detection.wiki

Microsoft-Windows-RasIpBootp

EventTitleChannelSampleRule
30001IPBOOTP was unable to initialize a critical section.OperationalNN
30002IPBOOTP was unable to create a heap for memory allocation.OperationalNN
30003IPBOOTP was unable to allocate memory from its heap.OperationalNN
30004IPBOOTP was called to start when it was already running.OperationalNN
30005IPBOOTP was unable to initialize Windows Sockets.OperationalNN
30006IPBOOTP was unable to create a synchronization object.OperationalNN
30007IPBOOTP was unable to create a table to hold interface information.OperationalNN
30008IPBOOTP was unable to create a semaphore.OperationalNN
30009IPBOOTP was unable to create an event.OperationalNN
30010IPBOOTP was unable to create a timer queue using CreateTimerQueue.OperationalNN
30011IPBOOTP started successfully.OperationalNN
30012IPBOOTP has stopped.OperationalNN
30013IPBOOTP was unable to bind to IP address param1.OperationalNN
30014IPBOOTP was unable to activate the interface with IP address param1.OperationalNN
30015IPBOOTP was unable to request notification of events on the socket for the local …OperationalNN
30016IPBOOTP has discarded a packet received on the local interface with IP address …OperationalNN
30017IPBOOTP has discarded a packet received on the local interface with IP address …OperationalNN
30018IPBOOTP was unable to relay a DHCP REQUEST packet on the local interface with IP …OperationalNN
30019IPBOOTP was unable to relay a DHCP REPLY packet on the local interface with IP …OperationalNN
30020IPBOOTP was unable to enumerate network events on the local interface with IP …OperationalNN
30021IPBOOTP detected an error on the local interface with IP address param1.OperationalNN
30022IPBOOTP was unable to receive an incoming message on the local interface with IP …OperationalNN
30023IPBOOTP received a packet which was smaller than the minimum size allowed for …OperationalNN
30024IPBOOTP received a packet containing an invalid op-code.OperationalNN
30025IPBOOTP could not schedule the processing of a packet received on the local …OperationalNN
30026IPBOOTP could not schedule a task to be executed.OperationalNN
30027IPBOOTP could not create a socket for the local interface with IP address …OperationalNN
30028IPBOOTP could not enable broadcasting on the socket for the local interface with …OperationalNN
30029IPBOOTP was unable to register an event with the ntdll wait threads.OperationalNN
30030IPBOOTP could not be configured on the interface.OperationalNN

Event ID 30001: IPBOOTP was unable to initialize a critical section.

#
Channel
Operational

Description

IPBOOTP was unable to initialize a critical section. The data is the exception code.

Message #

IPBOOTP was unable to initialize a critical section. The data is the exception code.

Event ID 30002: IPBOOTP was unable to create a heap for memory allocation.

#
Channel
Operational

Description

IPBOOTP was unable to create a heap for memory allocation. The data is the error code.

Message #

IPBOOTP was unable to create a heap for memory allocation. The data is the error code.

Event ID 30003: IPBOOTP was unable to allocate memory from its heap.

#
Channel
Operational

Description

IPBOOTP was unable to allocate memory from its heap. The data is the error code.

Message #

IPBOOTP was unable to allocate memory from its heap. The data is the error code.

Event ID 30004: IPBOOTP was called to start when it was already running.

#
Channel
Operational

Event ID 30005: IPBOOTP was unable to initialize Windows Sockets.

#
Channel
Operational

Description

IPBOOTP was unable to initialize Windows Sockets. The data is the error code.

Message #

IPBOOTP was unable to initialize Windows Sockets. The data is the error code.

Event ID 30006: IPBOOTP was unable to create a synchronization object.

#
Channel
Operational

Description

IPBOOTP was unable to create a synchronization object. The data is the exception code.

Message #

IPBOOTP was unable to create a synchronization object. The data is the exception code.

Event ID 30007: IPBOOTP was unable to create a table to hold interface information.

#
Channel
Operational

Description

IPBOOTP was unable to create a table to hold interface information. The data is the error code.

Message #

IPBOOTP was unable to create a table to hold interface information. The data is the error code.

Event ID 30008: IPBOOTP was unable to create a semaphore.

#
Channel
Operational

Description

IPBOOTP was unable to create a semaphore. The data is the error code.

Message #

IPBOOTP was unable to create a semaphore. The data is the error code.

Event ID 30009: IPBOOTP was unable to create an event.

#
Channel
Operational

Description

IPBOOTP was unable to create an event. The data is the error code.

Message #

IPBOOTP was unable to create an event. The data is the error code.

Event ID 30010: IPBOOTP was unable to create a timer queue using CreateTimerQueue.

#
Channel
Operational

Description

IPBOOTP was unable to create a timer queue using CreateTimerQueue. The data is the error code.

Message #

IPBOOTP was unable to create a timer queue using CreateTimerQueue. The data is the error code.

Event ID 30011: IPBOOTP started successfully.

#
Channel
Operational

Event ID 30012: IPBOOTP has stopped.

#
Channel
Operational

Event ID 30013: IPBOOTP was unable to bind to IP address param1.

#
Channel
Operational

Description

IPBOOTP was unable to bind to IP address param1. Please make sure TCP/IP is installed and configured correctly. The data is the error code.

Message #

IPBOOTP was unable to bind to IP address %1. Please make sure TCP/IP is installed and configured correctly. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30014: IPBOOTP was unable to activate the interface with IP address param1.

#
Channel
Operational

Description

IPBOOTP was unable to activate the interface with IP address param1. The data is the error code.

Message #

IPBOOTP was unable to activate the interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30015: IPBOOTP was unable to request notification of events on the socket for the local interface with IP address param1.

#
Channel
Operational

Description

IPBOOTP was unable to request notification of events on the socket for the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP was unable to request notification of events on the socket for the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30016: IPBOOTP has discarded a packet received on the local interface with IP address param1.

#
Channel
Operational

Message #

IPBOOTP has discarded a packet received on the local interface with IP address %1. The packet had a hop-count of %2, which is greater than the maximum value allowed in packets received for this interface. The hop-count field in a DHCP REQUEST packet indicates how many times the packet has been forwarded from one relay-agent to another.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30017: IPBOOTP has discarded a packet received on the local interface with IP address param1.

#
Channel
Operational

Message #

IPBOOTP has discarded a packet received on the local interface with IP address %1. The packet had a seconds-since-boot of %2, which is less than the minimum value needed for packets to be forwarded on this interface. The seconds-since-boot field in a DHCP REQUEST packet indicates how long the DHCP client machine which sent the packet has been trying to obtain an IP address.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30018: IPBOOTP was unable to relay a DHCP REQUEST packet on the local interface with IP address param1; the REQUEST was to have been relayed to the DHCP serve...

#
Channel
Operational

Description

IPBOOTP was unable to relay a DHCP REQUEST packet on the local interface with IP address param1; the REQUEST was to have been relayed to the DHCP server with IP address param2. The data is the error code.

Message #

IPBOOTP was unable to relay a DHCP REQUEST packet on the local interface with IP address %1; the REQUEST was to have been relayed to the DHCP server with IP address %2. The data is the error code.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30019: IPBOOTP was unable to relay a DHCP REPLY packet on the local interface with IP address param1; the REPLY was to have been relayed to the DHCP client wi...

#
Channel
Operational

Description

IPBOOTP was unable to relay a DHCP REPLY packet on the local interface with IP address param1; the REPLY was to have been relayed to the DHCP client with hardware address param2. The data is the error code.

Message #

IPBOOTP was unable to relay a DHCP REPLY packet on the local interface with IP address %1; the REPLY was to have been relayed to the DHCP client with hardware address %2. The data is the error code.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30020: IPBOOTP was unable to enumerate network events on the local interface with IP address param1.

#
Channel
Operational

Description

IPBOOTP was unable to enumerate network events on the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP was unable to enumerate network events on the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30021: IPBOOTP detected an error on the local interface with IP address param1.

#
Channel
Operational

Description

IPBOOTP detected an error on the local interface with IP address param1. The error occurred while the interface was receiving packets. The data is the error code.

Message #

IPBOOTP detected an error on the local interface with IP address %1. The error occurred while the interface was receiving packets. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30022: IPBOOTP was unable to receive an incoming message on the local interface with IP address param1.

#
Channel
Operational

Description

IPBOOTP was unable to receive an incoming message on the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP was unable to receive an incoming message on the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30023: IPBOOTP received a packet which was smaller than the minimum size allowed for DHCP packets.

#
Channel
Operational

Message #

IPBOOTP received a packet which was smaller than the minimum size allowed for DHCP packets. The packet has been discarded. It was received on the local interface with IP address %1,  and it came from a machine with IP address %2.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30024: IPBOOTP received a packet containing an invalid op-code.

#
Channel
Operational

Description

IPBOOTP received a packet containing an invalid op-code. The packet has been discarded. It was received on the local interface with IP address param1, and it came from a machine with IP address param2.

Message #

IPBOOTP received a packet containing an invalid op-code. The packet has been discarded. It was received on the local interface with IP address %1, and it came from a machine with IP address %2.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30025: IPBOOTP could not schedule the processing of a packet received on the local interface with IP address param1.

#
Channel
Operational

Message #

IPBOOTP could not schedule the processing of a packet received on the local interface with IP address %1. The packet was received from a machine with IP address %2. This error may have been caused by a memory allocation failure. The data is the error code.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30026: IPBOOTP could not schedule a task to be executed.

#
Channel
Operational

Description

IPBOOTP could not schedule a task to be executed. This error may have been caused by a memory allocation failure. The data is the error code.

Message #

IPBOOTP could not schedule a task to be executed. This error may have been caused by a memory allocation failure. The data is the error code.

Event ID 30027: IPBOOTP could not create a socket for the local interface with IP address param1.

#
Channel
Operational

Description

IPBOOTP could not create a socket for the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP could not create a socket for the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30028: IPBOOTP could not enable broadcasting on the socket for the local interface with IP address param1.

#
Channel
Operational

Description

IPBOOTP could not enable broadcasting on the socket for the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP could not enable broadcasting on the socket for the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30029: IPBOOTP was unable to register an event with the ntdll wait threads.

#
Channel
Operational

Description

IPBOOTP was unable to register an event with the ntdll wait threads. The data is the error code.

Message #

IPBOOTP was unable to register an event with the ntdll wait threads. The data is the error code.

Event ID 30030: IPBOOTP could not be configured on the interface.

#
Channel
Operational

Description

IPBOOTP could not be configured on the interface. The invalid parameter is: param1, value: ,Value.

Message #

IPBOOTP could not be configured on the interface. The invalid parameter is: %1, value: %2

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Provenance

ETW provider GUID 45ae379d-cadc-41d3-b69e-bd3f0a09788e

Defined in ipbootp.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB