Tcpip

Event	Title	Channel	Sample	Rule
4199	Event ID 4199	System	Y	N
4231	A request to allocate an ephemeral port number from the global TCP port space …	System	Y	N
4266	A request to allocate an ephemeral port number from the global UDP port space …	System	Y	N

Event ID 4199

Channel: System
Level: Error

Example Event #

{
  "system": {
    "provider": "Tcpip",
    "guid": "",
    "event_source_name": "",
    "event_id": 4199,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2013-10-23T16:24:53.817500Z",
    "event_record_id": 384,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "System",
    "computer": "IE8Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {}
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4231: A request to allocate an ephemeral port number from the global TCP port space has failed due to all such ports being in use.

Channel: System
Level: 3

Fields #

Name	Description
`Data_0`

Example Event #

{
  "system": {
    "provider": "Tcpip",
    "guid": "",
    "event_source_name": "",
    "event_id": 4231,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-04-13T02:18:11.3512067+00:00",
    "event_record_id": 5115,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 16572
    },
    "channel": "System",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": ""
  },
  "message": "A request to allocate an ephemeral port number from the global TCP port space has failed due to all such ports being in use."
}

Event ID 4266: A request to allocate an ephemeral port number from the global UDP port space has failed due to all such ports being in use.

Channel: System
Level: 3

Fields #

Name	Description
`Data_0`

Example Event #

{
  "system": {
    "provider": "Tcpip",
    "guid": "",
    "event_source_name": "",
    "event_id": 4266,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-04-03T15:42:48.5953392+00:00",
    "event_record_id": 4553,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8548
    },
    "channel": "System",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": ""
  },
  "message": "A request to allocate an ephemeral port number from the global UDP port space has failed due to all such ports being in use."
}