detection.wiki

Microsoft-Windows-RasIpBootp

30 events across 1 channel

EventTitleChannelSample
30001IPBOOTP was unable to initialize a critical section.OperationalN
30002IPBOOTP was unable to create a heap for memory allocation.OperationalN
30003IPBOOTP was unable to allocate memory from its heap.OperationalN
30004IPBOOTP was called to start when it was already running.OperationalN
30005IPBOOTP was unable to initialize Windows Sockets.OperationalN
30006IPBOOTP was unable to create a synchronization object.OperationalN
30007IPBOOTP was unable to create a table to hold interface information.OperationalN
30008IPBOOTP was unable to create a semaphore.OperationalN
30009IPBOOTP was unable to create an event.OperationalN
30010IPBOOTP was unable to create a timer queue using CreateTimerQueue.OperationalN
30011IPBOOTP started successfully.OperationalN
30012IPBOOTP has stopped.OperationalN
30013IPBOOTP was unable to bind to IP address param1.OperationalN
30014IPBOOTP was unable to activate the interface with IP address param1.OperationalN
30015IPBOOTP was unable to request notification of events on the socket for the local …OperationalN
30016IPBOOTP has discarded a packet received on the local interface with IP address …OperationalN
30017IPBOOTP has discarded a packet received on the local interface with IP address …OperationalN
30018IPBOOTP was unable to relay a DHCP REQUEST packet on the local interface with IP …OperationalN
30019IPBOOTP was unable to relay a DHCP REPLY packet on the local interface with IP …OperationalN
30020IPBOOTP was unable to enumerate network events on the local interface with IP …OperationalN
30021IPBOOTP detected an error on the local interface with IP address param1.OperationalN
30022IPBOOTP was unable to receive an incoming message on the local interface with IP …OperationalN
30023IPBOOTP received a packet which was smaller than the minimum size allowed for …OperationalN
30024IPBOOTP received a packet containing an invalid op-code.OperationalN
30025IPBOOTP could not schedule the processing of a packet received on the local …OperationalN
30026IPBOOTP could not schedule a task to be executed.OperationalN
30027IPBOOTP could not create a socket for the local interface with IP address …OperationalN
30028IPBOOTP could not enable broadcasting on the socket for the local interface with …OperationalN
30029IPBOOTP was unable to register an event with the ntdll wait threads.OperationalN
30030IPBOOTP could not be configured on the interface.OperationalN

Event ID 30001: IPBOOTP was unable to initialize a critical section.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to initialize a critical section. The data is the exception code.

Message #

IPBOOTP was unable to initialize a critical section. The data is the exception code.

Event ID 30002: IPBOOTP was unable to create a heap for memory allocation.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to create a heap for memory allocation. The data is the error code.

Message #

IPBOOTP was unable to create a heap for memory allocation. The data is the error code.

Event ID 30003: IPBOOTP was unable to allocate memory from its heap.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to allocate memory from its heap. The data is the error code.

Message #

IPBOOTP was unable to allocate memory from its heap. The data is the error code.

Event ID 30004: IPBOOTP was called to start when it was already running.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was called to start when it was already running.

Message #

IPBOOTP was called to start when it was already running.

Event ID 30005: IPBOOTP was unable to initialize Windows Sockets.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to initialize Windows Sockets. The data is the error code.

Message #

IPBOOTP was unable to initialize Windows Sockets. The data is the error code.

Event ID 30006: IPBOOTP was unable to create a synchronization object.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to create a synchronization object. The data is the exception code.

Message #

IPBOOTP was unable to create a synchronization object. The data is the exception code.

Event ID 30007: IPBOOTP was unable to create a table to hold interface information.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to create a table to hold interface information. The data is the error code.

Message #

IPBOOTP was unable to create a table to hold interface information. The data is the error code.

Event ID 30008: IPBOOTP was unable to create a semaphore.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to create a semaphore. The data is the error code.

Message #

IPBOOTP was unable to create a semaphore. The data is the error code.

Event ID 30009: IPBOOTP was unable to create an event.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to create an event. The data is the error code.

Message #

IPBOOTP was unable to create an event. The data is the error code.

Event ID 30010: IPBOOTP was unable to create a timer queue using CreateTimerQueue.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to create a timer queue using CreateTimerQueue. The data is the error code.

Message #

IPBOOTP was unable to create a timer queue using CreateTimerQueue. The data is the error code.

Event ID 30011: IPBOOTP started successfully.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP started successfully.

Message #

IPBOOTP started successfully.

Event ID 30012: IPBOOTP has stopped.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP has stopped.

Message #

IPBOOTP has stopped.

Event ID 30013: IPBOOTP was unable to bind to IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to bind to IP address param1. Please make sure TCP/IP is installed and configured correctly. The data is the error code.

Message #

IPBOOTP was unable to bind to IP address %1. Please make sure TCP/IP is installed and configured correctly. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30014: IPBOOTP was unable to activate the interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to activate the interface with IP address param1. The data is the error code.

Message #

IPBOOTP was unable to activate the interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30015: IPBOOTP was unable to request notification of events on the socket for the local interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to request notification of events on the socket for the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP was unable to request notification of events on the socket for the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30016: IPBOOTP has discarded a packet received on the local interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Message #

IPBOOTP has discarded a packet received on the local interface with IP address %1. The packet had a hop-count of %2, which is greater than the maximum value allowed in packets received for this interface. The hop-count field in a DHCP REQUEST packet indicates how many times the packet has been forwarded from one relay-agent to another.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30017: IPBOOTP has discarded a packet received on the local interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Message #

IPBOOTP has discarded a packet received on the local interface with IP address %1. The packet had a seconds-since-boot of %2, which is less than the minimum value needed for packets to be forwarded on this interface. The seconds-since-boot field in a DHCP REQUEST packet indicates how long the DHCP client machine which sent the packet has been trying to obtain an IP address.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30018: IPBOOTP was unable to relay a DHCP REQUEST packet on the local interface with IP address param1; the REQUEST was to have been relayed to the DHCP serve...

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to relay a DHCP REQUEST packet on the local interface with IP address param1; the REQUEST was to have been relayed to the DHCP server with IP address param2. The data is the error code.

Message #

IPBOOTP was unable to relay a DHCP REQUEST packet on the local interface with IP address %1; the REQUEST was to have been relayed to the DHCP server with IP address %2. The data is the error code.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30019: IPBOOTP was unable to relay a DHCP REPLY packet on the local interface with IP address param1; the REPLY was to have been relayed to the DHCP client wi...

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to relay a DHCP REPLY packet on the local interface with IP address param1; the REPLY was to have been relayed to the DHCP client with hardware address param2. The data is the error code.

Message #

IPBOOTP was unable to relay a DHCP REPLY packet on the local interface with IP address %1; the REPLY was to have been relayed to the DHCP client with hardware address %2. The data is the error code.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30020: IPBOOTP was unable to enumerate network events on the local interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to enumerate network events on the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP was unable to enumerate network events on the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30021: IPBOOTP detected an error on the local interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP detected an error on the local interface with IP address param1. The error occurred while the interface was receiving packets. The data is the error code.

Message #

IPBOOTP detected an error on the local interface with IP address %1. The error occurred while the interface was receiving packets. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30022: IPBOOTP was unable to receive an incoming message on the local interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to receive an incoming message on the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP was unable to receive an incoming message on the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30023: IPBOOTP received a packet which was smaller than the minimum size allowed for DHCP packets.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Message #

IPBOOTP received a packet which was smaller than the minimum size allowed for DHCP packets. The packet has been discarded. It was received on the local interface with IP address %1,  and it came from a machine with IP address %2.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30024: IPBOOTP received a packet containing an invalid op-code.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP received a packet containing an invalid op-code. The packet has been discarded. It was received on the local interface with IP address param1, and it came from a machine with IP address param2.

Message #

IPBOOTP received a packet containing an invalid op-code. The packet has been discarded. It was received on the local interface with IP address %1, and it came from a machine with IP address %2.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30025: IPBOOTP could not schedule the processing of a packet received on the local interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Message #

IPBOOTP could not schedule the processing of a packet received on the local interface with IP address %1. The packet was received from a machine with IP address %2. This error may have been caused by a memory allocation failure. The data is the error code.

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Event ID 30026: IPBOOTP could not schedule a task to be executed.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP could not schedule a task to be executed. This error may have been caused by a memory allocation failure. The data is the error code.

Message #

IPBOOTP could not schedule a task to be executed. This error may have been caused by a memory allocation failure. The data is the error code.

Event ID 30027: IPBOOTP could not create a socket for the local interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP could not create a socket for the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP could not create a socket for the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30028: IPBOOTP could not enable broadcasting on the socket for the local interface with IP address param1.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP could not enable broadcasting on the socket for the local interface with IP address param1. The data is the error code.

Message #

IPBOOTP could not enable broadcasting on the socket for the local interface with IP address %1. The data is the error code.

Fields #

NameDescription
param1 UnicodeString

Event ID 30029: IPBOOTP was unable to register an event with the ntdll wait threads.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP was unable to register an event with the ntdll wait threads. The data is the error code.

Message #

IPBOOTP was unable to register an event with the ntdll wait threads. The data is the error code.

Event ID 30030: IPBOOTP could not be configured on the interface.

#
Provider
Microsoft-Windows-RasIpBootp
Channel
Operational

Description

IPBOOTP could not be configured on the interface. The invalid parameter is: param1, value: ,Value.

Message #

IPBOOTP could not be configured on the interface. The invalid parameter is: %1, value: %2

Fields #

NameDescription
param1 UnicodeString
param2 UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 45ae379d-cadc-41d3-b69e-bd3f0a09788e

Defined in ipbootp.dll, which carries the event manifest.

Observed on:

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads