Microsoft-Windows-WinNat

Description

TransportProtocol session created. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr, Lifetime: Lifetime seconds, TcpState:TcpSessionState.

Message #

%7 session created. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState:%9

Fields #

Description

session lifetime updated. Internal source transport addr: , Internal dest transport addr: , External source transport addr , External dest transport addr , Lifetime: seconds, TcpState.

Message #

%7 session lifetime updated. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState: %9

Fields #

Description

TransportProtocol session state updated. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr, Lifetime: Lifetime seconds, TcpState: TcpSessionState.

Message #

%7 session state updated. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState: %9

Fields #

Description

TransportProtocol session timedout. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr, Lifetime: Lifetime seconds, TcpState: TcpSessionState.

Message #

%7 session timedout. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState: %9

Fields #

Description

TransportProtocol session deleted. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr, Lifetime: Lifetime seconds, TcpState: TcpSessionState.

Message #

%7 session deleted. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6, Lifetime: %8 seconds, TcpState: %9

Fields #

Description

TransportProtocol binding created. Internal transport addr: InternalAddr, External transport addr ExternalAddr, SessionCount: SessionCount, Configured: Configured.

Message #

%5 binding created. Internal transport addr: %2, External transport addr %4, SessionCount: %6, Configured: %7

Fields #

Description

TransportProtocol binding deleted. Internal transport addr: InternalAddr, External transport addr ExternalAddr, SessionCount: SessionCount, Configured: Configured.

Message #

%5 binding deleted. Internal transport addr: %2, External transport addr %4, SessionCount: %6, Configured: %7

Fields #

Description

TransportProtocol binding session count updated. Internal transport addr: InternalAddr, External transport addr ExternalAddr, SessionCount: SessionCount, Configured: Configured.

Message #

%5 binding session count updated. Internal transport addr: %2, External transport addr %4, SessionCount: %6, Configured: %7

Fields #

Description

Translating TransportProtocol packet from IncomingSrcAddr:IncomingDstAddr to TranslatedSrcAddr:TranslatedDstAddr, IPID:Identification. Status: Status, IcmpType: IcmpType, IcmpCode: IcmpCode, IcmpErrorPayload: IcmpPayload.

Message #

Translating %8 packet from %2:%3 to %5:%6, IPID:%7. Status: %9, IcmpType: %10, IcmpCode: %11, IcmpErrorPayload: %12

Fields #

Description

Nat Instance InstanceName Action Status: Status.UdpIdleSessionTimeout: UdpIdleSessionTimeout sec, TcpTransientConnectionTimeout: TcpTransientConnectionTimeout, TcpEstablishedConnectionTimeout: TcpEstablishedConnectionTimeout, IcmpQueryTimeout: IcmpQueryTimeout, TcpFilteringBehavior: TcpFilteringBehavior, UdpFilteringBehavior: UdpFilteringBehavior, UdpInboundRefresh: UdpInboundRefresh, Enabled: Enabled

Message #

Nat Instance %1 %11 Status: %10.UdpIdleSessionTimeout: %2 sec, TcpTransientConnectionTimeout: %3, TcpEstablishedConnectionTimeout: %4, IcmpQueryTimeout: %5, TcpFilteringBehavior: %6, UdpFilteringBehavior: %7, UdpInboundRefresh: %8, Enabled: %9

Fields #

Description

Packet filter Status: . Instance: , SrcPrefix: , SrcPrefixLength: , DstPrefix: , DstPrefixLength: , Ipv4Prefix: , Ipv4PrefixLength: , Nat64: , InterfaceLuid.

Message #

Packet filter %12 Status: %13. Instance: %1, SrcPrefix: %3, SrcPrefixLength: %4, DstPrefix: %5, DstPrefixLength: %6, Ipv4Prefix: %7, Ipv4PrefixLength: %8, Nat64: %9, InterfaceLuid: %10

Fields #

Description

WFP filter Status: . Instance: , FilterId: , SrcPrefix: , SrcPrefixLength: , DstPrefix: , DstPrefixLength: , Ipv4Prefix: , Ipv4PrefixLength: , Nat64: , InterfaceLuid.

Message #

WFP filter %12 Status: %13. Instance: %1, FilterId: %11, SrcPrefix: %3, SrcPrefixLength: %4, DstPrefix: %5, DstPrefixLength: %6, Ipv4Prefix: %7, Ipv4PrefixLength: %8, Nat64: %9, InterfaceLuid: %10

Fields #

Description

Address pool Action Status: Status. Instance: InstanceName, Address: Address, StartingPort: StartingPort, EndingPort: EndingPort, InterfaceLuid: InterfaceLuid.

Message #

Address pool %6 Status: %7. Instance: %1, Address: %2, StartingPort: %3, EndingPort: %4, InterfaceLuid: %5

Fields #

Description

Address Action notification. Address: Address, InterfaceLuid: InterfaceLuid.

Message #

Address %6 notification. Address: %2, InterfaceLuid: %5

Fields #

Description

Static binding Action Status: Status. Internal Source: InternalAddr, External Source: ExternalAddr, Protocol: TransportProtocol.

Message #

Static binding %6 Status: %7. Internal Source: %2, External Source: %4, Protocol: %5

Fields #

Description

Memory allocation failure: Description.

Message #

Memory allocation failure: %1

Fields #

Description

TransportProtocol session created. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr.

Message #

%7 session created. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6

Fields #

Description

TransportProtocol session deleted. Internal source transport addr: InternalSrcAddr, Internal dest transport addr: InternalDstAddr, External source transport addr ExternalSrcAddr, External dest transport addr ExternalDstAddr.

Message #

%7 session deleted. Internal source transport addr: %2, Internal dest transport addr: %3, External source transport addr %5, External dest transport addr %6

Fields #

Description

Created NAT instance InstanceName for RoutingDomainId InternalRoutingDomainId (CompartmentId CompartmentId) with external interface prefix AddressPrefix/PrefixLength.

Message #

Created NAT instance %1 for RoutingDomainId %2 (CompartmentId %5) with external interface prefix %4/%3

Fields #

Description

Modified NAT instance InstanceName properties.

Message #

Modified NAT instance %1 properties

Fields #

Description

NAT instance InstanceName external interface index is ExternalInterfaceIndex for prefix ExternalIPInterfaceAddressPrefix/ExternalIPInterfaceAddressPrefixLength.

Message #

NAT instance %1 external interface index is %6 for prefix %4/%3

Fields #

Description

Deleted NAT instance InstanceName.

Message #

Deleted NAT instance %1

Fields #

Description

NAT instance InstanceName: RoutingDomainId InternalRoutingDomainId (CompartmentId CompartmentId), external interface index ExternalInterfaceIndex (AddressPrefix/PrefixLength).

Message #

NAT instance %1: RoutingDomainId %2 (CompartmentId %5), external interface index %6 (%4/%3)

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinNat",
    "guid": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}",
    "event_source_name": "",
    "event_id": 1023,
    "version": 1,
    "level": 4,
    "task": 1023,
    "opcode": 0,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T06:08:06.772+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}"
    },
    "execution": {
      "process_id": 9736,
      "thread_id": 10668
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AddressPrefix": 12589740,
    "CompartmentId": 1,
    "ExternalInterfaceIndex": 0,
    "IcmpQueryTimeout": 30,
    "InstanceName": "ICSf3b2d77a-335a-48b3-8cf1-04bd3ff3b253",
    "InstanceType": 1,
    "InternalRoutingDomainId": "{00000000-0000-0000-0000-000000000000}",
    "PrefixLength": 20,
    "TcpEstablishedConnectionTimeout": 1800,
    "TcpFilteringBehavior": 1,
    "TcpTransientConnectionTimeout": 120,
    "UdpFilteringBehavior": 1,
    "UdpIdleSessionTimeout": 300,
    "UdpInboundRefresh": false
  },
  "message": "WinNatMInstanceRundown"
}

Description

Added external address IPAddress:PortStart-PortEnd to NAT instance InstanceName.

Message #

Added external address %3:%4-%5 to NAT instance %1

Fields #

Description

Removed external address IPAddress:PortStart-PortEnd from NAT instance InstanceName.

Message #

Removed external address %3:%4-%5 from NAT instance %1

Fields #

Description

NAT instance InstanceName: external address IPAddress:PortStart-PortEnd.

Message #

NAT instance %1: external address %3:%4-%5

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinNat",
    "guid": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}",
    "event_source_name": "",
    "event_id": 1026,
    "version": 0,
    "level": 4,
    "task": 1026,
    "opcode": 0,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T06:08:06.772+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}"
    },
    "execution": {
      "process_id": 9736,
      "thread_id": 10668
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AddressLength": 16,
    "IPAddress": "020000007F0000010000000000000000",
    "InstanceName": "ICSf3b2d77a-335a-48b3-8cf1-04bd3ff3b253",
    "PortEnd": 49833,
    "PortStart": 49734
  },
  "message": "WinNatMExternalAddressRundown"
}

Description

Added static mapping TransportProtocol ExternalTransportAddress > InternalTransportAddress (CompartmentId CompartmentId) to NAT instance InstanceName (MappingType RemoteAddressPrefix/RemoteAddressPrefixLength).

Message #

Added static mapping %2 %5 > %6 (CompartmentId %8) to NAT instance %1 (%3 %9/%10)

Fields #

Description

Removed static mapping TransportProtocol ExternalTransportAddress > InternalTransportAddress (CompartmentId CompartmentId) from NAT instance InstanceName (MappingType RemoteAddressPrefix/RemoteAddressPrefixLength).

Message #

Removed static mapping %2 %5 > %6 (CompartmentId %8) from NAT instance %1 (%3 %9/%10)

Fields #

Description

NAT instance InstanceName: static mapping TransportProtocol ExternalTransportAddress > InternalTransportAddress (CompartmentId CompartmentId) (MappingType RemoteAddressPrefix/RemoteAddressPrefixLength).

Message #

NAT instance %1: static mapping %2 %5 > %6 (CompartmentId %8) (%3 %9/%10)

Fields #

Description

NAT dropped IPv4 TransportProtocol packet which arrived over ArrivalNetwork interface ArrivalInterfaceIndex in compartment ArrivalCompartmentId with reason: ActionReason.

Message #

NAT dropped IPv4 %5 packet which arrived over %4 interface %3 in compartment %2 with reason: %1.

Fields #

Description

NAT detected a default route in compartment CompartmentId interface InterfaceIndex. Default routes in internal compartments will prevent NAT operation for those compartments.

Message #

NAT detected a default route in compartment %1 interface %2. Default routes in internal compartments will prevent NAT operation for those compartments.

Fields #

Description

NAT detected a default route in compartment CompartmentId interface InterfaceIndex. Default routes in internal compartments will prevent NAT operation for those compartments.

Message #

NAT detected a default route in compartment %1 interface %2. Default routes in internal compartments will prevent NAT operation for those compartments.

Fields #

Description

NAT instance InstanceName failed to allocate a TransportProtocol port dynamically because all ports in the instance's external address pool are in use.

Message #

NAT instance %1 failed to allocate a %2 port dynamically because all ports in the instance's external address pool are in use.

Fields #

Description

NAT left processing of IPv4 TransportProtocol packet to the host network stack over ArrivalNetwork interface ArrivalInterfaceIndex in compartment ArrivalCompartmentId with reason: ActionReason.

Message #

NAT left processing of IPv4 %5 packet to the host network stack over %4 interface %3 in compartment %2 with reason: %1.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinNat",
    "guid": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}",
    "event_source_name": "",
    "event_id": 1034,
    "version": 0,
    "level": 5,
    "task": 1034,
    "opcode": 0,
    "keywords": "0x0000000000000020",
    "time_created": "2026-06-02T06:08:08.447+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}"
    },
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ActionReason": 21,
    "ArrivalCompartmentId": 1,
    "ArrivalInterfaceIndex": 11,
    "ArrivalNetwork": 2,
    "CapturedIPHeaderLength": 20,
    "CapturedTransportHeaderLength": 20,
    "ContinuousLength": 40,
    "ForwardCompartmentId": 0,
    "ForwardInterfaceIndex": 0,
    "ICMPErrorCapturedIPHeaderLength": 0,
    "ICMPErrorCapturedTransportHeaderLength": 0,
    "ICMPErrorIPHeader": "",
    "ICMPErrorTransportHeader": "",
    "ICMPErrorTransportProtocol": 0,
    "IPHeader": "450000281A4140003F064A20C00002FE0A020A6F",
    "PacketLength": 40,
    "TransportHeader": "ECF41762C38106F39091305D5010083640750000",
    "TransportProtocol": 6
  },
  "message": "WinNatMSkippedIPv4Packet"
}

Description

NAT translated and forwarded IPv4 TransportProtocol packet which arrived over ArrivalNetwork interface ArrivalInterfaceIndex in compartment ArrivalCompartmentId to interface ForwardInterfaceIndex in compartment ForwardCompartmentId.

Message #

NAT translated and forwarded IPv4 %5 packet which arrived over %4 interface %3 in compartment %2 to interface %7 in compartment %6.

Fields #

Description

NAT ERROR ErrorID: ErrorContext (ErrorMisc) Status Status.

Message #

NAT ERROR %1: %2 (%3) Status %4

Fields #

Description

NAT Instance InstanceName created with no matching prefix AddressPrefix/PrefixLength.

Message #

NAT Instance %1 created with no matching prefix %4/%3.

Fields #

Description

Info

Message #

%1

Fields #

Description

Info

Message #

%1

Fields #

Description

Info

Message #

%1

Fields #

Description

Added IPxlat instance for interface InterfaceLuid.

Message #

Added IPxlat instance for interface %1

Fields #

Description

Modified IPxlat instance for interface InterfaceLuid.

Message #

Modified IPxlat instance for interface %1

Fields #

Description

Deleted IPxlat instance for interface InterfaceLuid.

Message #

Deleted IPxlat instance for interface %1

Fields #

Description

XLAT: Info

Message #

XLAT: %1

Fields #

Description

Added internal address IPAddress, IfIndex IfIndex to NAT instance InstanceName.

Message #

Added internal address %3, IfIndex %4 to NAT instance %1

Fields #

Description

Removed internal address IPAddress: IfIndex IfIndex from NAT instance InstanceName.

Message #

Removed internal address %3: IfIndex %4 from NAT instance %1

Fields #

Description

Driver state: PortChunkSize=PortChunkSize, RSCAware=RSCAware, UROAware=UROAware, FragmentAware=FragmentAware, ForceInternalRoute=ForceInternalRoute, UdpSessionTimeout=UdpSessionTimeout, ClampMssEnabled=ClampMssEnabled.

Message #

Driver state: PortChunkSize=%1, RSCAware=%2, UROAware=%3, FragmentAware=%4, ForceInternalRoute=%5, UdpSessionTimeout=%6, ClampMssEnabled=%7

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinNat",
    "guid": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}",
    "event_source_name": "",
    "event_id": 1047,
    "version": 0,
    "level": 4,
    "task": 1047,
    "opcode": 0,
    "keywords": "0x0000000000000008",
    "time_created": "2026-06-02T06:08:06.772+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{66C07ECD-6667-43FC-93F8-05CF07F446EC}"
    },
    "execution": {
      "process_id": 9736,
      "thread_id": 10668
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ClampMssEnabled": false,
    "ForceInternalRoute": false,
    "FragmentAware": false,
    "PortChunkSize": 100,
    "RSCAware": true,
    "UROAware": true,
    "UdpSessionTimeout": 300
  },
  "message": "WinNatDriverStateRundown"
}