHTTPS: IPHTTPS Adding Pending packet for address InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Adding Pending packet for address InterfaceName.

Message #

IPHTTPS: %1 Adding Pending packet for address %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`Address` UnicodeString

Event ID 5039: IPHTTPS: IPHTTPS Removing Pending packet for address InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Removing Pending packet for address InterfaceName.

Message #

IPHTTPS: %1 Removing Pending packet for address %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`Address` UnicodeString

Event ID 5040: IPHTTPS: IPHTTPS Receive client certificate completed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Receive client certificate completed. Status = InterfaceName.

Message #

IPHTTPS: %1 Receive client certificate completed. Status = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5041: IPHTTPS: IPHTTPS Send HTTP response completed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Send HTTP response completed. Status = InterfaceName.

Message #

IPHTTPS: %1 Send HTTP response completed. Status = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5042: IPHTTPS: IPHTTPS Receive request completed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Receive request completed. Status = InterfaceName.

Message #

IPHTTPS: %1 Receive request completed. Status = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5043: IPHTTPS: IPHTTPS Receive entity completed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Receive entity completed. Status = InterfaceName.

Message #

IPHTTPS: %1 Receive entity completed. Status = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5044: IPHTTPS: IPHTTPS Send entity completed.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Send entity completed. Status = InterfaceName.

Message #

IPHTTPS: %1 Send entity completed. Status = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5045: IPHTTPS: IPHTTPS Dropped packet destined to InterfaceName due to neighbor discovery timeout.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Dropped packet destined to InterfaceName due to neighbor discovery timeout.

Message #

IPHTTPS: %1 Dropped packet destined to %2 due to neighbor discovery timeout.

Fields #

Name	Description
`InterfaceName` UnicodeString
`DestinationAddress` UnicodeString

Event ID 5046: IPHTTPS: IPHTTPS Sending neighbor solicitation for InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Sending neighbor solicitation for InterfaceName.

Message #

IPHTTPS: %1 Sending neighbor solicitation for %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`DestinationAddress` UnicodeString

Event ID 5047: IPHTTPS: IPHTTPS Interface Reference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Interface Reference Object.

Message #

IPHTTPS: IPHTTPS Interface Reference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5048: IPHTTPS: IPHTTPS Interface Dereference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Interface Dereference Object.

Message #

IPHTTPS: IPHTTPS Interface Dereference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5049: IPHTTPS: IPHTTPS Client Interface Reference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Interface Reference Object.

Message #

IPHTTPS: IPHTTPS Client Interface Reference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5050: IPHTTPS: IPHTTPS Client Interface Dereference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Interface Dereference Object.

Message #

IPHTTPS: IPHTTPS Client Interface Dereference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5051: IPHTTPS: IPHTTPS Server Interface Reference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Server Interface Reference Object.

Message #

IPHTTPS: IPHTTPS Server Interface Reference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5052: IPHTTPS: IPHTTPS Server Interface Dereference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Server Interface Dereference Object.

Message #

IPHTTPS: IPHTTPS Server Interface Dereference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5053: IPHTTPS: IPHTTPS Client Context Reference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Context Reference Object.

Message #

IPHTTPS: IPHTTPS Client Context Reference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5054: IPHTTPS: IPHTTPS Client Context Dereference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS Client Context Dereference Object.

Message #

IPHTTPS: IPHTTPS Client Context Dereference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5055: IPHTTPS: Interface InterfaceName installation aborted.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface InterfaceName installation aborted. IPHTTPS is disabled by DisabledComponents registry.

Message #

IPHTTPS: Interface %1 installation aborted. IPHTTPS is disabled by DisabledComponents registry

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5061: IPHTTPS: Received WMI notification (WmiNotificationType) for interface InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Received WMI notification (WmiNotificationType) for interface InterfaceName.

Message #

IPHTTPS: Received WMI notification (%1) for interface %2

Fields #

Name	Description
`WmiNotificationType` UInt32
`InterfaceName` UnicodeString

Event ID 5062: IPHTTPS: Received configuration change notification.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Received configuration change notification.

Message #

IPHTTPS: Received configuration change notification.

Event ID 5063: IPHTTPS: IPHTTPS WinHTTP open failed with error code = InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS WinHTTP open failed with error code = InterfaceName.

Message #

IPHTTPS: %1 WinHTTP open failed with error code = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5064: IPHTTPS: IPHTTPS failed to get proxy information; error code = InterfaceName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS failed to get proxy information; error code = InterfaceName.

Message #

IPHTTPS: %1 failed to get proxy information; error code = %2.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5065: IPHTTPS: IPHTTPS proxy information: Access type = InterfaceName; proxy = ProxyAccessType; bypass = Proxy.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: IPHTTPS proxy information: Access type = InterfaceName; proxy = ProxyAccessType; bypass = Proxy.

Message #

IPHTTPS: %1 proxy information: Access type = %2; proxy = %3; bypass = %4.

Fields #

Name	Description
`InterfaceName` UnicodeString
`ProxyAccessType` UInt32
`Proxy` UnicodeString
`ProxyBypass` UnicodeString

Event ID 5066: IPHTTPS: Client interface InterfaceName is being shutdown.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Client interface InterfaceName is being shutdown.

Message #

IPHTTPS: Client interface %1 is being shutdown.

Fields #

Name	Description
`InterfaceName` UnicodeString
`StatusCode` UInt32	NTSTATUS reference

Event ID 5067: IPHTTPS: Sending Duplicate Address Detection Response to client (ClientContext) for Target: TargetAddress.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Sending Duplicate Address Detection Response to client (ClientContext) for Target: TargetAddress.

Message #

IPHTTPS: Sending Duplicate Address Detection Response to client (%1) for Target: %2

Fields #

Name	Description
`ClientContext` Pointer
`TargetAddress` UnicodeString

Event ID 5068: IPHTTPS: Interface canary is Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

IPHTTPS: Interface canary is Value.

Message #

IPHTTPS: Interface canary is %1

Fields #

Name	Description
`Value` Pointer

Event ID 5069: IPHTTPS.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Also via: realtime ETW trace
Level: Informational
Opcode: Info

Description

IPHTTPS: Action

Message #

IPHTTPS: %1

Fields #

Name	Description
`Action` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Iphlpsvc-Trace",
    "guid": "{6600E712-C3B6-44A2-8A48-935C511F28C8}",
    "event_source_name": "",
    "event_id": 5069,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": "0x0000000000000004",
    "time_created": "2026-06-02T05:25:24.188+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 3160,
      "thread_id": 3236
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Action": "RegOpenKeyEx: Key = SOFTWARE\\Policies\\Microsoft\\Windows\\Tcpip\\v6Transition\\IPHTTPSProfiles: Status = 2"
  },
  "message": ""
}

Event ID 5100: DNS64: Query of type A from client ClientIP for name QuestionName, received on interface QueryReceiveInterface and sent on interface QuerySendInterface, failed with code DnsStatus.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: Query of type A from client ClientIP for name QuestionName, received on interface QueryReceiveInterface and sent on interface QuerySendInterface, failed with code DnsStatus.

Message #

DNS64: Query of type A from client %2 for name %3, received on interface %4 and sent on interface %5, failed with code %6.

Fields #

Name	Description
`AddrLength` UInt32
`ClientIP` Binary
`QuestionName` UnicodeString
`QueryReceiveInterface` UnicodeString
`QuerySendInterface` UnicodeString
`DnsStatus` UInt32

Event ID 5101: DNS64: Query of type AAAA from client ClientIP for name QuestionName, received on interface QueryReceiveInterface and sent on interface QuerySendInterface, failed with code DnsStatus.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: Query of type AAAA from client ClientIP for name QuestionName, received on interface QueryReceiveInterface and sent on interface QuerySendInterface, failed with code DnsStatus.

Message #

DNS64: Query of type AAAA from client %2 for name %3, received on interface %4 and sent on interface %5, failed with code %6.

Fields #

Name	Description
`AddrLength` UInt32
`ClientIP` Binary
`QuestionName` UnicodeString
`QueryReceiveInterface` UnicodeString
`QuerySendInterface` UnicodeString
`DnsStatus` UInt32

Event ID 5102: DNS64: No matching IPv6 prefix found for IPv4 address Translated IPv4 Address, received for name QuestionName queried by client ClientIP.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: No matching IPv6 prefix found for IPv4 address Translated IPv4 Address, received for name QuestionName queried by client ClientIP.

Message #

DNS64: No matching IPv6 prefix found for IPv4 address %4, received for name %3 queried by client %2.

Fields #

Name	Description
`AddrLength` UInt32
`ClientIP` Binary
`QuestionName` UnicodeString
`TranslatedIPv4Address` UInt32

Event ID 5103: DNS64: Configured A query latency value is too high.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: Configured A query latency value is too high.

Message #

DNS64: Configured A query latency value is too high.

Event ID 5104: DNS64: AAAA response IPv6 Address received after A response IPv4 Address to query for name QuestionName by client ClientIP.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: AAAA response IPv6 Address received after A response IPv4 Address to query for name QuestionName by client ClientIP.

Message #

DNS64: AAAA response %5 received after A response %4 to query for name %3 by client %2.

Fields #

Name	Description
`AddrLength` UInt32
`ClientIP` Binary
`QuestionName` UnicodeString
`IPv4Address` UInt32
`IPv6Address` Binary

Event ID 5105: DNS64: DNS64 Module Init Failed with status Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Module Init Failed with status Value.

Message #

DNS64: DNS64 Module Init Failed with status %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5106: DNS64: DNS64 Instance Create Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Instance Create Object.

Message #

DNS64: DNS64 Instance Create %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5107: DNS64: DNS64 Instance Delete Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Instance Delete Object.

Message #

DNS64: DNS64 Instance Delete %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5108: DNS64: DNS64 Instance Free Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Instance Free Object.

Message #

DNS64: DNS64 Instance Free %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5109: DNS64: DNS64 Instance Reference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Instance Reference Object.

Message #

DNS64: DNS64 Instance Reference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5110: DNS64: DNS64 Instance Dereference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Instance Dereference Object.

Message #

DNS64: DNS64 Instance Dereference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5111: DNS64: DNS64 Request Object Create, with instance Object2.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Object Create, with instance Object2.

Message #

DNS64: DNS64 Request %1 Create, with instance %4

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32
`Object2` Pointer

Event ID 5112: DNS64: DNS64 Request Object Free.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Object Free.

Message #

DNS64: DNS64 Request %1 Free

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5113: DNS64: DNS64 Request Reference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Reference Object.

Message #

DNS64: DNS64 Request Reference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5114: DNS64: DNS64 Request Dereference Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Dereference Object.

Message #

DNS64: DNS64 Request Dereference %1

Fields #

Name	Description
`Object` Pointer
`FileName` AnsiString
`LineNumber` UInt32

Event ID 5115: DNS64: DNS64 Request Processing - request Object with query type Value for name Message.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - request Object with query type Value for name Message.

Message #

DNS64: DNS64 Request Processing - request %1 with query type %3 for name %2

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5116: DNS64: DNS64 Request Processing - request Object completed with response code Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - request Object completed with response code Value.

Message #

DNS64: DNS64 Request Processing - request %1 completed with response code %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5117: DNS64: DNS64 Request Processing - request Object cancelled.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - request Object cancelled.

Message #

DNS64: DNS64 Request Processing - request %1 cancelled

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5118: DNS64: DNS64 Request Processing - AAAA query issued for request Object, DnsQueryEx returned status Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - AAAA query issued for request Object, DnsQueryEx returned status Value.

Message #

DNS64: DNS64 Request Processing - AAAA query issued for request %1, DnsQueryEx returned status %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5119: DNS64: DNS64 Request Processing - AAAA query issued for request Object completed with status Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - AAAA query issued for request Object completed with status Value.

Message #

DNS64: DNS64 Request Processing - AAAA query issued for request %1 completed with status %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5120: DNS64: DNS64 Request Processing - AAAA query cancelled for request Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - AAAA query cancelled for request Object.

Message #

DNS64: DNS64 Request Processing - AAAA query cancelled for request %1

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5121: DNS64: DNS64 Request Processing - A query issued for request Object, DnsQueryEx returned status Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - A query issued for request Object, DnsQueryEx returned status Value.

Message #

DNS64: DNS64 Request Processing - A query issued for request %1, DnsQueryEx returned status %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5122: DNS64: DNS64 Request Processing - A query issued for request Object completed with status Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - A query issued for request Object completed with status Value.

Message #

DNS64: DNS64 Request Processing - A query issued for request %1 completed with status %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5123: DNS64: DNS64 Request Processing - A query cancelled for request Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - A query cancelled for request Object.

Message #

DNS64: DNS64 Request Processing - A query cancelled for request %1

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5124: DNS64: DNS64 Request Processing - A query timer started for request Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - A query timer started for request Object.

Message #

DNS64: DNS64 Request Processing - A query timer started for request %1

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5125: DNS64: DNS64 Request Processing - A query timer fired for request Object with reason Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - A query timer fired for request Object with reason Value.

