Microsoft-Windows-RasRoutingProtocols-dhcpv6r

28 events across 1 channel

Event	Title	Channel	Sample
34097	DHCPV6R was unable to initialize a critical section.	Operational	N
34098	DHCPV6R was unable to allocate memory from its heap.	Operational	N
34099	Severity=Warning DHCPV6R was called to start when it was already running.	Operational	N
34100	DHCPV6R was unable to initialize Windows Sockets.	Operational	N
34101	DHCPV6R was unable to create a synchronization object.	Operational	N
34102	DHCPV6R was unable to create a table to hold interface information.	Operational	N
34103	DHCPV6R was unable to create a semaphore.	Operational	N
34104	DHCPV6R was unable to create an event.	Operational	N
34105	DHCPV6R was unable to create a timer queue using CreateTimerQueue.	Operational	N
34106	Severity=Info DHCPV6R started successfully.	Operational	N
34107	Severity=Info DHCPV6R has stopped.	Operational	N
34108	DHCPV6R was unable to request notification of events on the socket for the local …	Operational	N
34109	Severity=Warning DHCPV6R has discarded a packet received on the local interface …	Operational	N
34110	Severity=Info DHCPV6 Relay Agent has discarded a packet received on the local …	Operational	N
34111	DHCPV6 Relay Agent was unable to relay a DHCP RELAY FORWARD packet on the local …	Operational	N
34112	DHCPV6 Relay Agent was unable to relay a DHCP REPLY packet on the local …	Operational	N
34113	DHCPV6 Relay Agent was unable to enumerate network events on the local interface …	Operational	N
34114	DHCPV6 Relay Agent detected an error on the local interface with IP address …	Operational	N
34115	DHCPV6 Relay Agent was unable to receive an incoming message on the local …	Operational	N
34116	DHCPV6 Relay received a packet which was smaller than the minimum size allowed …	Operational	N
34117	DHCPV6 Relay agent received a packet containing an invalid op-code.	Operational	N
34118	DHCPV6 Relay agent could not schedule the processing of a packet received on the …	Operational	N
34119	DHCPV6 Relay agent could not schedule a task to be executed.	Operational	N
34120	DHCPV6 Relay agent could not create a socket for the local interface with IP …	Operational	N
34121	DHCPV6 Relay agent could not enable multicasting on the socket for the local …	Operational	N
34122	DHCPV6 Relay was unable to register an event with the ntdll wait threads.	Operational	N
34123	DHCPV6 Relay agent could not be configured on the interface.	Operational	N
34124	DHCPV6R was unable to create a table to hold forward information.	Operational	N

Event ID 34097: DHCPV6R was unable to initialize a critical section.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to initialize a critical section. The data is the exception code.

Message #

DHCPV6R was unable to initialize a critical section. The data is the exception code.

Event ID 34098: DHCPV6R was unable to allocate memory from its heap.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to allocate memory from its heap. The data is the error code.

Message #

DHCPV6R was unable to allocate memory from its heap. The data is the error code.

Event ID 34099: Severity=Warning DHCPV6R was called to start when it was already running.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

Severity=Warning DHCPV6R was called to start when it was already running.

Message #

Severity=Warning DHCPV6R was called to start when it was already running.

Event ID 34100: DHCPV6R was unable to initialize Windows Sockets.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to initialize Windows Sockets. The data is the error code.

Message #

DHCPV6R was unable to initialize Windows Sockets. The data is the error code.

Event ID 34101: DHCPV6R was unable to create a synchronization object.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to create a synchronization object. The data is the exception code.

Message #

DHCPV6R was unable to create a synchronization object. The data is the exception code.

Event ID 34102: DHCPV6R was unable to create a table to hold interface information.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to create a table to hold interface information. The data is the error code.

Message #

DHCPV6R was unable to create a table to hold interface information. The data is the error code.

Event ID 34103: DHCPV6R was unable to create a semaphore.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to create a semaphore. The data is the error code.

Message #

DHCPV6R was unable to create a semaphore. The data is the error code.

Event ID 34104: DHCPV6R was unable to create an event.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to create an event. The data is the error code.

Message #

DHCPV6R was unable to create an event. The data is the error code.

Event ID 34105: DHCPV6R was unable to create a timer queue using CreateTimerQueue.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to create a timer queue using CreateTimerQueue. The data is the error code.

Message #

DHCPV6R was unable to create a timer queue using CreateTimerQueue. The data is the error code.

Event ID 34106: Severity=Info DHCPV6R started successfully.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

Severity=Info DHCPV6R started successfully.

Message #

Severity=Info DHCPV6R started successfully.

Event ID 34107: Severity=Info DHCPV6R has stopped.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

Severity=Info DHCPV6R has stopped.

Message #

Severity=Info DHCPV6R has stopped.

Event ID 34108: DHCPV6R was unable to request notification of events on the socket for the local interface with IP address param1.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to request notification of events on the socket for the local interface with IP address param1. The data is the error code.

Message #

DHCPV6R was unable to request notification of events on the socket for the local interface with IP address %1. The data is the error code.

Fields #

Name	Description
`param1` UnicodeString

Event ID 34109: Severity=Warning DHCPV6R has discarded a packet received on the local interface with IP address param1.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Message #

Severity=Warning DHCPV6R has discarded a packet received on the local interface with IP address %1. The packet had a hop-count of %2, which is greater than the maximum value allowed in packets received for this interface. The hop-count field in a DHCP REQUEST packet indicates how many times the packet has been forwarded from one relay-agent to another.

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 34110: Severity=Info DHCPV6 Relay Agent has discarded a packet received on the local interface with IP address param1.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Message #

Severity=Info DHCPV6 Relay Agent has discarded a packet received on the local interface with IP address %1. The packet had an elapsed time of %2,which is less  than the minimum value needed for packets to be forwarded on this interface. The elapsed time field in a DHCP REQUEST packet indicates how long the DHCP client machine which sent the packet has been trying to obtain an IP address.

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 34111: DHCPV6 Relay Agent was unable to relay a DHCP RELAY FORWARD packet on the local interface with IP address param1; the packet was to have been relayed t...

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Message #

DHCPV6 Relay Agent was unable to relay a DHCP RELAY FORWARD packet on the local interface with IP address %1; the packet was to have been relayed to the DHCP client with hardware address %2. The data is the error code.

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 34112: DHCPV6 Relay Agent was unable to relay a DHCP REPLY packet on the local interface with IP address param1; the REPLY was to have been relayed to the DHC...

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay Agent was unable to relay a DHCP REPLY packet on the local interface with IP address ; the REPLY was to have been relayed to the DHCP server with IP address . The data is the error code.

Message #

DHCPV6 Relay Agent was unable to relay a DHCP REPLY packet on the local interface with IP address %1; the REPLY was to have been relayed to the DHCP server with IP address %2. The data is the error code.

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 34113: DHCPV6 Relay Agent was unable to enumerate network events on the local interface with IP address param1.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay Agent was unable to enumerate network events on the local interface with IP address param1. The data is the error code.

Message #

DHCPV6 Relay Agent was unable to enumerate network events on the local interface with IP address %1. The data is the error code.

Fields #

Name	Description
`param1` UnicodeString

Event ID 34114: DHCPV6 Relay Agent detected an error on the local interface with IP address param1.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay Agent detected an error on the local interface with IP address param1. The error occurred while the interface was receiving packets. The data is the error code.

Message #

DHCPV6 Relay Agent detected an error on the local interface with IP address %1. The error occurred while the interface was receiving packets. The data is the error code.

Fields #

Name	Description
`param1` UnicodeString

Event ID 34115: DHCPV6 Relay Agent was unable to receive an incoming message on the local interface with IP address param1.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay Agent was unable to receive an incoming message on the local interface with IP address param1. The data is the error code.

Message #

DHCPV6 Relay Agent was unable to receive an incoming message on the local interface with IP address %1. The data is the error code.

Fields #

Name	Description
`param1` UnicodeString

Event ID 34116: DHCPV6 Relay received a packet which was smaller than the minimum size allowed for DHCP packets.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Message #

DHCPV6 Relay received a packet which was smaller than the minimum size allowed for DHCP packets. The packet has been discarded. It was received on the local interface with IP address %1,  and it came from a machine with IP address %2.

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 34117: DHCPV6 Relay agent received a packet containing an invalid op-code.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay agent received a packet containing an invalid op-code. The packet has been discarded. It was received on the local interface with IP address , and it came from a machine with IP address .

Message #

DHCPV6 Relay agent received a packet containing an invalid op-code. The packet has been discarded. It was received on the local interface with IP address %1, and it came from a machine with IP address %2.

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 34118: DHCPV6 Relay agent could not schedule the processing of a packet received on the local interface with IP address param1.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Message #

DHCPV6 Relay agent could not schedule the processing of a packet received on the local interface with IP address %1. The packet was received from a machine with IP address %2. This error may have been caused by a memory allocation failure. The data is the error code.

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 34119: DHCPV6 Relay agent could not schedule a task to be executed.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay agent could not schedule a task to be executed. This error may have been caused by a memory allocation failure. The data is the error code.

Message #

DHCPV6 Relay agent could not schedule a task to be executed. This error may have been caused by a memory allocation failure. The data is the error code.

Event ID 34120: DHCPV6 Relay agent could not create a socket for the local interface with IP address param1.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay agent could not create a socket for the local interface with IP address param1. The data is the error code.

Message #

DHCPV6 Relay agent could not create a socket for the local interface with IP address %1. The data is the error code.

Fields #

Name	Description
`param1` UnicodeString

Event ID 34121: DHCPV6 Relay agent could not enable multicasting on the socket for the local interface with IP address param1.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay agent could not enable multicasting on the socket for the local interface with IP address param1. The data is the error code.

Message #

DHCPV6 Relay agent could not enable multicasting on the socket for the local interface with IP address %1. The data is the error code.

Fields #

Name	Description
`param1` UnicodeString

Event ID 34122: DHCPV6 Relay was unable to register an event with the ntdll wait threads.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay was unable to register an event with the ntdll wait threads. The data is the error code.

Message #

DHCPV6 Relay was unable to register an event with the ntdll wait threads. The data is the error code.

Event ID 34123: DHCPV6 Relay agent could not be configured on the interface.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6 Relay agent could not be configured on the interface. The invalid parameter is: param1, value: ,Value.

Message #

DHCPV6 Relay agent could not be configured on the interface. The invalid parameter is: %1, value: %2

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 34124: DHCPV6R was unable to create a table to hold forward information.

Provider: Microsoft-Windows-RasRoutingProtocols-dhcpv6r
Channel: Operational

Description

DHCPV6R was unable to create a table to hold forward information. The data is the error code.

Message #

DHCPV6R was unable to create a table to hold forward information. The data is the error code.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID c488182e-fc71-4de9-8ec2-ff2312aed7eb

Defined in dhcpv6r.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-RasRoutingProtocols-dhcpv6r registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)