Microsoft-Windows-WinNat

Event	Title	Channel	Sample	Rule
1001	TransportProtocol session created.	Trace	N	N
1002	TransportProtocol session lifetime updated.	Trace	N	N
1003	TransportProtocol session state updated.	Trace	N	N
1004	TransportProtocol session timedout.	Trace	N	N
1005	TransportProtocol session deleted.	Trace	N	N
1006	TransportProtocol binding created.	Trace	N	N
1007	TransportProtocol binding deleted.	Trace	N	N
1008	TransportProtocol binding session count updated.	Trace	N	N
1009	Translating TransportProtocol packet from IncomingSrcAddr:IncomingDstAddr to …	Trace	N	N
1010	Nat Instance InstanceName Action Status: Status.	Trace	N	N
1011	Packet filter Action Status: Status.	Trace	N	N
1012	WFP filter Action Status: Status.	Trace	N	N
1013	Address pool Action Status: Status.	Trace	N	N
1014	Address Action notification.	Trace	N	N
1015	Static binding Action Status: Status.	Trace	N	N
1016	Memory allocation failure: Description.	Trace	N	N
1017	TransportProtocol session created.	Oper	N	N
1018	TransportProtocol session deleted.	Oper	N	N
1019	Created NAT instance InstanceName for RoutingDomainId InternalRoutingDomainId …	Trace	N	N
1020	Modified NAT instance InstanceName properties.	Trace	N	N
1021	NAT instance InstanceName external interface index is ExternalInterfaceIndex for …	Trace	N	N
1022	Deleted NAT instance InstanceName.	Trace	N	N
1023	NAT instance InstanceName: RoutingDomainId InternalRoutingDomainId …	Trace	Y	N
1024	Added external address IPAddress:PortStart-PortEnd to NAT instance InstanceName.	Trace	N	N
1025	Removed external address IPAddress:PortStart-PortEnd from NAT instance …	Trace	N	N
1026	NAT instance InstanceName: external address IPAddress:PortStart-PortEnd.	Trace	Y	N
1027	Added static mapping TransportProtocol ExternalTransportAddress > …	Trace	N	N
1028	Removed static mapping TransportProtocol ExternalTransportAddress > …	Trace	N	N
1029	NAT instance InstanceName: static mapping TransportProtocol …	Trace	N	N
1030	NAT dropped IPv4 TransportProtocol packet which arrived over ArrivalNetwork …	Trace	N	N
1031	NAT detected a default route in compartment CompartmentId interface …	Trace	N	N
1032	NAT detected a default route in compartment CompartmentId interface …	Oper	N	N
1033	NAT instance InstanceName failed to allocate a TransportProtocol port …	Oper	N	N
1034	NAT left processing of IPv4 TransportProtocol packet to the host network stack …	Trace	Y	N
1035	NAT translated and forwarded IPv4 TransportProtocol packet which arrived over …	Trace	N	N
1036	NAT ERROR ErrorID: ErrorContext (ErrorMisc) Status Status.	Trace	N	N
1037	NAT Instance InstanceName created with no matching prefix …	Trace	N	N
1038	Info.	Trace	N	N
1039	Info.	Trace	N	N
1040	Info.	Trace	N	N
1041	Added IPxlat instance for interface InterfaceLuid.	Trace	N	N
1042	Modified IPxlat instance for interface InterfaceLuid.	Trace	N	N
1043	Deleted IPxlat instance for interface InterfaceLuid.	Trace	N	N
1044	XLAT.	Trace	N	N
1045	Added internal address IPAddress, IfIndex IfIndex to NAT instance InstanceName.	Trace	N	N
1046	Removed internal address IPAddress: IfIndex IfIndex from NAT instance …	Trace	N	N
1047	Driver state: PortChunkSize=PortChunkSize, RSCAware=RSCAware, UROAware=UROAware, …	Trace	Y	N

Event ID 1001: TransportProtocol session created.

Channel: Trace
Task: WinNatSessionCreate

Description

TransportProtocol session created. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr, Lifetime: Lifetime seconds, TcpState:TcpSessionState.

Message #

%7 session created. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState:%9

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalSrcAddr` Binary
`InternalDstAddr` Binary
`ExternalAddrLen` UInt32
`ExternalSrcAddr` Binary
`ExternalDstAddr` Binary
`TransportProtocol` UInt32
`Lifetime` UInt32
`TcpSessionState` UInt32
`InternalCompartmentId` UInt32

Event ID 1002: TransportProtocol session lifetime updated.

Channel: Trace
Task: WinNatSessionTimerUpdate

Description

session lifetime updated. Internal source transport addr: , Internal dest transport addr: , External source transport addr , External dest transport addr , Lifetime: seconds, TcpState.

Message #

%7 session lifetime updated. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState: %9

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalSrcAddr` Binary
`InternalDstAddr` Binary
`ExternalAddrLen` UInt32
`ExternalSrcAddr` Binary
`ExternalDstAddr` Binary
`TransportProtocol` UInt32
`Lifetime` UInt32
`TcpSessionState` UInt32
`InternalCompartmentId` UInt32

Event ID 1003: TransportProtocol session state updated.

Channel: Trace
Task: WinNatSessionTcpStateUpdate

Description

TransportProtocol session state updated. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr, Lifetime: Lifetime seconds, TcpState: TcpSessionState.

Message #

%7 session state updated. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState: %9

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalSrcAddr` Binary
`InternalDstAddr` Binary
`ExternalAddrLen` UInt32
`ExternalSrcAddr` Binary
`ExternalDstAddr` Binary
`TransportProtocol` UInt32
`Lifetime` UInt32
`TcpSessionState` UInt32
`InternalCompartmentId` UInt32

Event ID 1004: TransportProtocol session timedout.

Channel: Trace
Task: WinNatSessionTimeout

Description

TransportProtocol session timedout. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr, Lifetime: Lifetime seconds, TcpState: TcpSessionState.

Message #

%7 session timedout. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState: %9

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalSrcAddr` Binary
`InternalDstAddr` Binary
`ExternalAddrLen` UInt32
`ExternalSrcAddr` Binary
`ExternalDstAddr` Binary
`TransportProtocol` UInt32
`Lifetime` UInt32
`TcpSessionState` UInt32
`InternalCompartmentId` UInt32

Event ID 1005: TransportProtocol session deleted.

Channel: Trace
Task: WinNatSessionDelete

Description

TransportProtocol session deleted. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr, Lifetime: Lifetime seconds, TcpState: TcpSessionState.

Message #

%7 session deleted. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState: %9

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalSrcAddr` Binary
`InternalDstAddr` Binary
`ExternalAddrLen` UInt32
`ExternalSrcAddr` Binary
`ExternalDstAddr` Binary
`TransportProtocol` UInt32
`Lifetime` UInt32
`TcpSessionState` UInt32
`InternalCompartmentId` UInt32

Event ID 1006: TransportProtocol binding created.

Channel: Trace
Task: WinNatBindingCreate

Description

TransportProtocol binding created. Internal transport addr: InternalAddr, External transport addr ExternalAddr, SessionCount: SessionCount, Configured: Configured.

Message #

%5 binding created. Internal transport addr: %2, External transport addr %4, SessionCount: %6, Configured: %7

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalAddr` Binary
`ExternalAddrLen` UInt32
`ExternalAddr` Binary
`TransportProtocol` UInt32
`SessionCount` UInt32
`Configured` Boolean
`InternalCompartmentId` UInt32

Event ID 1007: TransportProtocol binding deleted.

Channel: Trace
Task: WinNatBindingDelete

Description

TransportProtocol binding deleted. Internal transport addr: InternalAddr, External transport addr ExternalAddr, SessionCount: SessionCount, Configured: Configured.

Message #

%5 binding deleted. Internal transport addr: %2, External transport addr %4, SessionCount: %6, Configured: %7

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalAddr` Binary
`ExternalAddrLen` UInt32
`ExternalAddr` Binary
`TransportProtocol` UInt32
`SessionCount` UInt32
`Configured` Boolean
`InternalCompartmentId` UInt32

Event ID 1008: TransportProtocol binding session count updated.

Channel: Trace
Task: WinNatBindingSessionCount

Description

TransportProtocol binding session count updated. Internal transport addr: InternalAddr, External transport addr ExternalAddr, SessionCount: SessionCount, Configured: Configured.

Message #

%5 binding session count updated. Internal transport addr: %2, External transport addr %4, SessionCount: %6, Configured: %7

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalAddr` Binary
`ExternalAddrLen` UInt32
`ExternalAddr` Binary
`TransportProtocol` UInt32
`SessionCount` UInt32
`Configured` Boolean
`InternalCompartmentId` UInt32

Event ID 1009: Translating TransportProtocol packet from IncomingSrcAddr:IncomingDstAddr to TranslatedSrcAddr:TranslatedDstAddr, IPID:Identification.

Channel: Trace
Task: WinNatTranslation

Description

Translating TransportProtocol packet from IncomingSrcAddr:IncomingDstAddr to TranslatedSrcAddr:TranslatedDstAddr, IPID:Identification. Status: Status, IcmpType: IcmpType, IcmpCode: IcmpCode, IcmpErrorPayload: IcmpPayload.

Message #

Translating %8 packet from %2:%3 to %5:%6, IPID:%7. Status: %9, IcmpType: %10, IcmpCode: %11, IcmpErrorPayload: %12

Fields #

Name	Description
`IncomingAddrLen` UInt32
`IncomingSrcAddr` Binary
`IncomingDstAddr` Binary
`TranslatedAddrLen` UInt32
`TranslatedSrcAddr` Binary
`TranslatedDstAddr` Binary
`Identification` UInt32
`TransportProtocol` UInt32
`Status` UInt32	NTSTATUS reference
`IcmpType` UInt32
`IcmpCode` UInt32
`IcmpPayload` Boolean

Event ID 1010: Nat Instance InstanceName Action Status: Status.

Channel: Trace
Task: WinNatInstanceEvent

Description

Nat Instance InstanceName Action Status: Status.UdpIdleSessionTimeout: UdpIdleSessionTimeout sec, TcpTransientConnectionTimeout: TcpTransientConnectionTimeout, TcpEstablishedConnectionTimeout: TcpEstablishedConnectionTimeout, IcmpQueryTimeout: IcmpQueryTimeout, TcpFilteringBehavior: TcpFilteringBehavior, UdpFilteringBehavior: UdpFilteringBehavior, UdpInboundRefresh: UdpInboundRefresh, Enabled: Enabled

Message #

Nat Instance %1 %11 Status: %10.UdpIdleSessionTimeout: %2 sec, TcpTransientConnectionTimeout: %3, TcpEstablishedConnectionTimeout: %4, IcmpQueryTimeout: %5, TcpFilteringBehavior: %6, UdpFilteringBehavior: %7, UdpInboundRefresh: %8, Enabled: %9

Fields #

Name	Description
`InstanceName` UnicodeString
`UdpIdleSessionTimeout` UInt32
`TcpTransientConnectionTimeout` UInt32
`TcpEstablishedConnectionTimeout` UInt32
`IcmpQueryTimeout` UInt32
`TcpFilteringBehavior` UInt32
`UdpFilteringBehavior` UInt32
`UdpInboundRefresh` Boolean
`Enabled` Boolean
`Status` UInt32	NTSTATUS reference
`Action` UInt32

Event ID 1011: Packet filter Action Status: Status.

Channel: Trace
Task: WinNatPacketFilterEvent

Description

Packet filter Status: . Instance: , SrcPrefix: , SrcPrefixLength: , DstPrefix: , DstPrefixLength: , Ipv4Prefix: , Ipv4PrefixLength: , Nat64: , InterfaceLuid.

Message #

Packet filter %12 Status: %13. Instance: %1, SrcPrefix: %3, SrcPrefixLength: %4, DstPrefix: %5, DstPrefixLength: %6, Ipv4Prefix: %7, Ipv4PrefixLength: %8, Nat64: %9, InterfaceLuid: %10

Fields #

Name	Description
`InstanceName` UnicodeString
`InternalPrefixAddrLength` UInt32
`InternalSrcPrefix` Binary
`InternalSrcPrefixLength` UInt32
`InternaDstlPrefix` Binary
`InternalDstPrefixLength` UInt32
`IPv4Prefix` UInt32
`IPv4PrefixLength` UInt32
`Nat64` Boolean
`InterfaceLuid` UInt64
`FilterId` UInt64
`Action` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 1012: WFP filter Action Status: Status.

Channel: Trace
Task: WinNatWFPFilterEvent

Description

WFP filter Status: . Instance: , FilterId: , SrcPrefix: , SrcPrefixLength: , DstPrefix: , DstPrefixLength: , Ipv4Prefix: , Ipv4PrefixLength: , Nat64: , InterfaceLuid.

Message #

WFP filter %12 Status: %13. Instance: %1, FilterId: %11, SrcPrefix: %3, SrcPrefixLength: %4, DstPrefix: %5, DstPrefixLength: %6, Ipv4Prefix: %7, Ipv4PrefixLength: %8, Nat64: %9, InterfaceLuid: %10

Fields #

Name	Description
`InstanceName` UnicodeString
`InternalPrefixAddrLength` UInt32
`InternalSrcPrefix` Binary
`InternalSrcPrefixLength` UInt32
`InternaDstlPrefix` Binary
`InternalDstPrefixLength` UInt32
`IPv4Prefix` UInt32
`IPv4PrefixLength` UInt32
`Nat64` Boolean
`InterfaceLuid` UInt64
`FilterId` UInt64
`Action` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 1013: Address pool Action Status: Status.

Channel: Trace
Task: WinNatAddressPoolConfig

Description

Address pool Action Status: Status. Instance: InstanceName, Address: Address, StartingPort: StartingPort, EndingPort: EndingPort, InterfaceLuid: InterfaceLuid.

Message #

Address pool %6 Status: %7. Instance: %1, Address: %2, StartingPort: %3, EndingPort: %4, InterfaceLuid: %5

Fields #

Name	Description
`InstanceName` UnicodeString
`Address` UInt32
`StartingPort` UInt16
`EndingPort` UInt16
`InterfaceLuid` UInt64
`Action` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 1014: Address Action notification.

Channel: Trace
Task: WinNatAddressChangeNotify

Description

Address Action notification. Address: Address, InterfaceLuid: InterfaceLuid.

Message #

Address %6 notification. Address: %2, InterfaceLuid: %5

Fields #

Name	Description
`InstanceName` UnicodeString
`Address` UInt32
`StartingPort` UInt16
`EndingPort` UInt16
`InterfaceLuid` UInt64
`Action` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 1015: Static binding Action Status: Status.

Channel: Trace
Task: WinNatStaticBindingEvent

Description

Static binding Action Status: Status. Internal Source: InternalAddr, External Source: ExternalAddr, Protocol: TransportProtocol.

Message #

Static binding %6 Status: %7. Internal Source: %2, External Source: %4, Protocol: %5

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalAddr` Binary
`ExternalAddrLen` UInt32
`ExternalAddr` Binary
`TransportProtocol` UInt32
`Action` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 1016: Memory allocation failure: Description.

Channel: Trace
Task: WinNatMemoryAllocationFailure

Message #

Memory allocation failure: %1

Fields #

Name	Description
`Description` UnicodeString

Event ID 1017: TransportProtocol session created.

Channel: Oper
Task: WinNatSessionCreateOperational

Description

Message #

%7 session created. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalSrcAddr` Binary
`InternalDstAddr` Binary
`ExternalAddrLen` UInt32
`ExternalSrcAddr` Binary
`ExternalDstAddr` Binary
`TransportProtocol` UInt32

Event ID 1018: TransportProtocol session deleted.

Channel: Oper
Task: WinNatSessionDeleteOperational

Description

Message #

%7 session deleted. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6

Fields #

Name	Description
`InternalAddrLen` UInt32
`InternalSrcAddr` Binary
`InternalDstAddr` Binary
`ExternalAddrLen` UInt32
`ExternalSrcAddr` Binary
`ExternalDstAddr` Binary
`TransportProtocol` UInt32

Event ID 1019: Created NAT instance InstanceName for RoutingDomainId InternalRoutingDomainId (CompartmentId CompartmentId) with external interface prefix AddressPrefix/PrefixLength.

Channel: Trace
Task: WinNatMInstanceCreation

Message #

Created NAT instance %1 for RoutingDomainId %2 (CompartmentId %5) with external interface prefix %4/%3

Fields #

Name	Description
`InstanceName` UnicodeString
`InternalRoutingDomainId` GUID
`PrefixLength` UInt32
`AddressPrefix` UInt32
`CompartmentId` UInt32
`ExternalInterfaceIndex` UInt32
`UdpIdleSessionTimeout` UInt32
`TcpTransientConnectionTimeout` UInt32
`TcpEstablishedConnectionTimeout` UInt32
`IcmpQueryTimeout` UInt32
`TcpFilteringBehavior` UInt32
`UdpFilteringBehavior` UInt32
`UdpInboundRefresh` Boolean
`InstanceType` UInt32

Event ID 1020: Modified NAT instance InstanceName properties.

Channel: Trace
Task: WinNatMInstanceModification

Message #

Modified NAT instance %1 properties

Fields #

Name	Description
`InstanceName` UnicodeString
`InternalRoutingDomainId` GUID
`ExternalIPInterfaceAddressPrefixLength` UInt32
`ExternalIPInterfaceAddressPrefix` UInt32
`CompartmentId` UInt32
`ExternalInterfaceIndex` UInt32
`UdpIdleSessionTimeout` UInt32
`TcpTransientConnectionTimeout` UInt32
`TcpEstablishedConnectionTimeout` UInt32
`IcmpQueryTimeout` UInt32
`TcpFilteringBehavior` UInt32
`UdpFilteringBehavior` UInt32
`UdpInboundRefresh` Boolean

Event ID 1021: NAT instance InstanceName external interface index is ExternalInterfaceIndex for prefix ExternalIPInterfaceAddressPrefix/ExternalIPInterfaceAddressPrefixLength.

Channel: Trace
Task: WinNatMInstanceExternalInterfaceAssociation

Message #

NAT instance %1 external interface index is %6 for prefix %4/%3

Fields #

Name	Description
`InstanceName` UnicodeString
`InternalRoutingDomainId` GUID
`ExternalIPInterfaceAddressPrefixLength` UInt32
`ExternalIPInterfaceAddressPrefix` UInt32
`CompartmentId` UInt32
`ExternalInterfaceIndex` UInt32
`UdpIdleSessionTimeout` UInt32
`TcpTransientConnectionTimeout` UInt32
`TcpEstablishedConnectionTimeout` UInt32
`IcmpQueryTimeout` UInt32
`TcpFilteringBehavior` UInt32
`UdpFilteringBehavior` UInt32
`UdpInboundRefresh` Boolean

Event ID 1022: Deleted NAT instance InstanceName.

Channel: Trace
Task: WinNatMInstanceDeletion

Message #

Deleted NAT instance %1

Fields #

Name	Description
`InstanceName` UnicodeString
`InternalRoutingDomainId` GUID
`ExternalIPInterfaceAddressPrefixLength` UInt32
`ExternalIPInterfaceAddressPrefix` UInt32
`CompartmentId` UInt32
`ExternalInterfaceIndex` UInt32
`UdpIdleSessionTimeout` UInt32
`TcpTransientConnectionTimeout` UInt32
`TcpEstablishedConnectionTimeout` UInt32
`IcmpQueryTimeout` UInt32
`TcpFilteringBehavior` UInt32
`UdpFilteringBehavior` UInt32
`UdpInboundRefresh` Boolean

Event ID 1023: NAT instance InstanceName: RoutingDomainId InternalRoutingDomainId (CompartmentId CompartmentId), external interface index ExternalInterfaceIndex (AddressPrefix/PrefixLength).

Channel: Trace
Also via: realtime ETW trace
Level: Informational
Task: WinNatMInstanceRundown
Opcode: win:Info

Message #

NAT instance %1: RoutingDomainId %2 (CompartmentId %5), external interface index %6 (%4/%3)

Fields #

Name	Description
`InstanceName` UnicodeString
`InternalRoutingDomainId` GUID
`PrefixLength` UInt32
`AddressPrefix` UInt32
`CompartmentId` UInt32
`ExternalInterfaceIndex` UInt32
`UdpIdleSessionTimeout` UInt32
`TcpTransientConnectionTimeout` UInt32
`TcpEstablishedConnectionTimeout` UInt32
`IcmpQueryTimeout` UInt32
`TcpFilteringBehavior` UInt32
`UdpFilteringBehavior` UInt32
`UdpInboundRefresh` Boolean
`InstanceType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinNat",
    "guid": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}",
    "event_source_name": "",
    "event_id": 1023,
    "version": 1,
    "level": 4,
    "task": 1023,
    "opcode": 0,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T06:08:06.772+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}"
    },
    "execution": {
      "process_id": 9736,
      "thread_id": 10668
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AddressPrefix": 12589740,
    "CompartmentId": 1,
    "ExternalInterfaceIndex": 0,
    "IcmpQueryTimeout": 30,
    "InstanceName": "ICSf3b2d77a-335a-48b3-8cf1-04bd3ff3b253",
    "InstanceType": 1,
    "InternalRoutingDomainId": "{00000000-0000-0000-0000-000000000000}",
    "PrefixLength": 20,
    "TcpEstablishedConnectionTimeout": 1800,
    "TcpFilteringBehavior": 1,
    "TcpTransientConnectionTimeout": 120,
    "UdpFilteringBehavior": 1,
    "UdpIdleSessionTimeout": 300,
    "UdpInboundRefresh": false
  },
  "message": "WinNatMInstanceRundown"
}

Event ID 1024: Added external address IPAddress:PortStart-PortEnd to NAT instance InstanceName.

Channel: Trace
Task: WinNatMExternalAddressAddition

Message #

Added external address %3:%4-%5 to NAT instance %1

Fields #

Name	Description
`InstanceName` UnicodeString
`AddressLength` UInt32
`IPAddress` Binary
`PortStart` UInt16
`PortEnd` UInt16

Event ID 1025: Removed external address IPAddress:PortStart-PortEnd from NAT instance InstanceName.

Channel: Trace
Task: WinNatMExternalAddressRemoval

Message #

Removed external address %3:%4-%5 from NAT instance %1

Fields #

Name	Description
`InstanceName` UnicodeString
`AddressLength` UInt32
`IPAddress` Binary
`PortStart` UInt16
`PortEnd` UInt16

Event ID 1026: NAT instance InstanceName: external address IPAddress:PortStart-PortEnd.

Channel: Trace
Also via: realtime ETW trace
Level: Informational
Task: WinNatMExternalAddressRundown
Opcode: win:Info

Message #

NAT instance %1: external address %3:%4-%5

Fields #

Name	Description
`InstanceName` UnicodeString
`AddressLength` UInt32
`IPAddress` Binary
`PortStart` UInt16
`PortEnd` UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinNat",
    "guid": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}",
    "event_source_name": "",
    "event_id": 1026,
    "version": 0,
    "level": 4,
    "task": 1026,
    "opcode": 0,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T06:08:06.772+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}"
    },
    "execution": {
      "process_id": 9736,
      "thread_id": 10668
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AddressLength": 16,
    "IPAddress": "020000007F0000010000000000000000",
    "InstanceName": "ICSf3b2d77a-335a-48b3-8cf1-04bd3ff3b253",
    "PortEnd": 49833,
    "PortStart": 49734
  },
  "message": "WinNatMExternalAddressRundown"
}

Event ID 1027: Added static mapping TransportProtocol ExternalTransportAddress > InternalTransportAddress (CompartmentId CompartmentId) to NAT instance InstanceName (MappingType RemoteAddressPrefix/RemoteAddressP...

Channel: Trace
Task: WinNatMStaticMappingAddition

Description

Added static mapping TransportProtocol ExternalTransportAddress > InternalTransportAddress (CompartmentId CompartmentId) to NAT instance InstanceName (MappingType RemoteAddressPrefix/RemoteAddressPrefixLength).

Message #

Added static mapping %2 %5 > %6 (CompartmentId %8) to NAT instance %1 (%3 %9/%10)

Fields #

Name	Description
`InstanceName` UnicodeString
`TransportProtocol` UInt32
`MappingType` UInt32
`AddressLength` UInt32
`ExternalTransportAddress` Binary
`InternalTransportAddress` Binary
`InternalRoutingDomainId` GUID
`CompartmentId` UInt32
`RemoteAddressPrefix` Binary
`RemoteAddressPrefixLength` UInt32

Event ID 1028: Removed static mapping TransportProtocol ExternalTransportAddress > InternalTransportAddress (CompartmentId CompartmentId) from NAT instance InstanceName (MappingType RemoteAddressPrefix/RemoteAddr...

Channel: Trace
Task: WinNatMStaticMappingRemoval

Description

Removed static mapping TransportProtocol ExternalTransportAddress > InternalTransportAddress (CompartmentId CompartmentId) from NAT instance InstanceName (MappingType RemoteAddressPrefix/RemoteAddressPrefixLength).

Message #

Removed static mapping %2 %5 > %6 (CompartmentId %8) from NAT instance %1 (%3 %9/%10)

Fields #

Name	Description
`InstanceName` UnicodeString
`TransportProtocol` UInt32
`MappingType` UInt32
`AddressLength` UInt32
`ExternalTransportAddress` Binary
`InternalTransportAddress` Binary
`InternalRoutingDomainId` GUID
`CompartmentId` UInt32
`RemoteAddressPrefix` Binary
`RemoteAddressPrefixLength` UInt32

Event ID 1029: NAT instance InstanceName: static mapping TransportProtocol ExternalTransportAddress > InternalTransportAddress (CompartmentId CompartmentId) (MappingType RemoteAddressPrefix/RemoteAddressPrefixLen...

Channel: Trace
Task: WinNatMStaticMappingRundown

Description

NAT instance InstanceName: static mapping TransportProtocol ExternalTransportAddress > InternalTransportAddress (CompartmentId CompartmentId) (MappingType RemoteAddressPrefix/RemoteAddressPrefixLength).

Message #

NAT instance %1: static mapping %2 %5 > %6 (CompartmentId %8) (%3 %9/%10)

Fields #

Name	Description
`InstanceName` UnicodeString
`TransportProtocol` UInt32
`MappingType` UInt32
`AddressLength` UInt32
`ExternalTransportAddress` Binary
`InternalTransportAddress` Binary
`InternalRoutingDomainId` GUID
`CompartmentId` UInt32
`RemoteAddressPrefix` Binary
`RemoteAddressPrefixLength` UInt32

Event ID 1030: NAT dropped IPv4 TransportProtocol packet which arrived over ArrivalNetwork interface ArrivalInterfaceIndex in compartment ArrivalCompartmentId with reason: ActionReason.

Channel: Trace
Task: WinNatMDroppedIPv4Packet

Message #

NAT dropped IPv4 %5 packet which arrived over %4 interface %3 in compartment %2 with reason: %1.

Fields #

Name	Description
`ActionReason` UInt32
`ArrivalCompartmentId` UInt32
`ArrivalInterfaceIndex` UInt32
`ArrivalNetwork` UInt32
`TransportProtocol` UInt32
`ForwardCompartmentId` UInt32
`ForwardInterfaceIndex` UInt32
`PacketLength` UInt32
`ContinuousLength` UInt32
`CapturedIPHeaderLength` UInt32
`CapturedTransportHeaderLength` UInt32
`ICMPErrorTransportProtocol` UInt32
`ICMPErrorCapturedIPHeaderLength` UInt32
`ICMPErrorCapturedTransportHeaderLength` UInt32
`IPHeader` Binary
`TransportHeader` Binary
`ICMPErrorIPHeader` Binary
`ICMPErrorTransportHeader` Binary

Event ID 1031: NAT detected a default route in compartment CompartmentId interface InterfaceIndex.

Channel: Trace
Task: WinNatMImproperDefaultRoute

Description

NAT detected a default route in compartment CompartmentId interface InterfaceIndex. Default routes in internal compartments will prevent NAT operation for those compartments.

Message #

NAT detected a default route in compartment %1 interface %2. Default routes in internal compartments will prevent NAT operation for those compartments.

Fields #

Name	Description
`CompartmentId` UInt32
`InterfaceIndex` UInt32

Event ID 1032: NAT detected a default route in compartment CompartmentId interface InterfaceIndex.

Channel: Oper
Task: WinNatMImproperDefaultRouteOper

Description

NAT detected a default route in compartment CompartmentId interface InterfaceIndex. Default routes in internal compartments will prevent NAT operation for those compartments.

Message #

NAT detected a default route in compartment %1 interface %2. Default routes in internal compartments will prevent NAT operation for those compartments.

Fields #

Name	Description
`CompartmentId` UInt32
`InterfaceIndex` UInt32

Event ID 1033: NAT instance InstanceName failed to allocate a TransportProtocol port dynamically because all ports in the instance's external address pool are in use.

Channel: Oper
Task: WinNatMOutOfPortsOper

Message #

NAT instance %1 failed to allocate a %2 port dynamically because all ports in the instance's external address pool are in use.

Fields #

Name	Description
`InstanceName` UnicodeString
`TransportProtocol` UInt32

Event ID 1034: NAT left processing of IPv4 TransportProtocol packet to the host network stack over ArrivalNetwork interface ArrivalInterfaceIndex in compartment ArrivalCompartmentId with reason: ActionReason.

Channel: Trace
Also via: realtime ETW trace
Level: Verbose
Task: WinNatMSkippedIPv4Packet
Opcode: win:Info

Message #

NAT left processing of IPv4 %5 packet to the host network stack over %4 interface %3 in compartment %2 with reason: %1.

Fields #

Name	Description
`ActionReason` UInt32
`ArrivalCompartmentId` UInt32
`ArrivalInterfaceIndex` UInt32
`ArrivalNetwork` UInt32
`TransportProtocol` UInt32
`ForwardCompartmentId` UInt32
`ForwardInterfaceIndex` UInt32
`PacketLength` UInt32
`ContinuousLength` UInt32
`CapturedIPHeaderLength` UInt32
`CapturedTransportHeaderLength` UInt32
`ICMPErrorTransportProtocol` UInt32
`ICMPErrorCapturedIPHeaderLength` UInt32
`ICMPErrorCapturedTransportHeaderLength` UInt32
`IPHeader` Binary
`TransportHeader` Binary
`ICMPErrorIPHeader` Binary
`ICMPErrorTransportHeader` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinNat",
    "guid": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}",
    "event_source_name": "",
    "event_id": 1034,
    "version": 0,
    "level": 5,
    "task": 1034,
    "opcode": 0,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T06:08:08.447+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ActionReason": 21,
    "ArrivalCompartmentId": 1,
    "ArrivalInterfaceIndex": 11,
    "ArrivalNetwork": 2,
    "CapturedIPHeaderLength": 20,
    "CapturedTransportHeaderLength": 20,
    "ContinuousLength": 40,
    "ForwardCompartmentId": 0,
    "ForwardInterfaceIndex": 0,
    "ICMPErrorCapturedIPHeaderLength": 0,
    "ICMPErrorCapturedTransportHeaderLength": 0,
    "ICMPErrorIPHeader": "",
    "ICMPErrorTransportHeader": "",
    "ICMPErrorTransportProtocol": 0,
    "IPHeader": "450000281A4140003F064A20C00002FE0A020A6F",
    "PacketLength": 40,
    "TransportHeader": "ECF41762C38106F39091305D5010083640750000",
    "TransportProtocol": 6
  },
  "message": "WinNatMSkippedIPv4Packet"
}

Event ID 1035: NAT translated and forwarded IPv4 TransportProtocol packet which arrived over ArrivalNetwork interface ArrivalInterfaceIndex in compartment ArrivalCompartmentId to interface ForwardInterfaceIndex i...

Channel: Trace
Task: WinNatMForwardedIPv4Packet

Description

NAT translated and forwarded IPv4 TransportProtocol packet which arrived over ArrivalNetwork interface ArrivalInterfaceIndex in compartment ArrivalCompartmentId to interface ForwardInterfaceIndex in compartment ForwardCompartmentId.

Message #

NAT translated and forwarded IPv4 %5 packet which arrived over %4 interface %3 in compartment %2 to interface %7 in compartment %6.

Fields #

Name	Description
`ActionReason` UInt32
`ArrivalCompartmentId` UInt32
`ArrivalInterfaceIndex` UInt32
`ArrivalNetwork` UInt32
`TransportProtocol` UInt32
`ForwardCompartmentId` UInt32
`ForwardInterfaceIndex` UInt32
`PacketLength` UInt32
`ContinuousLength` UInt32
`CapturedIPHeaderLength` UInt32
`CapturedTransportHeaderLength` UInt32
`ICMPErrorTransportProtocol` UInt32
`ICMPErrorCapturedIPHeaderLength` UInt32
`ICMPErrorCapturedTransportHeaderLength` UInt32
`IPHeader` Binary
`TransportHeader` Binary
`ICMPErrorIPHeader` Binary
`ICMPErrorTransportHeader` Binary

Event ID 1036: NAT ERROR ErrorID: ErrorContext (ErrorMisc) Status Status.

Channel: Trace
Task: WinNatMGeneralError

Message #

NAT ERROR %1: %2 (%3) Status %4

Fields #

Name	Description
`ErrorID` UInt32
`ErrorContext` UnicodeString
`ErrorMisc` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 1037: NAT Instance InstanceName created with no matching prefix AddressPrefix/PrefixLength.

Channel: Trace
Task: WinNatMInstanceCreationWithNoMatchingPrefix

Message #

NAT Instance %1 created with no matching prefix %4/%3.

Fields #

Name	Description
`InstanceName` UnicodeString
`InternalRoutingDomainId` GUID
`PrefixLength` UInt32
`AddressPrefix` UInt32
`CompartmentId` UInt32
`ExternalInterfaceIndex` UInt32
`UdpIdleSessionTimeout` UInt32
`TcpTransientConnectionTimeout` UInt32
`TcpEstablishedConnectionTimeout` UInt32
`IcmpQueryTimeout` UInt32
`TcpFilteringBehavior` UInt32
`UdpFilteringBehavior` UInt32
`UdpInboundRefresh` Boolean
`InstanceType` UInt32

Event ID 1038: Info.

Channel: Trace
Task: WinNatMTaskGenericEventInformational

Message #

%1

Fields #

Name	Description
`Info` UnicodeString

Event ID 1039: Info.

Channel: Trace
Task: WinNatMTaskGenericEventError

Message #

%1

Fields #

Name	Description
`Info` UnicodeString

Event ID 1040: Info.

Channel: Trace
Task: WinNatMTaskGenericEventError

Message #

%1

Fields #

Name	Description
`Info` UnicodeString

Event ID 1041: Added IPxlat instance for interface InterfaceLuid.

Channel: Trace
Task: WinNatIPxlatInstanceCreate

Message #

Added IPxlat instance for interface %1

Fields #

Name	Description
`InterfaceLuid` UInt64
`FallbackIPv4Address` UInt32
`SyntheticIPv4Address` UInt32
`SyntheticIPv6Address` Binary
`RemotePrefix` Binary
`RemotePrefixLength` UInt32
`LocalPrefix` Binary
`LocalPrefixLength` UInt32

Event ID 1042: Modified IPxlat instance for interface InterfaceLuid.

Channel: Trace
Task: WinNatIPxlatInstanceModify

Message #

Modified IPxlat instance for interface %1

Fields #

Name	Description
`InterfaceLuid` UInt64
`FallbackIPv4Address` UInt32
`SyntheticIPv4Address` UInt32
`SyntheticIPv6Address` Binary
`RemotePrefix` Binary
`RemotePrefixLength` UInt32
`LocalPrefix` Binary
`LocalPrefixLength` UInt32

Event ID 1043: Deleted IPxlat instance for interface InterfaceLuid.

Channel: Trace
Task: WinNatIPxlatInstanceDelete

Message #

Deleted IPxlat instance for interface %1

Fields #

Name	Description
`InterfaceLuid` UInt64
`FallbackIPv4Address` UInt32
`SyntheticIPv4Address` UInt32
`SyntheticIPv6Address` Binary
`RemotePrefix` Binary
`RemotePrefixLength` UInt32
`LocalPrefix` Binary
`LocalPrefixLength` UInt32

Event ID 1044: XLAT.

Channel: Trace
Task: WinNatIPxlatGenericTrace

Description

XLAT: Info

Message #

XLAT: %1

Fields #

Name	Description
`Info` UnicodeString

Event ID 1045: Added internal address IPAddress, IfIndex IfIndex to NAT instance InstanceName.

Channel: Trace
Task: WinNatMInternalAddressAddition

Message #

Added internal address %3, IfIndex %4 to NAT instance %1

Fields #

Name	Description
`InstanceName` UnicodeString
`AddressLength` UInt32
`IPAddress` Binary
`IfIndex` UInt32

Event ID 1046: Removed internal address IPAddress: IfIndex IfIndex from NAT instance InstanceName.

Channel: Trace
Task: WinNatMInternalAddressRemoval

Message #

Removed internal address %3: IfIndex %4 from NAT instance %1

Fields #

Name	Description
`InstanceName` UnicodeString
`AddressLength` UInt32
`IPAddress` Binary
`IfIndex` UInt32

Event ID 1047: Driver state: PortChunkSize=PortChunkSize, RSCAware=RSCAware, UROAware=UROAware, FragmentAware=FragmentAware, ForceInternalRoute=ForceInternalRoute, UdpSessionTimeout=UdpSessionTimeout, ClampMssEna...

Channel: Trace
Also via: realtime ETW trace
Level: Informational
Task: WinNatDriverStateRundown
Opcode: win:Info

Description

Driver state: PortChunkSize=PortChunkSize, RSCAware=RSCAware, UROAware=UROAware, FragmentAware=FragmentAware, ForceInternalRoute=ForceInternalRoute, UdpSessionTimeout=UdpSessionTimeout, ClampMssEnabled=ClampMssEnabled.

Message #

Driver state: PortChunkSize=%1, RSCAware=%2, UROAware=%3, FragmentAware=%4, ForceInternalRoute=%5, UdpSessionTimeout=%6, ClampMssEnabled=%7

Fields #

Name	Description
`PortChunkSize` UInt32
`RSCAware` Boolean
`UROAware` Boolean
`FragmentAware` Boolean
`ForceInternalRoute` Boolean
`UdpSessionTimeout` UInt32
`ClampMssEnabled` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinNat",
    "guid": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}",
    "event_source_name": "",
    "event_id": 1047,
    "version": 0,
    "level": 4,
    "task": 1047,
    "opcode": 0,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T06:08:06.772+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}"
    },
    "execution": {
      "process_id": 9736,
      "thread_id": 10668
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClampMssEnabled": false,
    "ForceInternalRoute": false,
    "FragmentAware": false,
    "PortChunkSize": 100,
    "RSCAware": true,
    "UROAware": true,
    "UdpSessionTimeout": 300
  },
  "message": "WinNatDriverStateRundown"
}

Provenance

ETW provider GUID {66C07ECD-6667-43FC-93F8-05CF07F446EC}

Defined in winnat.sys, the binary that emits these events.

Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB