Microsoft-Windows-SMBDirect
92 events across 5 channels
Event ID 0: SMB Direct is starting.
#Event ID 1: The network adapter '.
#Event ID 1: SMB Direct has started.
#Event ID 2: The network adapter '.
#Event ID 2: SMB Direct is stopping.
#Event ID 3: The network adapter '.
#Event ID 3: SMB Direct has stopped.
#Event ID 4: Setting RegistryKeyName\SettingName is invalid.
#Description
Setting RegistryKeyName\SettingName is invalid. Verify that SettingName is a DWORD (32-bit) value in the range MinValidValue to MaxValidValue (inclusive). The default value of DefaultValue will be used for this setting until the error is corrected.
Message #
Fields #
| Name | Description |
|---|---|
RegistryKeyName UnicodeString | |
SettingName UnicodeString | |
MinValidValue UInt32 | |
MaxValidValue UInt32 | |
DefaultValue UInt32 |
Event ID 5: The network adapter 'AdapterAlias' does not support a value of Value for setting RegistryKeyName\SettingName.
#Description
The network adapter 'AdapterAlias' does not support a value of Value for setting RegistryKeyName\SettingName. The closest adapter supported value of ClosestAdapterSupportedValue will be used.
Message #
Fields #
| Name | Description |
|---|---|
AdapterAlias UnicodeString | |
RegistryKeyName UnicodeString | |
SettingName UnicodeString | |
Value UInt32 | |
ClosestAdapterSupportedValue UInt32 |
Event ID 6: A connection has been terminated because no pending requests to network adapter 'AdapterAlias' have completed in the last TimeoutInMs milliseconds.
#Description
A connection has been terminated because no pending requests to network adapter 'AdapterAlias' have completed in the last TimeoutInMs milliseconds. Verify that the network is operational and that the peer is responsive. This event may also indicate that there are insufficient send credits to support the workload. Socket = SocketID Local = LocalAddress Remote = RemoteAddress
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
AdapterAlias UnicodeString | |
TimeoutInMs UInt32 |
Event ID 7: Settings BaseAffinityNode and MaxAffinityNode (\Registry\Machine\System\CurrentControlSet\Services\SmbDirect\Parameters) must specify a set of NUMA...
#Description
Settings BaseAffinityNode and MaxAffinityNode (\Registry\Machine\System\CurrentControlSet\Services\SmbDirect\Parameters) must specify a set of NUMA nodes that contain active processors. All of the system's processors will be eligible to perform SMB Direct processing until the error is corrected.
Message #
Fields #
| Name | Description |
|---|---|
BaseAffinityNode UInt32 → unsignedInt | |
MaxAffinityNode UInt32 → unsignedInt | |
BaseAffinityProcessor UInt32 → unsignedInt | |
MaxAffinityProcessor UInt32 → unsignedInt |
Event ID 8: A registry configuration parameter is invalid.
#Event ID 9: Loaded a registry configuration parameter value.
#Event ID 10: The network adapter's FRMR page count is incompatible with SMB Direct.
#Event ID 11: Found an interrupt processor.
#Event ID 12: A NUMA node has only one processor that may be used to process interrupts.
#Event ID 100: Failed to load a configuration parameter from the registry.
#Description
Failed to load a configuration parameter from the registry.
Message #
Fields #
| Name | Description |
|---|---|
RegistryKeyName UnicodeString | |
ParamName UnicodeString | |
Status HexInt32 | NTSTATUS reference |
Event ID 101: A configuration parameter value has been updated.
#Event ID 102: A configuration parameter value has been updated.
#Event ID 150: A socket configuration parameter value is not supported.
#Event ID 200: Identified a set of completion queue processors.
#Event ID 201: A NUMA node has too few completion queue processors for optimal performance.
#Event ID 202: Failed to identify any completion queue processors.
#Event ID 300: Starting connect.
#Event ID 300: An RDMA network adapter's NDKPI version is no longer supported.
#Event ID 301: Connect succeeded.
#Event ID 301: An RDMA network adapter's NDKPI limit does not meet SMB Direct's minimum requirements.
#Event ID 302: Connect failed.
#Event ID 302: Failed to allocate an RDMA network adapter resource.
#Event ID 303: Timed out while waiting for connection establishment to complete - cancelling connect.
#Event ID 303: An RDMA network adapter's completion queue has experienced a catastrophic failure and is no longer operational.
#Event ID 304: NdkConnect failed.
#Description
Allocating an RDMA network adapter resource took too long.
Message #
Fields #
| Name | Description |
|---|---|
AdapterIfIndex | |
SocketId GUID | |
ElapsedUsecs | |
ApiName | |
Status HexInt32 | NTSTATUS reference |
Event ID 304: Allocating an RDMA network adapter resource took too long.
#Description
Allocating an RDMA network adapter resource took too long.
Message #
Fields #
| Name | Description |
|---|---|
AdapterIfIndex | |
SocketId GUID | |
ElapsedUsecs | |
ApiName | |
Status HexInt32 | NTSTATUS reference |
Event ID 305: NdkCompleteConnect failed.
#Description
NdkCompleteConnect failed. Socket = SocketID Local = LocalAddress Remote = RemoteAddress Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Status HexInt32 | NTSTATUS reference |
Event ID 306: Failed to negotiate a common SMB Direct version with the peer.
#Description
Failed to negotiate a common SMB Direct version with the peer. Socket = SocketID Local = LocalAddress Remote = RemoteAddress MinVersion = MinVersion MaxVersion = MaxVersion PeerMinVersion = PeerMinVersion PeerMaxVersion = PeerMaxVersion.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
MinVersion UInt16 | |
MaxVersion UInt16 | |
PeerMinVersion UInt16 | |
PeerMaxVersion UInt16 |
Event ID 350: Received connect request.
#Event ID 351: Rejected connect request - connect backlog limit exceeded.
#Event ID 352: Rejected connect request - not enough memory.
#Event ID 353: Timed-out while waiting to receive a negotiate request - cancelling accept.
#Event ID 354: NdkAccept failed.
#Description
NdkAccept failed. Socket = SocketID Local = LocalAddress Remote = RemoteAddress Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Status HexInt32 | NTSTATUS reference |
Event ID 355: Accept started.
#Event ID 356: Accept succeeded.
#Event ID 357: Accept failed.
#Description
Accept failed. Socket = SocketID Local = LocalAddress Remote = RemoteAddress Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Status HexInt32 | NTSTATUS reference |
Event ID 358: Upper-level driver rejected the connection.
#Description
Upper-level driver rejected the connection. Socket = SocketID Status = LocalAddressLength.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Status HexInt32 | NTSTATUS reference |
Event ID 400: NDK disconnect event.
#Event ID 401: Disconnect started.
#Event ID 402: Disconnect completed.
#Event ID 403: Close started.
#Event ID 404: Close completed.
#Event ID 450: Out of send credits - starting credit grant timer.
#Event ID 451: Peer used their last send credit.
#Event ID 452: Using last send credit.
#Event ID 453: Timed-out while waiting to receive send credits.
#Event ID 454: Protocol violation - the peer sent a packet but does not have a send credit.
#Event ID 455: Protocol violation - the peer used their last send credit but did not grant a send credit.
#Event ID 456: Granted the peer PeerSendCreditsGranted additional send credits.
#Description
Granted the peer PeerSendCreditsGranted additional send credits. Socket SocketID Local = LocalAddress Remote = RemoteAddress PeerSendCredits = PeerSendCredits.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
PeerSendCreditsGranted UInt32 | |
PeerSendCredits UInt32 |
Event ID 457: Received a grant of SendCreditsReceived credits.
#Description
Received a grant of SendCreditsReceived credits. Socket = SocketID Local = LocalAddress Remote = RemoteAddress SendCreditsAccepted = SendCreditsAccepted SendCredits = SendCredits.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
SendCreditsReceived UInt32 | |
SendCreditsAccepted UInt32 | |
SendCredits UInt32 |
Event ID 500: Failed to post a Type SQ work request.
#Description
Failed to post a Type SQ work request. Socket = SocketID Local = LocalAddress Remote = RemoteAddress Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Type UInt32 | |
Status HexInt32 | NTSTATUS reference |
Event ID 501: Type SQ work request failed.
#Description
Type SQ work request failed. Socket = SocketID Local = LocalAddress Remote = RemoteAddress Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Type UInt32 | |
Status HexInt32 | NTSTATUS reference |
Event ID 502: Failed to post a Receive work request.
#Description
Failed to post a Receive work request. Socket = SocketID Local = LocalAddress Remote = RemoteAddress Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Status HexInt32 | NTSTATUS reference |
Event ID 503: Receive work request failed.
#Description
Receive work request failed. Socket = SocketID Local = LocalAddress Remote = RemoteAddress Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Status HexInt32 | NTSTATUS reference |
Event ID 1000: Timed-out out while waiting to receive a keepalive response.
#Event ID 1001: Protocol violation - received packet is too small or contains at least one invalid value.
#Event ID 1002: Protocol violation - total fragmented payload is larger than indicated by first fragment.
#Event ID 1003: Protocol violation - total fragmented payload is smaller than indicated by first fragment.
#Event ID 1004: Failed to allocate a fragment reassembly buffer.
#Event ID 1005: Type operation failed.
#Description
Type operation failed. Socket = SocketID Local = LocalAddress Remote = RemoteAddress Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Type UInt32 | |
Status HexInt32 | NTSTATUS reference |
Event ID 1006: Created socket.
#Event ID 1007: Failed to create socket.
#Description
Failed to create socket. Socket = SocketID Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
Status HexInt32 | NTSTATUS reference |
Event ID 1008: Finished negotiating connection properties.
#Description
Finished negotiating connection properties. Socket = SocketID Local = LocalAddress Remote = RemoteAddress ProtocolVersion = ProtocolVersion MaxReadWriteSize = MaxReadWriteSize MaxReceiveSize = MaxReceiveSize MaxFragmentedReceiveSize = MaxFragmentedReceiveSize MaxSendSize = MaxSendSize MaxFragmentedSendSize = MaxFragmentedSendSize IRD = InboundReadDepth ORD = OutboundReadDepth
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
ProtocolVersion UInt16 | |
MaxReadWriteSize UInt32 | |
MaxReceiveSize UInt32 | |
MaxFragmentedReceiveSize UInt32 | |
MaxSendSize UInt32 | |
MaxFragmentedSendSize UInt32 | |
InboundReadDepth UInt32 | |
OutboundReadDepth UInt32 |
Event ID 1009: A completion queue has failed and is no longer indicating completions.
#Description
A completion queue has failed and is no longer indicating completions. Socket = SocketID Local = LocalAddress Remote = RemoteAddress Status = Status.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
Status HexInt32 | NTSTATUS reference |
Event ID 1010: Updated SCQ interrupt moderation parameters.
#Event ID 1011: Updated RCQ interrupt moderation parameters.
#Event ID 1012: Affinitized socket CQs.
#Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID → GUID | |
NumaNode UInt16 → unsignedShort | |
RcqProcessorGroup UInt16 → unsignedShort | |
RcqProcessorMask HexInt64 → HexInt64 | |
RcqProcessorIndex UInt32 → unsignedInt | |
ScqProcessorGroup UInt16 → unsignedShort | |
ScqProcessorMask HexInt64 → HexInt64 | |
ScqProcessorIndex UInt32 → unsignedInt |
Event ID 1013: CQ processor.
#Description
CQ processor. NumaNode={NumaNode} ProcessorGroup={ProcessorGroup} ProcessorMask={ProcessorMask} ProcessorIndex={ProcessorIndex}.
Message #
Fields #
| Name | Description |
|---|---|
NumaNode UInt16 → unsignedShort | |
ProcessorGroup UInt16 → unsignedShort | |
ProcessorMask HexInt64 → HexInt64 | |
ProcessorIndex UInt32 → unsignedInt |
Event ID 1014: A socket configuration parameter value is not suppored by the socket's network adapter or is incompatible with one or more of the socket's other co...
#Event ID 5000: An RDMA network adapter has been opened.
#Description
An RDMA network adapter has been opened.
Message #
Fields #
| Name | Description |
|---|---|
AdapterIfIndex UInt32 | |
NdkMajorVer UInt16 | |
NdkMinorVer UInt16 | |
EffectiveNdkMajorVer UInt16 | |
EffectiveNdkMinorVer UInt16 | |
VendorId HexInt32 | |
DeviceId HexInt32 | |
MaxRegistrationSize UInt64 | |
MaxWindowSize UInt64 | |
FrmrPageCount UInt32 | |
MaxInitiatorRequestSge UInt32 | |
MaxEffectiveInitiatorRequestSge UInt32 | |
MaxReceiveRequestSge UInt32 | |
MaxEffectiveReceiveRequestSge UInt32 | |
MaxReadRequestSge UInt32 | |
MaxEffectiveReadRequestSge UInt32 | |
MaxTransferLength UInt32 | |
MaxEffectiveSendSize UInt32 | |
MaxEffectiveReceiveSize UInt32 | |
MaxInlineDataSize UInt32 | |
MaxInboundReadLimit UInt32 | |
MaxOutboundReadLimit UInt32 | |
MaxReceiveQueueDepth UInt32 | |
MaxEffectiveReceiveQueueDepth UInt32 | |
MaxInitiatorQueueDepth UInt32 | |
MaxEffectiveInitiatorQueueDepth UInt32 | |
MaxSrqDepth UInt32 | |
MaxCqDepth UInt32 | |
LargeRequestThreshold UInt32 | |
MaxCallerData UInt32 | |
MaxCalleeData UInt32 | |
AdapterFlags HexInt32 | |
InOrderDma Boolean | |
RdmaReadSinkRequired Boolean | |
CqInterruptModeration Boolean | |
MultiEngine Boolean | |
ReadLocalInvalidate Boolean | |
CqResize Boolean | |
LoopbackConnections Boolean |
Event ID 5002: A socket has disconnected.
#Event ID 5003: A network protocol violation has been detected.
#Event ID 5004: Failed to establish an outbound connection.
#Description
Failed to establish an outbound connection.
Message #
Fields #
| Name | Description |
|---|---|
AdapterIfIndex UInt32 | |
SocketId GUID | |
LocalNetAddressSize UInt32 | |
LocalNetAddress Binary | |
RemoteNetAddressSize UInt32 | |
RemoteNetAddress Binary | |
NdkConnectStatus HexInt32 | |
NdkCompleteConnectStatus HexInt32 | |
NdkReceiveStatus HexInt32 | |
NdkSendStatus HexInt32 | |
NegotiateStatus HexInt32 | |
TimedOut UInt8 | |
RdmaObjectCreationFailureType UInt32 | |
Status HexInt32 | NTSTATUS reference |
Event ID 5005: Failed to accept an inbound connection.
#Description
Failed to accept an inbound connection.
Message #
Fields #
| Name | Description |
|---|---|
AdapterIfIndex UInt32 | |
SocketId GUID | |
LocalNetAddressSize UInt32 | |
LocalNetAddress Binary | |
RemoteNetAddressSize UInt32 | |
RemoteNetAddress Binary | |
NdkAcceptStatus HexInt32 | |
NdkReceiveStatus HexInt32 | |
NdkSendStatus HexInt32 | |
NegotiateStatus HexInt32 | |
TimedOut UInt8 | |
RefusalReason UInt32 | |
RdmaObjectCreationFailureType UInt32 | |
Status HexInt32 | NTSTATUS reference |
Event ID 5006: A socket has been disconnected after the remote peer failed to respond to a keepalive request.
#Event ID 5007: A socket has been disconnected after the remote peer failed to grant send credits.
#Event ID 5008: A request to rundown a socket exceeded the completion deadline.
#Event ID 5009: A request to close a socket exceeded the completion deadline.
#Event ID 9500: Opened network adapter 'AdapterAlias'.
#Description
Opened network adapter 'AdapterAlias'. NdkMajorVer = NdkMajorVer NdkMinorVer = NdkMinorVer VendorId = VendorId DeviceId = DeviceId MaxRegistrationSize = MaxRegistrationSize MaxWindowSize = MaxWindowSize FrmrPageCount = FrmrPageCount MaxInitiatorRequestSge = MaxInitiatorRequestSge MaxReceiveRequestSge = MaxReceiveRequestSge MaxReadRequestSge = MaxReadRequestSge MaxTransferLength = MaxTransferLength MaxInlineDataSize = MaxInlineDataSize MaxInboundReadLimit = MaxInboundReadLimit MaxOutboundReadLimit = MaxOutboundReadLimit MaxReceiveQueueDepth = MaxReceiveQueueDepth MaxInitiatorQueueDepth = MaxInitiatorQueueDepth MaxSrqDepth = MaxSrqDepth MaxCqDepth = MaxCqDepth LargeRequestThreshold = LargeRequestThreshold MaxCallerData = MaxCallerData MaxCalleeData = MaxCalleeData AdapterFlags = AdapterFlags
Message #
Fields #
| Name | Description |
|---|---|
AdapterAlias UnicodeString | |
NdkMajorVer UInt16 | |
NdkMinorVer UInt16 | |
VendorId HexInt32 | |
DeviceId HexInt32 | |
MaxRegistrationSize UInt64 | |
MaxWindowSize UInt64 | |
FrmrPageCount UInt32 | |
MaxInitiatorRequestSge UInt32 | |
MaxReceiveRequestSge UInt32 | |
MaxReadRequestSge UInt32 | |
MaxTransferLength UInt32 | |
MaxInlineDataSize UInt32 | |
MaxInboundReadLimit UInt32 | |
MaxOutboundReadLimit UInt32 | |
MaxReceiveQueueDepth UInt32 | |
MaxInitiatorQueueDepth UInt32 | |
MaxSrqDepth UInt32 | |
MaxCqDepth UInt32 | |
LargeRequestThreshold UInt32 | |
MaxCallerData UInt32 | |
MaxCalleeData UInt32 | |
AdapterFlags HexInt32 |
Event ID 10000: Received negotiate request.
#Description
Received negotiate request. Socket = Local = Remote = MinVersion = MaxVersion = Reserved = CreditsRequested = PreferredSendSize = MaxReceiveSize = MaxFragmentReassemblyBufferSize =.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
MinVersion UInt16 | |
MaxVersion UInt16 | |
Reserved UInt16 | |
CreditsRequested UInt16 | |
PreferredSendSize UInt32 | |
MaxReceiveSize UInt32 | |
MaxFragmentReassemblyBufferSize UInt32 |
Event ID 10001: Sending negotiate request.
#Description
Sending negotiate request. Socket = Local = Remote = MinVersion = MaxVersion = Reserved = CreditsRequested = PreferredSendSize = MaxReceiveSize = MaxFragmentReassemblyBufferSize =.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
MinVersion UInt16 | |
MaxVersion UInt16 | |
Reserved UInt16 | |
CreditsRequested UInt16 | |
PreferredSendSize UInt32 | |
MaxReceiveSize UInt32 | |
MaxFragmentReassemblyBufferSize UInt32 |
Event ID 10002: Received negotiate response.
#Description
Received negotiate response. Socket = SocketID Local = LocalAddress Remote = RemoteAddress MinVersion = MinVersion MaxVersion = MaxVersion NegotiatedVersion = NegotiatedVersion Reserved = Reserved CreditsRequested = CreditsRequested CreditsGranted = CreditsGranted Status = Status MaxReadWriteSize = MaxReadWriteSize PreferredSendSize = PreferredSendSize MaxReceiveSize = MaxReceiveSize MaxFragmentReassemblyBufferSize = MaxFragmentReassemblyBufferSize
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
MinVersion UInt16 | |
MaxVersion UInt16 | |
NegotiatedVersion UInt16 | |
Reserved UInt16 | |
CreditsRequested UInt16 | |
CreditsGranted UInt16 | |
Status HexInt32 | NTSTATUS reference |
MaxReadWriteSize UInt32 | |
PreferredSendSize UInt32 | |
MaxReceiveSize UInt32 | |
MaxFragmentReassemblyBufferSize UInt32 |
Event ID 10003: Sending negotiate response.
#Description
Sending negotiate response. Socket = SocketID Local = LocalAddress Remote = RemoteAddress MinVersion = MinVersion MaxVersion = MaxVersion NegotiatedVersion = NegotiatedVersion Reserved = Reserved CreditsRequested = CreditsRequested CreditsGranted = CreditsGranted Status = Status MaxReadWriteSize = MaxReadWriteSize PreferredSendSize = PreferredSendSize MaxReceiveSize = MaxReceiveSize MaxFragmentReassemblyBufferSize = MaxFragmentReassemblyBufferSize
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
MinVersion UInt16 | |
MaxVersion UInt16 | |
NegotiatedVersion UInt16 | |
Reserved UInt16 | |
CreditsRequested UInt16 | |
CreditsGranted UInt16 | |
Status HexInt32 | NTSTATUS reference |
MaxReadWriteSize UInt32 | |
PreferredSendSize UInt32 | |
MaxReceiveSize UInt32 | |
MaxFragmentReassemblyBufferSize UInt32 |
Event ID 10004: Received data.
#Description
Received data. Socket = SocketID Local = LocalAddress Remote = RemoteAddress CreditsRequested = CreditsRequested CreditsGranted = CreditsGranted Flags = Flags Reserved = Reserved RemainingDataLength = RemainingDataLength DataOffset = DataOffset DataLength = DataLength.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
CreditsRequested UInt16 | |
CreditsGranted UInt16 | |
Flags UInt16 | |
Reserved UInt16 | |
RemainingDataLength UInt32 | |
DataOffset UInt32 | |
DataLength UInt32 |
Event ID 10005: Sending data.
#Description
Sending data. Socket = SocketID Local = LocalAddress Remote = RemoteAddress CreditsRequested = CreditsRequested CreditsGranted = CreditsGranted Flags = Flags Reserved = Reserved RemainingDataLength = RemainingDataLength DataOffset = DataOffset DataLength = DataLength.
Message #
Fields #
| Name | Description |
|---|---|
SocketID GUID | |
LocalAddressLength UInt32 | |
LocalAddress Binary | |
RemoteAddressLength UInt32 | |
RemoteAddress Binary | |
CreditsRequested UInt16 | |
CreditsGranted UInt16 | |
Flags UInt16 | |
Reserved UInt16 | |
RemainingDataLength UInt32 | |
DataOffset UInt32 | |
DataLength UInt32 |
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID db66ea65-b7bb-4ca9-8748-334cb5c32400
Defined in smbdirect.sys, the binary that emits these events.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02