Message #

DNS64: DNS64 Request Processing - A query timer fired for request %1 with reason %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5126: DNS64: DNS64 Request Processing - Forwarded query issued for request Object, DnsQueryEx returned status Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - Forwarded query issued for request Object, DnsQueryEx returned status Value.

Message #

DNS64: DNS64 Request Processing - Forwarded query issued for request %1, DnsQueryEx returned status %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5127: DNS64: DNS64 Request Processing - Forwarded query issued for request Object completed with status Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - Forwarded query issued for request Object completed with status Value.

Message #

DNS64: DNS64 Request Processing - Forwarded query issued for request %1 completed with status %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5128: DNS64: DNS64 Request Processing - Forwarded query cancelled for request Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - Forwarded query cancelled for request Object.

Message #

DNS64: DNS64 Request Processing - Forwarded query cancelled for request %1

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5129: DNS64: DNS64 Request Processing - Processing locally PTR query matched configured suffixes for request Object.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - Processing locally PTR query matched configured suffixes for request Object.

Message #

DNS64: DNS64 Request Processing - Processing locally PTR query matched configured suffixes for request %1

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5130: DNS64: DNS64 Request Processing - Copying records from AAAA query results for request Object, response code set to Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - Copying records from AAAA query results for request Object, response code set to Value.

Message #

DNS64: DNS64 Request Processing - Copying records from AAAA query results for request %1, response code set to %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5131: DNS64: DNS64 Request Processing - Synthesizing records from A query results for request Object, response code set to Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - Synthesizing records from A query results for request Object, response code set to Value.

Message #

DNS64: DNS64 Request Processing - Synthesizing records from A query results for request %1, response code set to %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5132: DNS64: DNS64 Request Processing - Merging records from A query results for request Object, response code set to Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - Merging records from A query results for request Object, response code set to Value.

Message #

DNS64: DNS64 Request Processing - Merging records from A query results for request %1, response code set to %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5133: DNS64: DNS64 Request Processing - Copying records from AAAA query results to otherwise empty response for request Object, response code set to Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DNS64: DNS64 Request Processing - Copying records from AAAA query results to otherwise empty response for request Object, response code set to Value.

Message #

DNS64: DNS64 Request Processing - Copying records from AAAA query results to otherwise empty response for request %1, response code set to %3

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5200: Connectivity Platform operation in action: {Action}.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Iphlpsvc Etw Channel

Description

Connectivity Platform operation in action: {Action}.

Message #

Connectivity Platform operation in action: {Action}.

Fields #

Name	Description
`Action`

Event ID 5201: Connectivity Platform operation started: {Action}.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Iphlpsvc Etw Channel

Description

Connectivity Platform operation started: {Action}.

Message #

Connectivity Platform operation started: {Action}.

Fields #

Name	Description
`Action`

Event ID 5202: Connectivity Platform operation ended: {Action}.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Iphlpsvc Etw Channel

Description

Connectivity Platform operation ended: {Action}.

Message #

Connectivity Platform operation ended: {Action}.

Fields #

Name	Description
`Action`

Event ID 5203: Connectivity Platform operation failed: {Action}.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Iphlpsvc Etw Channel

Description

Connectivity Platform operation failed: {Action}.

Message #

Connectivity Platform operation failed: {Action}.

Fields #

Name	Description
`Action`

Event ID 5300: HA: {Action} started.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Iphlpsvc Etw Channel

Description

HA: {Action} started.

Message #

HA: {Action} started.

Fields #

Name	Description
`Action`

Event ID 5301: HA: {Action} failed with status {Status}.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Iphlpsvc Etw Channel

Description

HA: {Action} failed with status {Status}.

Message #

HA: {Action} failed with status {Status}.

Fields #

Name	Description
`Action`
`Status`	NTSTATUS reference

Event ID 5302: HA: HEP discovery succeeded; found {Count} addresses.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Iphlpsvc Etw Channel

Description

HA: HEP discovery succeeded; found {Count} addresses.

Message #

HA: HEP discovery succeeded; found {Count} addresses.

Fields #

Name	Description
`Count`

Event ID 5303: HA: Connection attempt failed; retrying {Count} more times.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Iphlpsvc Etw Channel

Description

HA: Connection attempt failed; retrying {Count} more times.

Message #

HA: Connection attempt failed; retrying {Count} more times.

Fields #

Name	Description
`Count`

Event ID 5304: HA: Successfully connected to network {Network ID}.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Iphlpsvc Etw Channel

Description

HA: Successfully connected to network {Network ID}.

Message #

HA: Successfully connected to network {Network ID}.

Event ID 5401: PROXYMGR: Reason: notifying providers of event: Event.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

PROXYMGR: Reason: notifying providers of event: Event.

Message #

PROXYMGR: %1: notifying providers of event: %2

Fields #

Name	Description
`Reason` UnicodeString
`Event` UInt32

Event ID 5402: PROXYMGR: Reason: notifying clients of event: Event.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

PROXYMGR: Reason: notifying clients of event: Event.

Message #

PROXYMGR: %1: notifying clients of event: %2

Fields #

Name	Description
`Reason` UnicodeString
`Event` UInt32

Event ID 5403: PROXYMGR: PROXYMGR failed with status Action.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

PROXYMGR: PROXYMGR failed with status Action.

Message #

PROXYMGR: %1 failed with status %2

Fields #

Name	Description
`Action` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 5404: PROXYMGR.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

PROXYMGR: Action

Message #

PROXYMGR: %1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5501: DA MULTISITE: Configuring site SiteName selected based on SiteSelectionMethod.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Configuring site SiteName selected based on SiteSelectionMethod.

Message #

DA MULTISITE: Configuring site %2 selected based on %1.

Fields #

Name	Description
`SiteSelectionMethod` UInt32
`SiteName` UnicodeString
`IphttpsProfileName` UnicodeString
`TeredoServerIp` UInt32
`AddrLength` UInt32
`SiteIpv6Address` Binary
`AdSiteName` UnicodeString
`CorporateRanges` UnicodeString

Event ID 5502: DA MULTISITE: Configured AD site name, status Status.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Configured AD site name, status Status.

Message #

DA MULTISITE: Configured AD site name, status %2.

Fields #

Name	Description
`AdSiteName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 5503: DA MULTISITE: Added a prefix to the prefix policy table, status Status.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Added a prefix to the prefix policy table, status Status.

Message #

DA MULTISITE: Added a prefix to the prefix policy table, status %4

Fields #

Name	Description
`AddrLength` UInt32
`Prefix` Binary
`PrefixLength` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 5504: DA MULTISITE: Configured IPHTTPS to use profile IphttpsProfileName, status Status.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Configured IPHTTPS to use profile IphttpsProfileName, status Status.

Message #

DA MULTISITE: Configured IPHTTPS to use profile %1, status %2

Fields #

Name	Description
`IphttpsProfileName` UnicodeString
`Status` UInt32	NTSTATUS reference

Event ID 5505: DA MULTISITE: Configured Teredo to use server TeredoServerIp, status Status.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Configured Teredo to use server TeredoServerIp, status Status.

Message #

DA MULTISITE: Configured Teredo to use server %1, status %2

Fields #

Name	Description
`TeredoServerIp` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 5506: DA MULTISITE: Removed configuration for site SiteName.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Removed configuration for site SiteName.

Message #

DA MULTISITE: Removed configuration for site %1.

Fields #

Name	Description
`SiteName` UnicodeString

Event ID 5508: DA MULTISITE: Site ProbingSiteName is selected based on probing.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Site ProbingSiteName is selected based on probing. Previously, TCP/IP sorting selected site SortingSiteName with metric SortingMetric for address family AddressFamily.

Message #

DA MULTISITE: Site %4 is selected based on probing. Previously, TCP/IP sorting selected site %1 with metric %2 for address family %3.

Fields #

Name	Description
`SortingSiteName` UnicodeString
`SortingMetric` UInt32
`AddressFamily` UInt32
`ProbingSiteName` UnicodeString

Event ID 5509: DA MULTISITE: Name resolution for multisite FQDN Message started with error code Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Name resolution for multisite FQDN Message started with error code Value.

Message #

DA MULTISITE: Name resolution for multisite FQDN %2 started with error code %3.

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5510: DA MULTISITE: Name resolution for multisite FQDN Action cancelled.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Name resolution for multisite FQDN Action cancelled.

Message #

DA MULTISITE: Name resolution for multisite FQDN %1 cancelled.

Fields #

Name	Description
`Action` UnicodeString

Event ID 5511: DA MULTISITE: Name resolution for multisite FQDN Message completed with error code Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Name resolution for multisite FQDN Message completed with error code Value.

Message #

DA MULTISITE: Name resolution for multisite FQDN %2 completed with error code %3.

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5512: DA MULTISITE: No potentially reachable site record found for the IP address Prefix resolved for the multisite FQDN.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: No potentially reachable site record found for the IP address Prefix resolved for the multisite FQDN.

Message #

DA MULTISITE: No potentially reachable site record found for the IP address %2 resolved for the multisite FQDN.

Fields #

Name	Description
`AddrLength` UInt32
`Prefix` Binary

Event ID 5513: DA MULTISITE: Site probing preparation finished with Value site probes prepared.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Site probing preparation finished with Value site probes prepared.

Message #

DA MULTISITE: Site probing preparation finished with %3 site probes prepared.

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5514: DA MULTISITE: Site probing prepared for URL SiteUrl at timestamp Timestamp.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Site probing prepared for URL SiteUrl at timestamp Timestamp.

Message #

DA MULTISITE: Site probing prepared for URL %1 at timestamp %2.

Fields #

Name	Description
`SiteUrl` UnicodeString
`Timestamp` UInt64

Event ID 5515: DA MULTISITE: Site probing started for URL SiteUrl with error code ErrorCode at timestamp Timestamp.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Site probing started for URL SiteUrl with error code ErrorCode at timestamp Timestamp.

Message #

DA MULTISITE: Site probing started for URL %1 with error code %2 at timestamp %3.

Fields #

Name	Description
`SiteUrl` UnicodeString
`ErrorCode` UInt32
`Timestamp` UInt64

Event ID 5516: DA MULTISITE: Site probing cancelled for URL Action.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Site probing cancelled for URL Action.

Message #

DA MULTISITE: Site probing cancelled for URL %1.

Fields #

Name	Description
`Action` UnicodeString

Event ID 5517: DA MULTISITE: Site probe for URL SiteUrl completed with error code ErrorCode, HTTP status HttpStatus at timestamp Timestamp.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Site probe for URL SiteUrl completed with error code ErrorCode, HTTP status HttpStatus at timestamp Timestamp.

Message #

DA MULTISITE: Site probe for URL %1 completed with error code %2, HTTP status %3 at timestamp %4.

Fields #

Name	Description
`SiteUrl` UnicodeString
`ErrorCode` UInt32
`HttpStatus` UInt32
`Timestamp` UInt64

Event ID 5518: DA MULTISITE: Timer expired in state Value.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Timer expired in state Value.

Message #

DA MULTISITE: Timer expired in state %3.

Fields #

Name	Description
`Object` Pointer
`Message` UnicodeString
`Value` UInt32

Event ID 5519: DASTMGR.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DASTMGR: Action

Message #

DASTMGR: %1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5550: ISATAP.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ISATAP: Action

Message #

ISATAP: %1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5600: 6to4.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

6to4: Action

Message #

6to4: %1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5607: DA MULTISITE: Corporate connectivity has been indicated in Delay milliseconds or less after site SiteName configuration.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

DA MULTISITE: Corporate connectivity has been indicated in Delay milliseconds or less after site SiteName configuration.

Message #

DA MULTISITE: Corporate connectivity has been indicated in %2 milliseconds or less after site %1 configuration.

Fields #

Name	Description
`SiteName` UnicodeString
`Delay` UInt64

Event ID 5650: COMMON.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

COMMON: Action

Message #

COMMON: %1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5651: ERROR.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

ERROR: Action

Message #

ERROR: %1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5652: Action.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Action

Message #

%1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5653: FSM.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

FSM: Action

Message #

FSM: %1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5654: Action.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

Action

Message #

%1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5655: PortProxy: PortProxy.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace
Opcode: Info

Description

PortProxy: PortProxy.

Message #

PortProxy: %1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5656: CLATMGR:

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Operational

Fields #

Name	Description
`Action` UnicodeString

Event ID 5656: CLATMGR.

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Trace

Description

CLATMGR: Action

Message #

CLATMGR: %1

Fields #

Name	Description
`Action` UnicodeString

Event ID 5657

Provider: Microsoft-Windows-Iphlpsvc-Trace
Channel: Operational

Fields #

Name	Description
`ErrorMessage` UnicodeString
`ErrorCode` UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {6600E712-C3B6-44A2-8A48-935C511F28C8}

Defined in iphlpsvc.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)