Microsoft-Windows-WPD-MTPIP
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 100 | Write MTP IP Packet to Data channel | Analytic | N | N |
| 101 | Write MTP IP Packet to Event channel | Analytic | N | N |
| 102 | Read MTP IP Packet from Data channel | Analytic | N | N |
| 103 | Read MTP IP Packet from Event channel | Analytic | N | N |
| 104 | Read MTP IP Data Packet | Analytic | N | N |
| 105 | Received IP Device Event | Analytic | N | N |
| 106 | Received IP Unexpected header on data channel | Analytic | N | N |
| 107 | Received IP Unexpected header on event channel | Analytic | N | N |
Event ID 100: Write MTP IP Packet to Data channel
#Fields #
| Name | Description |
|---|---|
MTPIPPacketLength UInt32 | |
MTPIPPacketData Binary |
Event ID 101: Write MTP IP Packet to Event channel
#Fields #
| Name | Description |
|---|---|
MTPIPPacketLength UInt32 | |
MTPIPPacketData Binary |
Event ID 102: Read MTP IP Packet from Data channel
#Fields #
| Name | Description |
|---|---|
MTPIPPacketLength UInt32 | |
MTPIPPacketData Binary |
Event ID 103: Read MTP IP Packet from Event channel
#Fields #
| Name | Description |
|---|---|
MTPIPPacketLength UInt32 | |
MTPIPPacketData Binary |
Event ID 104: Read MTP IP Data Packet
#Fields #
| Name | Description |
|---|---|
MTPIPPacketLength UInt32 | |
MTPIPPacketType UInt32 |
Event ID 105: Received IP Device Event
#Fields #
| Name | Description |
|---|---|
MTPIPEventLength UInt32 | |
MTPIPEventData Binary |
Provenance
ETW provider GUID c374d21e-69b2-4cd7-9a25-62187c5a5619
Defined in wpd_ci.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB