List of fields (both values and keys) used in PVQL to query data.
| Field Name | Type | Layers | Description |
|---|---|---|---|
| aborts | number | citrix | The number of aborted Citrix sessions |
| aborts.ratio | number | citrix | The ratio of aborts to the total number of launch attempts |
| ajax.requests | number | http | The number of javascript requests |
| alert.access_denied | bool | tls | A valid certificate was received, but when access control was applied, the sender decided not to proceed with negotiation. Code 49. |
| alert.bad_certificate | bool | tls | A certificate was corrupt, contained signatures that did not verify correctly, etc. Code 42. |
| alert.bad_record_mac | bool | tls | This alert is returned if a record is received with an incorrect MAC. Code 20. |
| alert.certificate_expired | bool | tls | A certificate has expired or is not currently valid. Code 45. |
| alert.certificate_revoked | bool | tls | A certificate was revoked by its signer. Code 44. |
| alert.certificate_unknown | bool | tls | Some other (unspecified) issue arose in processing the certificate, rendering it unacceptable. Code 46. |
| alert.close_notify | bool | tls | This message notifies the recipient that the sender will not send any more messages on this connection. Code 0. |
| alert.decode_error | bool | tls | A message could not be decoded because some field was out of the specified range or the length of the message was incorrect. Code 50. |
| alert.decompression_failure | bool | tls | The decompression function received improper input (e.g., data that would expand to excessive length). Code 30. |
| alert.decrypt_error | bool | tls | A handshake cryptographic operation failed, including being unable to correctly verify a signature or validate a Finished message. Code 51. |
| alert.decryption_failed | bool | tls | This alert was used in some earlier versions of TLS, and may have permitted certain attacks against the CBC mode. Code 21. |
| alert.export_restriction | bool | tls | This alert was used in some earlier versions of TLS. Code 60. |
| alert.handshake_failure | bool | tls | Reception of a handshake failure alert message indicates that the sender was unable to negotiate an acceptable set of security parameters given the options available. Code 40. |
| alert.illegal_parameter | bool | tls | A field in the handshake was out of range or inconsistent with other fields. Code 47. |
| alert.insufficient_security | bool | tls | Returned instead of a handshake failure when a negotiation has failed specifically because the server requires ciphers more secure than those supported by the client. Code 71. |
| alert.internal_error | bool | tls | An internal error unrelated to the peer or the correctness of the protocol (such as a memory allocation failure) makes it impossible to continue. Code 80. |
| alert.no_certificate | bool | tls | This alert was used in SSLv3 but not any version of TLS. Code 41. |
| alert.no_renegotiation | bool | tls | Sent by the client in response to a hello request or by the server in response to a client hello after initial handshaking. Code 100. |
| alert.protocol_version | bool | tls | The protocol version the client has attempted to negotiate is recognized but not supported. Code 70. |
| alert.record_overflow | bool | tls | A TLSCiphertext record was received that had a length more than 2^14+2048 bytes, or a record decrypted to a TLSCompressed record with more than 2^14+1024 bytes. Code 22. |
| alert.unexpected_message | bool | tls | An inappropriate message was received. Code 10. |
| alert.unknown_ca | bool | tls | A valid certificate chain or partial chain was received, but the certificate was not accepted because the CA certificate could not be located or couldn't be matched with a known, trusted CA. Code 48. |
| alert.unsupported_certificate | bool | tls | A certificate was of an unsupported type. Code 43. |
| alert.unsupported_extension | bool | tls | Sent by clients that receive an extended server hello containing an extension that they did not put in the corresponding client hello. Code 110. |
| alert.user_canceled | bool | tls | This handshake is being canceled for some reason unrelated to a protocol failure. Code 90. |
| alert_types | alerttypes | rdp tls |
Flags of alerts present in the TLS conversation |
| application.category.id | application_category_id | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The application category ID |
| application.category.name | application_category | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The application category name |
| application.id | application_id | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The application ID |
| application.name | application | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The application |
| application.src | application_source | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
Application source |
| attachments | array | Name of file(s) present on the attachments | |
| attachments.content_type | array | Content types of file(s) present on the attachments | |
| attachments.sha256 | array | SHA256 hashes of file(s) present on the attachments | |
| attempts | number | citrix | The total number of launch attempts |
| authentication.result | vnc_authentication_result | vnc | Authentication Result |
| authentication.status | string | vnc | Authentication Status |
| authorization.type | string | ldap | Authorization type of the LDAP message |
| begin | time | arp bootp citrix citrix_channels databases dce_rpc dns flows ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The timestamp of the first captured packet |
| begins | number | voip | The number of VoIP flows that started |
| bootp_client.mac | mac | bootp | The MAC address of the BOOTP/DHCP client |
| call | string | voip | The VoIP call id |
| call.direction | calldirection | voip | The direction (inbound, outbound, unknown) of the VoIP calls |
| call.duration | number | voip | The total duration of the VoIP calls |
| call.global.jitter | number | voip | The average measured jitter for call PDUs (protocol data units) in both directions |
| call.global.rtt | number | voip | The average round-trip time for call PDUs (protocol data units) in both directions |
| call.jitter.count | number | voip | The total number of measured jitters for call PDUs (protocol data units) in both directions |
| call.jitter.deviation | number | voip | The deviation of the measured jitter for call PDUs (protocol data units) in both directions |
| call.jitter.total | number | voip | The sum of both caller and callee average round-trip times |
| call.rtt.count | number | voip | The total number of round-trip times for call PDUs (protocol data units) in both directions |
| call.rtt.deviation | number | voip | The deviation of the round-trip time for call PDUs (protocol data units) in both directions |
| call.rtt.total | number | voip | The sum of both caller and callee average round-trip times |
| call.state | callstate | voip | The latest call state in this conversation |
| callee | string | voip | The VoIP callee id |
| callee.codec | string | voip | The voice codec of the callee |
| callee.hostname | hostname | voip | The hostname of the callee |
| callee.ip | ip | voip | The IP address of the callee |
| callee.jitter | number | voip | The average measured jitter for a PDU (protocol data unit) emitted by the callee |
| callee.jitter.count | number | voip | The number of measured jitters for PDUs (protocol data units) emitted by the callee |
| callee.jitter.deviation | number | voip | The deviation of the measured jitters for PDUs (protocol data units) emitted by the callee |
| callee.label | string | voip | The display name of the callee |
| callee.lost.pdus | number | voip | The number of lost callee PDUs (protocol data units) |
| callee.lost.pdus.ratio | number | voip | The ratio of lost to the total number of PDUs (protocol data units) emitted by the callee |
| callee.mac | mac | voip | The MAC address of the Callee |
| callee.rtt | number | voip | The average round-trip time for PDUs (protocol data units) emitted by the caller |
| callee.rtt.count | number | voip | The number of round-trip times for PDUs (protocol data units) emitted by the caller |
| callee.rtt.deviation | number | voip | The deviation of the round-trip time for PDUs (protocol data units) emitted by the caller |
| callee.zone.id | zone_id | voip | The zone ID of the callee |
| callee.zone.name | zone | voip | The zone of the callee |
| caller | string | voip | The VoIP caller id |
| caller.codec | string | voip | The voice codec of the caller |
| caller.hostname | hostname | voip | The hostname of the caller |
| caller.ip | ip | voip | The IP address of the caller |
| caller.jitter | number | voip | The average measured jitter for a PDU (protocol data unit) emitted by the the caller |
| caller.jitter.count | number | voip | The number of measured jitters for PDUs (protocol data units) emitted by the caller |
| caller.jitter.deviation | number | voip | The deviation of the measured jitters for PDUs (protocol data units) emitted by the caller |
| caller.label | string | voip | The display name of the caller |
| caller.lost.pdus | number | voip | The number of lost caller PDUs (protocol data units) |
| caller.lost.pdus.ratio | number | voip | The ratio of lost to the total number of PDUs (protocol data units) emitted by the caller |
| caller.mac | mac | voip | The MAC address of the Caller |
| caller.rtt | number | voip | The average round-trip time for PDUs (protocol data units) emitted by the callee |
| caller.rtt.count | number | voip | The number of round-trip times for PDUs (protocol data units emitted by the callee |
| caller.rtt.deviation | number | voip | The deviation of the round-trip time for PDUs (protocol data units) emitted by the callee |
| caller.zone.id | zone_id | voip | The zone ID of the caller |
| caller.zone.name | zone | voip | The zone of the caller |
| capture.hostname | poller | arp bootp citrix citrix_channels databases dce_rpc dns flows ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The probe device hostname that captured this traffic |
| capture.id | poller_id | arp bootp citrix citrix_channels databases dce_rpc dns flows ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The probe device ID that captured this traffic |
| category | category_value | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
This placeholder function exists to prevent the creation of fields named 'category'.It is mapped to other functions during processing. |
| cgp.client.pdus | number | citrix | The total number of CGP PDUs (protocol data units) at applicative level emitted by the client |
| cgp.dest.pdus | number | citrix | The total number of CGP PDUs (protocol data units) at applicative level emitted by the destination |
| cgp.pdus | number | citrix | The total number of CGP PDUs (protocol data units) at applicative level in both directions |
| cgp.server.pdus | number | citrix | The total number of CGP PDUs (protocol data units) at applicative level emitted by the server |
| cgp.source.pdus | number | citrix | The total number of CGP PDUs (protocol data units) at applicative level emitted by the source |
| challenge | number | dce_rpc | Client challenge |
| channel | channel | citrix_channels | The Citrix channel |
| channel.id | number | citrix_channels | The Citrix channel ID |
| chunked.transfers | number | http | The number of times the HTTP 'chunked' transfer encoding has been used |
| cipher | ciphersuite | tls | The set of cryptographic algorithms used to secure this conversation |
| cipher.is_weak | bool | tls | Is the TLS cipher weak? |
| citrix.application | string | citrix citrix_channels |
The published Citrix application being executed |
| client | string | Name received during an HELO SMTP command | |
| client.common_name | string | tls | The Common Name of the client certificate |
| client.compressed.pdus | number | citrix_channels | The number of compressed client PDUs (protocol data units) |
| client.compressed.pdus.ratio | number | citrix_channels | The ratio of compressions to the total number of PDUs (protocol data units) emitted by the client |
| client.data | number | tls | The total number of client data PDUs (protocol data units) |
| client.datasource.kind | pktsourcekind | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The packet source type (pcap file, netflow, network iface, rpcapd) on which this traffic has been captured (client-side) |
| client.datasource.name | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The packet source name on which this traffic has been captured (client-side) |
| client.datasource.pair | pktsourcepair | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The packet source type and name on which this traffic has been captured (client-side) |
| client.diffserv | diffserv | icmp other_ip tcp udp |
The client differentiated service |
| client.dtt | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The average data-transfer time for PDUs (protocol data units) emitted by the client |
| client.dtt.count | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The number of data-transfer times for PDUs (protocol data units) emitted by the client |
| client.dtt.deviation | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The deviation of the data-transfer time for PDUs (protocol data units) emitted by the client |
| client.dupacks | number | tcp | The number of duplicated ACK packets from the client |
| client.dupacks.ratio | number | tcp | The ratio of duplicated ACKs to the total number of packets emitted by the client |
| client.emtu | number | icmp non_ip other_ip tcp udp |
The maximum payload in a single ethernet packet emmited by the client in these conversations (this value is assumed to be the MTU of the client's network interface, although the actual MTU value might be greater) |
| client.error.ip | ip | icmp | The IP address of the client, as it appears in the headers of the ICMP error message |
| client.error.port | port | icmp | The port of the client, as it appears in the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| client.error.zone.id | zone_id | icmp | The zone ID of the client, determined using the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| client.error.zone.name | zone | icmp | The zone of the client, determined using the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| client.expiration | time | tls | The expiration date of the client certificate |
| client.file | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The name of the Pcap File used as traffic source (client-side) |
| client.fins | number | tcp | The number of FIN packets emitted by the client |
| client.fins.ratio | number | tcp | The average number of client FIN packets in a connection |
| client.hostname | hostname | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The hostname of the client |
| client.initial.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the server between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| client.initial.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the server between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| client.initial.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the server between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| client.interface | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The name of the network interface on which this traffic has been captured (client-side) |
| client.ip | ip | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The IP address of the client |
| client.ja3 | tls_fingerprint | rdp tls |
The JA3 client fingerprint |
| client.keepalives | number | citrix | The number of keep alives from the client |
| client.key.bits | number | tls | The number of bits in the client key |
| client.key.type | keytype | tls | The type of the client key |
| client.mac | mac | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The MAC address of the client |
| client.meta | number | tls | The total number of client metadata (handshake, change cipher spec & alerts PDU types) |
| client.multiple.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the server between a series of packets and a single ACK for all of them (more than 1). |
| client.multiple.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the server between a series of packets and a single ACK for all of them (more than 1). |
| client.multiple.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the server between a series of packets and a single ACK for all of them (more than 1). |
| client.name | string | kerberos | Client principal Name |
| client.os | os | tcp | The client operating system |
| client.payload | number | arp bootp citrix citrix_channels dce_rpc ftp ipsec kerberos ldap ntlm rdp socks5 ssh tcp tls udp vnc voip |
The total amount of bytes of data (without headers) emitted by the client |
| client.payload.pdus | number | citrix citrix_channels tcp voip |
The total number of PDUs (protocol data units) with payload emitted by the client |
| client.payload.ratio | number | bootp citrix citrix_channels dce_rpc ftp kerberos ldap ntlm rdp socks5 tcp tls udp vnc voip |
The ratio of payload bytes to the entire traffic emitted by the client |
| client.pdus | number | arp bootp citrix citrix_channels dce_rpc dns ftp icmp ipsec kerberos ldap non_ip ntlm other_ip rdp socks5 ssh tcp udp vnc voip |
The total number of PDUs (protocol data units) at applicative level emitted by the client |
| client.port | port | citrix citrix_channels databases dce_rpc ftp http ipsec kerberos ldap ntlm rdp smb socks5 ssh tcp tls udp vnc voip |
The TCP/UDP port of the client |
| client.rd | number | tcp | The average retransmission delay for PDUs emitted by the client |
| client.rd.count | number | tcp | The number of retransmission delays for PDUs emitted by the client |
| client.rd.deviation | number | tcp | The deviation of the retransmission delay for PDUs emitted by the client |
| client.realm | string | kerberos | Client realm |
| client.remote | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The name of the network interface on which this traffic has been captured via rpcapd (client-side) |
| client.retrans.payload | number | tcp | The total amount of bytes of data (without headers) in retransmitted PDUs emitted by the client |
| client.retrans.pdus | number | tcp | The total number of retransmitted PDUs emitted by the client |
| client.retrans.pdus.ratio | number | tcp | The ratio of retransmissions to the total number of PDUs (protocol data units) with payload emitted by the client |
| client.retrans.traffic | number | tcp | The total amount of bytes in retransmitted PDUs emitted by the client |
| client.retrans.traffic.ratio | number | tcp | The ratio of retransmitted traffic to the entire traffic emitted by the client |
| client.rsts | number | tcp | The number of RST packets emitted by the client |
| client.rsts.ratio | number | tcp | The average number of client RST packets in a connection |
| client.rtt | number | tcp | The average round-trip time for PDUs (protocol data units) emitted by the server |
| client.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the server |
| client.rtt.deviation | number | tcp | The deviation of the round-trip time for PDUs (protocol data units) emitted by the server |
| client.seqnum_frames | number | tcp | Number of packets that increment the TCP seqnum emitted by the client |
| client.serial_number | string | tls | The unique serial number of the client's digital certificate |
| client.signalization.payload | number | voip | The total amount of bytes of data (without headers) in all signalization PDUs (protocol data units) emitted by the client |
| client.signalization.pdus | number | voip | The total number of signalization PDUs (protocol data units) emitted by the client |
| client.signalization.rd | number | voip | The average retransmission delay for signalization PDUs (protocol data units) emitted by the client |
| client.signalization.rd.count | number | voip | The number of retransmission delays for signalization PDUs (protocol data units) emitted by the client |
| client.signalization.rd.deviation | number | voip | The deviation of the retransmission delay for signalization PDUs (protocol data units) emitted by the client |
| client.signalization.retrans.pdus.ratio | number | voip | The ratio of retransmissions to the total number of signalization PDUs (protocol data units) emitted by the client |
| client.signalization.rtt | number | voip | The average round-trip time for signalization PDUs (protocol data units) emitted by the server |
| client.signalization.rtt.count | number | voip | The number of round-trip times for signalization PDUs (protocol data units) emitted by the server |
| client.signalization.rtt.deviation | number | voip | The deviation of the round-trip time for signalization PDUs (protocol data units) emitted by the server |
| client.signalization.traffic | number | voip | The total amount of bytes in signalization PDUs (protocol data units) emitted by the client |
| client.signature | string | tls | The client signature |
| client.single.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the server between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| client.single.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the server between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| client.single.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the server between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| client.traffic | number | arp bootp dce_rpc dns ftp icmp ipsec kerberos ldap non_ip ntlm other_ip rdp socks5 ssh tcp tls udp vnc voip |
The total amount of bytes emitted by the client |
| client.vlan | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The inner VLAN id on the client side of the transaction (alias of client.vlans.inner) |
| client.vlans | array | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The VLAN ids on the client side of the transaction. The first VLAN id represents the outer VLAN and the last VLAN id represents the inner VLAN |
| client.vlans.count | number | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The number of VLANs on the client side of the transaction |
| client.vlans.inner | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The inner VLAN id on the client side of the transaction |
| client.vlans.outer | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The outer VLAN id on the client side of the transaction |
| client.zero_windows | number | tcp | The number of zero-window size packets emitted by the client |
| client.zero_windows.ratio | number | tcp | The ratio of zero-window size to the total number of packets emitted by the client |
| client.zone.id | zone_id | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The zone id of the client |
| client.zone.name | zone | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The zone of the client |
| closes | number | tcp | The number of TCP sessions that ended properly (by acked FIN or RST) |
| command | databasecommand | databases | The database command type |
| compressed.pdus | number | citrix_channels | The total number of compressed PDUs (protocol data units) in both directions |
| compressed.pdus.ratio | number | citrix_channels | The ratio of compressions to the total number of PDUs (protocol data units) in both directions |
| compressed.responses | number | http | The number of compressed HTTP responses |
| content_description | string | http | The Content-Description response header |
| content_disposition | string | http | The Content-Disposition response header |
| cookie | string | rdp | The RDP cookie (domain\server, username, etc.) |
| ct | number | tcp tls |
The average connection time |
| ct.count | number | tcp tls |
The number of successful handshakes |
| ct.deviation | number | tcp tls |
The deviation of the connection time |
| data.payload | number | smb | The total amount of bytes of data in both directions |
| database | string | databases | The name of the database |
| date | string | Date when the email was send | |
| dcerpc.computer_name | string | dce_rpc | Computer name |
| dcerpc.errors | number | dce_rpc | Number of failed calls |
| dcerpc.interface | string | dce_rpc | RPC identifier of the called interface (UUID) |
| dcerpc.successes | number | dce_rpc | Number of successful calls |
| dcerpc_uuid | dcerpc_uuid | tcp udp |
The identifier of the DCE/RPC service |
| dcom.arguments | array | dce_rpc | DCOM arguments |
| dcom.arguments_lengths | array | dce_rpc | DCOM arguments lengths |
| dcom.flags | dcerpc_flag | dce_rpc | Flags of the IDispatch::Invoke method |
| dcom.lcid | number | dce_rpc | Localization id |
| dcom.name | string | dce_rpc | DCOM function name |
| decrypted | number | tls | The number of decrypted conversations |
| dest.common_name | string | tls | The Common Name of the destination certificate |
| dest.compressed.pdus | number | citrix_channels | The number of compressed destination PDUs (protocol data units) |
| dest.compressed.pdus.ratio | number | citrix_channels | The ratio of compressions to the total number of PDUs (protocol data units) emitted by the destination |
| dest.data | number | tls | The total number of destination data PDUs (protocol data units) |
| dest.datasource.kind | pktsourcekind | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The packet source type (pcap file, netflow, network iface, rpcapd) on which this traffic has been captured (destination-side) |
| dest.datasource.name | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The packet source name on which this traffic has been captured (destination-side) |
| dest.datasource.pair | pktsourcepair | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The packet source type and name on which this traffic has been captured (destination-side) |
| dest.diffserv | diffserv | icmp other_ip tcp udp |
The destination differentiated service |
| dest.dtt | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The average data-transfer time for PDUs (protocol data units) emitted by the destination |
| dest.dtt.count | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The number of data-transfer times for PDUs (protocol data units) emitted by the destination |
| dest.dtt.deviation | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The deviation of the data-transfer time for PDUs (protocol data units) emitted by the destination |
| dest.dupacks | number | tcp | The number of duplicated ACK packets from the destination |
| dest.dupacks.ratio | number | tcp | The ratio of duplicated ACKs to the total number of packets emitted by the destination |
| dest.emtu | number | icmp non_ip other_ip tcp udp |
The maximum payload in a single ethernet packet emmited by the destination in these conversations (this value is assumed to be the MTU of the destination's network interface, although the actual MTU value might be greater) |
| dest.error.ip | ip | icmp | The IP address of the destination, as it appears in the headers of the ICMP error message |
| dest.error.port | port | icmp | The port of the destination, as it appears in the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| dest.error.zone.id | zone_id | icmp | The zone ID of the destination, determined using the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| dest.error.zone.name | zone | icmp | The zone of the destination, determined using the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| dest.expiration | time | tls | The expiration date of the destination certificate |
| dest.file | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The name of the Pcap File used as traffic source (destination-side) |
| dest.fins | number | tcp | The number of FIN packets emitted by the destination |
| dest.fins.ratio | number | tcp | The average number of destination FIN packets in a connection |
| dest.hostname | hostname | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The hostname of the destination |
| dest.initial.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the source between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| dest.initial.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the source between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| dest.initial.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the source between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| dest.interface | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The name of the network interface on which this traffic has been captured (destination-side) |
| dest.ip | ip | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The IP address of the destination |
| dest.ja3 | tls_fingerprint | rdp tls |
The JA3 destination fingerprint |
| dest.keepalives | number | citrix | The number of keep alives from the destination |
| dest.key.bits | number | tls | The number of bits in the destination key |
| dest.key.type | keytype | tls | The type of the destination key |
| dest.mac | mac | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The MAC address of the destination |
| dest.meta | number | tls | The total number of destination metadata (handshake, change cipher spec & alerts PDU types) |
| dest.multiple.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the source between a series of packets and a single ACK for all of them (more than 1). |
| dest.multiple.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the source between a series of packets and a single ACK for all of them (more than 1). |
| dest.multiple.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the source between a series of packets and a single ACK for all of them (more than 1). |
| dest.os | os | tcp | The destination operating system |
| dest.payload | number | arp bootp citrix citrix_channels dce_rpc ftp ipsec kerberos ldap ntlm rdp socks5 ssh tcp tls udp vnc voip |
The total amount of bytes of data (without headers) emitted by the destination |
| dest.payload.pdus | number | citrix citrix_channels tcp voip |
The total number of PDUs (protocol data units) with payload emitted by the destination |
| dest.payload.ratio | number | bootp citrix citrix_channels dce_rpc ftp kerberos ldap ntlm rdp socks5 tcp tls udp vnc voip |
The ratio of payload bytes to the entire traffic emitted by the destination |
| dest.pdus | number | arp bootp citrix citrix_channels dce_rpc dns ftp icmp ipsec kerberos ldap non_ip ntlm other_ip rdp socks5 ssh tcp udp vnc voip |
The total number of PDUs (protocol data units) at applicative level emitted by the destination |
| dest.port | port | citrix citrix_channels databases dce_rpc ftp http ipsec kerberos ldap ntlm rdp smb socks5 ssh tcp tls udp vnc voip |
The TCP/UDP port of the destination |
| dest.rd | number | tcp | The average retransmission delay for PDUs emitted by the destination |
| dest.rd.count | number | tcp | The number of retransmission delays for PDUs emitted by the destination |
| dest.rd.deviation | number | tcp | The deviation of the retransmission delay for PDUs emitted by the destination |
| dest.remote | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The name of the network interface on which this traffic has been captured via rpcapd (destination-side) |
| dest.retrans.payload | number | tcp | The total amount of bytes of data (without headers) in retransmitted PDUs emitted by the destination |
| dest.retrans.pdus | number | tcp | The total number of retransmitted PDUs emitted by the destination |
| dest.retrans.pdus.ratio | number | tcp | The ratio of retransmissions to the total number of PDUs (protocol data units) with payload emitted by the destination |
| dest.retrans.traffic | number | tcp | The total amount of bytes in retransmitted PDUs emitted by the destination |
| dest.retrans.traffic.ratio | number | tcp | The ratio of retransmitted traffic to the entire traffic emitted by the destination |
| dest.rsts | number | tcp | The number of RST packets emitted by the destination |
| dest.rsts.ratio | number | tcp | The average number of destination RST packets in a connection |
| dest.rtt | number | tcp | The average round-trip time for PDUs (protocol data units) emitted by the source |
| dest.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the source |
| dest.rtt.deviation | number | tcp | The deviation of the round-trip time for PDUs (protocol data units) emitted by the source |
| dest.seqnum_frames | number | tcp | Number of packets that increment the TCP seqnum emitted by the destination |
| dest.serial_number | string | tls | The unique serial number of the destination's digital certificate |
| dest.signalization.payload | number | voip | The total amount of bytes of data (without headers) in all signalization PDUs (protocol data units) emitted by the destination |
| dest.signalization.pdus | number | voip | The total number of signalization PDUs (protocol data units) emitted by the destination |
| dest.signalization.rd | number | voip | The average retransmission delay for signalization PDUs (protocol data units) emitted by the destination |
| dest.signalization.rd.count | number | voip | The number of retransmission delays for signalization PDUs (protocol data units) emitted by the destination |
| dest.signalization.rd.deviation | number | voip | The deviation of the retransmission delay for signalization PDUs (protocol data units) emitted by the destination |
| dest.signalization.retrans.pdus.ratio | number | voip | The ratio of retransmissions to the total number of signalization PDUs (protocol data units) emitted by the destination |
| dest.signalization.rtt | number | voip | The average round-trip time for signalization PDUs (protocol data units) emitted by the source |
| dest.signalization.rtt.count | number | voip | The number of round-trip times for signalization PDUs (protocol data units) emitted by the source |
| dest.signalization.rtt.deviation | number | voip | The deviation of the round-trip time for signalization PDUs (protocol data units) emitted by the source |
| dest.signalization.traffic | number | voip | The total amount of bytes in signalization PDUs (protocol data units) emitted by the destination |
| dest.signature | string | tls | The destination signature |
| dest.single.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the source between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| dest.single.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the source between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| dest.single.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the source between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| dest.traffic | number | arp bootp dce_rpc dns ftp icmp ipsec kerberos ldap non_ip ntlm other_ip rdp socks5 ssh tcp tls udp vnc voip |
The total amount of bytes emitted by the destination |
| dest.vlan | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The inner VLAN id on the destination side of the transaction (alias of destination.vlans.inner) |
| dest.vlans | array | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The VLAN ids on the destination side of the transaction. The first VLAN id represents the outer VLAN and the last VLAN id represents the inner VLAN |
| dest.vlans.count | number | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The number of VLANs on the destination side of the transaction |
| dest.vlans.inner | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The inner VLAN id on the destination side of the transaction |
| dest.vlans.outer | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The outer VLAN id on the destination side of the transaction |
| dest.zero_windows | number | tcp | The number of zero-window size packets emitted by the destination |
| dest.zero_windows.ratio | number | tcp | The ratio of zero-window size to the total number of packets emitted by the destination |
| dest.zone.id | zone_id | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The zone id of the destination |
| dest.zone.name | zone | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The zone of the destination |
| dns.rt | number | dns | The average DNS response time |
| dns.rt.count | number | dns | DNS response time count |
| dns.rt.deviation | number | dns | The deviation of the DNS response time |
| dns_computer | string | ntlm | DNS computer name |
| dns_domain | string | ntlm | DNS domain name |
| dns_tree | string | ntlm | DNS tree name |
| domain | string | citrix citrix_channels ntlm smb socks5 |
The Windows Domain of the user |
| domain.primary | string | http tls |
The primary domain name (www.example.org -> example.org) |
| domain.short | string | http tls |
The primary domain name, without TLD |
| domain.toplevel | string | http tls |
The top-level domain name (TLD) |
| domain_name | string | bootp | The domain name that client should use when resolving hostnames via the DNS |
| dtt.count | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The total number of data-transfer times in both directions |
| dtt.deviation | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The deviation of the data-transfer time in both directions |
| dtt.total | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The sum of both client and server average data-transfer times |
| dupacks | number | tcp | The total number of duplicated ACK packets in both directions |
| dupacks.ratio | number | tcp | The ratio of duplicated ACKs to the total number of packets in both directions |
| email.additional.response.codes | array | Email additional response codes | |
| email.additional.response.codes.counters | array | Email additional response codes counters | |
| email.command | email_command | SMTP command | |
| email.command.counter | number | Email command counter | |
| email.message.id | string | Message ID | |
| email.response.code | email_response_code | Email final response code | |
| encryption | encryption | citrix | The Citrix encryption type |
| end | time | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The timestamp of the last captured packet |
| ends | number | voip | The number of VoIP flows that ended |
| error.alerts | number | rdp tls |
The total number of error alerts (everything but close notifications) |
| error.code | string | databases kerberos |
The error code |
| error.hits | number | http | The number of hits with a response code of at least 400 |
| error.message | string | databases | The database error message |
| error.protocol | ipprotocol | icmp | The IP protocol of the PDU (protocol data unit) transported by the ICMP error message |
| error.status | string | databases | The database error status |
| error.unknown_alerts | number | rdp | Error events not defined in TLS RFC |
| errors | number | databases dns smb vnc voip |
The number of errors |
| errors.ratio | number | databases dns smb vnc voip |
The ratio of errors to the total number of queries |
| etype_ticket | keberos_encryption_type | kerberos | Encryption type ticket |
| expiration | time | kerberos | Expiration date requested by the client |
| expiration.is_illformed | bool | kerberos | Is expiration ill formed? |
| file | path | bootp ftp smb |
The file path |
| file.count | number | flows | The number of processed files |
| file.id | descriptor | smb | The CIFS file descriptor id |
| filter | string | ldap | Search filter |
| fins | number | tcp | The total number of FIN packets in both directions |
| fins.ratio | number | tcp | The average number of FIN packets in a connection |
| flags | number | dns | Bit array that contains DNS flags |
| flags.AA | number | dns | Authoritative Answer |
| flags.OPCODE | number | dns | Message kind: standard query (0), inverse query (1), server status (2), or reserved (3-15) |
| flags.QR | number | dns | A one bit field that specifies whether this message is a query (0), or a response (1). |
| flags.RA | number | dns | Recursion Available |
| flags.RCODE | number | dns | Response code |
| flags.RD | number | dns | Recursion Desired |
| flags.TC | number | dns | TrunCation |
| flags.Z | number | dns | Reserved for future use |
| ftp.commands | array | ftp | List of FTP client commands |
| ftp.commands.counters | array | ftp | Commands counters for each found commands item |
| ftp.file.sha256 | sha256 | ftp | SHA256 checksum of downloaded file |
| ftp.has_password | bool | ftp | Field to determine if a password was present during authentication |
| ftp.reply_codes | array | ftp | FTP server reply codes |
| ftp.reply_codes.counters | array | ftp | Reply codes counters for each found reply code |
| ftp.unknown_query | string | ftp | Unknown command in FTP standard |
| functions | array | dce_rpc | Function names |
| gateway.ip | ip | bootp | Relay agent IP address, used in booting via a relay agent |
| global.dtt | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The average data-transfer time in both directions |
| global.emtu | number | icmp non_ip other_ip tcp udp |
The maximum payload in a single ethernet packet in both directions |
| global.rd | number | tcp | The average retransmission delay in both directions |
| global.rtt | number | tcp | The average round-trip time in both directions |
| global.signalization.rd | number | voip | The average retransmission delay for signalization PDUs (protocol data units) in both directions |
| global.signalization.rtt | number | voip | The average round-trip time for signalization PDUs (protocol data units) in both directions |
| has_contributed | bool | http | Did this hit contribute to the metrics of the page it is attached to? |
| has_password | bool | socks5 | Flag specifying if password was present in captured communication. |
| has_timeouted | bool | databases http smb |
Did this transaction timeout? |
| has_voice | bool | voip | Was there any voice in the conversation? |
| headers | number | http | The total amount of bytes of headers in both query and response PDUs (protocol data units) |
| hit | uuid | http | This hit's unique identifier |
| hit.parent | uuid | http | This hit's parent's unique identifier |
| hit.referrer | uuid | http | This hit's referrer's unique identifier |
| hit.rt | number | http | The average hit response time |
| hit.rt.count | number | http | The number of HTTP hit response times |
| hit.rt.deviation | number | http | The deviation of the hit response time |
| hits | number | http | The number of HTTP hits |
| hops | number | bootp | In BOOTREQUEST messages, set to zero by the client and incremented by the relay agents |
| host | string | http | The URL Host |
| hostname | string | bootp ntlm rdp vnc |
Name of the client |
| http.version | http_version | http | The HTTP protocol version |
| http.version.major | number | http | The HTTP protocol major version |
| http.version.minor | number | http | The HTTP protocol minor version |
| icmp.code | number | icmp | The ICMP message code |
| icmp.message | icmpmessage | icmp | The ICMP message |
| icmp.type | icmptype | icmp | The ICMP message type |
| ignored_server.ip | ip | bootp | IP address of DHCP server which OFFER was not REQUESTed by the client |
| ignored_server.mac | mac | bootp | MAC address of DHCP server which OFFER was not REQUESTed by the client |
| include_pac | bool | kerberos | Include PAC (Privileged Attribute Certificate) |
| ip.family | ipfamily | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap ntlm other_ip rdp smb tcp tls udp vnc voip |
The IP address family |
| ip.protocol | ipprotocol | other_ip voip |
The IP protocol |
| ipsec.authentication.method | number | ipsec | Selected authentication method. |
| ipsec.certificate.type | number | ipsec | Contains an encoding of the type of certificate requested. |
| ipsec.domain.fqdn | string | ipsec | Domain FQDN |
| ipsec.encryption.type | number | ipsec | Selected encryption algorithm. |
| ipsec.esp | bool | ipsec | States if ESP traffic is present. |
| ipsec.group.description | number | ipsec | Identifies a group to use in a Diffie-Hellman exchange. |
| ipsec.group.type | number | ipsec | Defines the type of group. |
| ipsec.hash.type | number | ipsec | Selected hashing algorithm. |
| ipsec.ike | string | ipsec | IKE hash |
| ipsec.initiator.cookie | number | ipsec | Cookie of entity that initiated SA establishment. |
| ipsec.key_exchange | number | ipsec | Identifies the Diffie-Hellman group in which the Key Exchange Data was computed. |
| ipsec.key_exchange.count | number | ipsec | Number of key exchanges. |
| ipsec.life.duration | number | ipsec | Life duration of Security Association. |
| ipsec.life.type | number | ipsec | Type of lifetime to which the Security Association applies. |
| ipsec.nat | string | ipsec | NAT hash |
| ipsec.nonce | string | ipsec | Contains random data used to guarantee liveness during an exchange and protect against replay attacks. |
| ipsec.responder.cookie | number | ipsec | Cookie of entity that is responding to an SA establishment request. |
| ipsec.transform.id | array | ipsec | The specific instance of the transform type. |
| ipsec.transform.type | array | ipsec | The type of transform being specified in this transform. |
| ipsec.user.fqdn | string | ipsec | User FQDN |
| ipsec.vendors | array | ipsec | Vendors |
| ipsec.version | ipsec_protocol_version | ipsec | IKE/IPsec protocol version. |
| is_ajax | bool | http | Is this hit requested through javascript? |
| is_chunked | bool | http | Does this hit use HTTP 'chunked' transfer encoding? |
| is_compressed | bool | http | Is this hit compressed? |
| is_deepinspect | bool | http | Was page reconstruction activated for this hit? |
| is_main | bool | http | Is this hit the main resource of the page? |
| is_root | bool | http | Is this a root hit? |
| kdc_options | number | kerberos | KDC Options |
| keepalives | number | citrix | The total number of keep alives in both directions |
| kerberos.msg_types | array | kerberos | Message Types |
| kerberos.other_count | number | kerberos | Number of aggregated KRB_Ticket, KRB_SAFE, KRB_PRIV, KRB_CRED |
| kerberos.realm | string | kerberos | Realm |
| kerberos.reply_count | number | kerberos | Number of aggregated AS_REP, TGS_REP, AP_REP |
| kerberos.request.cipher | string | kerberos | Request cipher |
| kerberos.response.cipher | string | kerberos | Response cipher |
| kerberos.type | kerberos_type | kerberos | Kerberos message type |
| launch.time | number | citrix | The average launch time for Citrix applications |
| launch.time.deviation | number | citrix | The deviation of the launch time |
| layer | layer | arp bootp citrix citrix_channels databases dce_rpc dns flows ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The layer |
| ldap.type | string | ldap | The LDAP operation type |
| lease_time | number | bootp | A lease time requested by the client for the IP address |
| login.time | number | citrix | The average login time |
| login.time.count | number | citrix | The number of logins |
| login.time.deviation | number | citrix | The deviation of the login time |
| lost.pdus | number | voip | The total number of lost PDUs (protocol data units) in both directions |
| lost.pdus.ratio | number | voip | The ratio of lost to the total number of PDUs (protocol data units) in both directions |
| message | string | bootp | Error message |
| message.id | number | ldap | The ID of the LDAP message |
| metadata.payload | number | smb | The total amount of bytes of metadata in both directions |
| metadata.read | number | smb | The total amount of bytes of metadata read by SMB commands (directory listing commands, for example) |
| metadata.written | number | smb | The total amount of bytes of metadata written by SMB commands |
| method | httpquerymethod | http | The HTTP request method |
| module | string | citrix | The name of the Citrix module used by the client |
| mos | number | voip | The VOIP mean opinion score |
| name_flags | number | dns | Bit array that contains NetBIOS flags |
| name_flags.ACT | number | dns | Active Name Flag |
| name_flags.CNF | number | dns | Conflict Flag |
| name_flags.DRG | number | dns | Deregister Flag |
| name_flags.G | number | dns | Groupe Name Flag |
| name_flags.ONT | number | dns | Owner Node Type |
| name_flags.PRM | number | dns | Permanent Name Flag. |
| name_flags.RESERVED | number | dns | Reserved for future use. |
| nameserver1.ip | ip | bootp | The IP addresses of the first DNS servers available to the client |
| nameserver2.ip | ip | bootp | The IP addresses of the second DNS servers available to the client |
| nb_answers | number | dns | Number of answers |
| nb_questions | number | dns | Number of questions |
| netbios.computer_name | string | ntlm | Netbios computer name |
| netbios_domain | string | ntlm | Netbios domain name |
| netflow.hostname | hostname | icmp tcp udp |
The hostname of the emitter |
| netflow.ip | ip | icmp tcp udp |
The IP address of the emitter |
| next_server.ip | ip | bootp | IP address of next bootstrap server |
| nonip.protocol | ethernetprotocol | non_ip | The OSI layer 2 protocol |
| ntlm.negotiate_flags | number | ntlm | Flags defining NTLM capabilities supported by the sender |
| ntlm.source_proto | number | ntlm | Protocol in which NTML was embedded |
| ntp.ip | ip | bootp | The IP address of the first NTP server available to the client |
| object_name | string | ldap | Modified object |
| opnums | array | dce_rpc | List of identifiers for remote procedure call or a method in an interface |
| origin.ip | ip | http | The original client's IP, as it appears in the HTTP header |
| page.begin | time | http | The timestamp of the first packet in this page |
| page.end | time | http | The timestamp of the last packet in this page |
| page.errors | number | http | The number of errors in all the hits that contributed to these pages, errors consisting of HTTP response codes of at least 400 |
| page.hits | number | http | The number of hits that contributed to these pages |
| page.load.time | number | http | The average page load time |
| page.load.time.deviation | number | http | The deviation of the page load time |
| page.request.traffic | number | http | The total amount of bytes of request traffic (headers + payload) in all the hits that contributed to these pages |
| page.response.traffic | number | http | The total amount of bytes of response traffic (headers + payload) in all the hits that contributed to these pages |
| page.timeouts | number | http | The number of timeouts in all the hits that contributed to these pages |
| page.traffic | number | http | The total amount of bytes of query and response traffic (headers + payload) in all the hits that contributed to these pages |
| pages | number | http | The number of HTTP pages |
| payload | number | bootp citrix citrix_channels databases dce_rpc ftp http kerberos ldap ntlm rdp smb socks5 tcp tls udp vnc voip |
The total amount of bytes of data (without headers) in both directions |
| payload.pdus | number | citrix citrix_channels tcp voip |
The total number of PDUs (protocol data units) with payload in both directions |
| payload.ratio | number | bootp citrix citrix_channels dce_rpc ftp kerberos ldap ntlm rdp socks5 tcp tls udp vnc voip |
The ratio of payload bytes to the entire traffic in both directions |
| pcap | string | dns tcp voip |
The link to the associated captured PCAP file (generated according to the configuration of zones and applications) |
| pdus | number | bootp citrix citrix_channels databases dns icmp ldap non_ip ntlm other_ip smb tcp udp voip |
The total number of PDUs (protocol data units) at applicative level in both directions |
| points | number | arp bootp citrix citrix_channels databases dce_rpc dns flows ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The number of points |
| policy_handle | string | dce_rpc | Policy handle |
| protostack | protostack | arp bootp citrix citrix_channels databases dce_rpc dns icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The protocol stack |
| pxelinux | string | bootp | The PXELINUX bootloader's configuration file's location |
| queries | number | databases dns kerberos smb |
The number of queries |
| query | databasequery | databases | The database query |
| query.begin | time | databases smb |
The timestamp of the first query packet |
| query.class | dnsclass | dns | The class of the DNS query |
| query.end | time | databases smb |
The timestamp of the last query packet |
| query.name | string | dns | The name of the DNS query |
| query.payload | number | databases smb |
The total amount of bytes of payload in query PDUs (protocol data units) emitted by the client |
| query.pdus | number | databases smb |
The total number of query PDUs (protocol data units) at applicative level |
| query.tcp_pdus | number | http | The number of TCP packets that form up these HTTP queries |
| query.type | dnstype | dns | The type of the DNS query |
| query.write | number | smb | The total amount of bytes of data to be written |
| query_256 | databasequery | databases | First 256 characters of the query |
| rd.count | number | tcp | The total number of retransmission delays in both directions |
| rd.deviation | number | tcp | The deviation of the retransmission delay in both directions |
| rd.total | number | tcp | The sum of both client and server average data-transfer times |
| rdp.authentications.count | number | rdp | Total number of authentication attempts |
| rdp.client.application.count | number | rdp | Amount of bytes exchanged, packet counters from client |
| rdp.dest.application.count | number | rdp | Amount of bytes exchanged, packet counters from destination |
| rdp.server.application.count | number | rdp | Amount of bytes exchanged, packet counters from server |
| rdp.source.application.count | number | rdp | Amount of bytes exchanged, packet counters from source |
| rebinding.time | number | bootp | DHCP rebinding period |
| recipients | array | List of all recipient addresses | |
| recipients.cc | array | Recipient addresses using the cc header | |
| recipients.to | array | Recipient addresses using the to header | |
| referrer | string | http | The HTTP referrer |
| renew.time | time | kerberos | Renew time |
| renew.time.is_illformed | bool | kerberos | Is renew time ill formed? |
| renewal.time | number | bootp | DHCP renewal period |
| request.begin | time | http | The timestamp of the first request packet |
| request.content_length | number | http | The average Content-Length in the headers of these HTTP requests |
| request.content_length.count | number | http | The number of HTTP requests with a Content-Length header |
| request.content_pack | path | http | The path to the pack file that contains the HTTP request content |
| request.content_type | mimetype | http | The mime-type in the Content-Type header of the HTTP request |
| request.end | time | http | The timestamp of the last request packet |
| request.etypes | array | kerberos | Encryption type requests. (Only one execpt on attack) |
| request.headers | number | http | The total amount of bytes of headers in request PDUs (protocol data units) emitted by the client |
| request.payload | number | http | The total amount of bytes of payload in request PDUs (protocol data units) emitted by the client |
| request.payload.sha256 | sha256 | http | The hash sha256 calculated using the bytes of payload in request PDUs (protocol data units) emitted by the client |
| request.traffic | number | http | The total amount of bytes (headers + payload) in request PDUs (protocol data units) emitted by the client |
| request_attributes | string | ldap | Request attributes for search/modify/delete/add requests |
| requested_ip | ip | bootp | A particular IP address that the client request to be assigned |
| resolved_ip | ip | dns | Resovled IP address |
| response.begin | time | databases http smb |
The timestamp of the first response packet |
| response.category | string | http | The HTTP response mime-type's category |
| response.class | dnsclass | dns | The class of the DNS response |
| response.code | dnscode | dns | The DNS response code |
| response.content_length | number | http | The average Content-Length in the headers of these HTTP responses |
| response.content_length.count | number | http | The number of HTTP responses with a Content-Length header |
| response.content_pack | path | http | The path to the pack file that contains the HTTP response content |
| response.content_type | mimetype | http | The mime-type in the Content-Type header of the HTTP response |
| response.end | time | databases http smb |
The timestamp of the first response packet |
| response.etypes | array | kerberos | Encryption type responses. (Only one except on attack) |
| response.headers | number | http | The total amount of bytes of headers in response PDUs (protocol data units) emitted by the server |
| response.payload | number | databases http smb |
The total amount of bytes of payload in response PDUs (protocol data units) emitted by the server |
| response.payload.sha256 | sha256 | http | The hash sha256 calculated using the bytes of payload in response PDUs (protocol data units) emitted by the server |
| response.pdus | number | databases smb |
The total number of PDUs (protocol data units) at applicative level emitted by the server |
| response.read | number | smb | The total amount of bytes of data read by SMB commands |
| response.status | httpstatus | http | The HTTP response code |
| response.status.category | httpstatuscategory | http | The category of the response status code |
| response.tcp_pdus | number | http | The number of TCP packets that form up these HTTP responses |
| response.traffic | number | http | The total amount of bytes (headers + payload) in response PDUs (protocol data units) emitted by the client |
| response.type | dnstype | dns | The type of the DNS response |
| response.written | number | smb | The total amount of bytes of data effectively written by SMB commands |
| result_code | number | ldap ntlm |
Result code |
| resumed | number | tls | The number of resumed sessions |
| retrans.payload | number | tcp | The total amount of bytes of data (without headers) in retransmitted PDUs in both directions |
| retrans.pdus.ratio | number | tcp | The ratio of retransmissions to the total number of PDUs (protocol data units) with payload in both directions |
| retrans.traffic | number | tcp | The total amount of bytes in retransmitted PDUs in both directions |
| retrans.traffic.ratio | number | tcp | The ratio of retransmitted traffic to the entire traffic in both directions |
| return_codes | array | dce_rpc | List of return codes |
| router.ip | ip | bootp | The IP address of the first router on the client's subnet |
| rows.integrated | number | flows | The number of integrated rows |
| rows.integrated.per_minute | number | flows | The number of integrated rows per minute |
| rows.total | number | flows | The total number of analyzed rows |
| rows.total.per_minute | number | flows | The number of total rows per minute |
| rows.truncated | number | flows | The number of truncated rows |
| rows.truncated.per_minute | number | flows | The number of truncated rows per minute |
| rsts | number | tcp | The total number of RST packets in both directions |
| rsts.ratio | number | tcp | The average number of RST packets in a connection |
| rtt.count | number | tcp | The total number of round-trip times in both directions |
| rtt.deviation | number | tcp | The deviation of the round-trip time in both directions |
| rtt.total | number | tcp | The sum of both client and server average round-trip times |
| search_result_num | number | ldap | Number of entries in search result |
| sender.address | string | Sender email address | |
| sender.hostname | hostname | arp | Hostname of the sender IP address |
| sender.ip | ip | arp | Sender Protocol Address |
| sender.mac | mac | arp | Sender MAC Address |
| sender.name | string | Sender username | |
| server.challenge | number | ntlm | Server challenge |
| server.common_name | string | tls | The Common Name of the server certificate |
| server.compressed.pdus | number | citrix_channels | The number of compressed server PDUs (protocol data units) |
| server.compressed.pdus.ratio | number | citrix_channels | The ratio of compressions to the total number of PDUs (protocol data units) emitted by the server |
| server.data | number | tls | The total number of server data PDUs (protocol data units) |
| server.datasource.kind | pktsourcekind | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The packet source type (pcap file, netflow, network iface, rpcapd) on which this traffic has been captured (server-side) |
| server.datasource.name | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The packet source name on which this traffic has been captured (server-side) |
| server.datasource.pair | pktsourcepair | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The packet source type and name on which this traffic has been captured (server-side) |
| server.diffserv | diffserv | icmp other_ip tcp udp |
The server differentiated service |
| server.dtt | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The average data-transfer time for PDUs (protocol data units) emitted by the server |
| server.dtt.count | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The number of data-transfer times for PDUs (protocol data units) emitted by the server |
| server.dtt.deviation | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The deviation of the data-transfer time for PDUs (protocol data units) emitted by the server |
| server.dupacks | number | tcp | The number of duplicated ACK packets from the server |
| server.dupacks.ratio | number | tcp | The ratio of duplicated ACKs to the total number of packets emitted by the server |
| server.emtu | number | icmp non_ip other_ip tcp udp |
The maximum payload in a single ethernet packet emmited by the server in these conversations (this value is assumed to be the MTU of the server's network interface, although the actual MTU value might be greater) |
| server.error.ip | ip | icmp | The IP address of the server, as it appears in the headers of the ICMP error message |
| server.error.port | port | icmp | The port of the server, as it appears in the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| server.error.zone.id | zone_id | icmp | The zone ID of the server, determined using the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| server.error.zone.name | zone | icmp | The zone of the server, determined using the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| server.expiration | time | tls | The expiration date of the server certificate |
| server.file | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The name of the Pcap File used as traffic source (server-side) |
| server.fins | number | tcp | The number of FIN packets emitted by the server |
| server.fins.ratio | number | tcp | The average number of server FIN packets in a connection |
| server.hostname | hostname | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The hostname of the server |
| server.initial.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the client between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| server.initial.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the client between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| server.initial.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the client between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| server.interface | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The name of the network interface on which this traffic has been captured (server-side) |
| server.ip | ip | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The IP address of the server |
| server.ja3 | tls_fingerprint | rdp tls |
The JA3 server fingerprint |
| server.keepalives | number | citrix | The number of keep alives from the server |
| server.key.bits | number | tls | The number of bits in the server key |
| server.key.type | keytype | tls | The type of the server key |
| server.mac | mac | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The MAC address of the server |
| server.meta | number | tls | The total number of server metadata (handshake, change cipher spec & alerts PDU types) |
| server.multiple.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the client between a series of packets and a single ACK for all of them (more than 1). |
| server.multiple.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the client between a series of packets and a single ACK for all of them (more than 1). |
| server.multiple.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the client between a series of packets and a single ACK for all of them (more than 1). |
| server.name | string | kerberos | Server Principal name |
| server.os | os | tcp | The server operating system |
| server.payload | number | arp bootp citrix citrix_channels dce_rpc ftp ipsec kerberos ldap ntlm rdp socks5 ssh tcp tls udp vnc voip |
The total amount of bytes of data (without headers) emitted by the server |
| server.payload.pdus | number | citrix citrix_channels tcp voip |
The total number of PDUs (protocol data units) with payload emitted by the server |
| server.payload.ratio | number | bootp citrix citrix_channels dce_rpc ftp kerberos ldap ntlm rdp socks5 tcp tls udp vnc voip |
The ratio of payload bytes to the entire traffic emitted by the server |
| server.pdus | number | arp bootp citrix citrix_channels dce_rpc dns ftp icmp ipsec kerberos ldap non_ip ntlm other_ip rdp socks5 ssh tcp udp vnc voip |
The total number of PDUs (protocol data units) at applicative level emitted by the server |
| server.port | port | citrix citrix_channels databases dce_rpc ftp http ipsec kerberos ldap ntlm rdp smb socks5 ssh tcp tls udp vnc voip |
The TCP/UDP port of the server |
| server.rd | number | tcp | The average retransmission delay for PDUs emitted by the server |
| server.rd.count | number | tcp | The number of retransmission delays for PDUs emitted by the server |
| server.rd.deviation | number | tcp | The deviation of the retransmission delay for PDUs emitted by the server |
| server.remote | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The name of the network interface on which this traffic has been captured via rpcapd (server-side) |
| server.retrans.payload | number | tcp | The total amount of bytes of data (without headers) in retransmitted PDUs emitted by the server |
| server.retrans.pdus | number | tcp | The total number of retransmitted PDUs emitted by the server |
| server.retrans.pdus.ratio | number | tcp | The ratio of retransmissions to the total number of PDUs (protocol data units) with payload emitted by the server |
| server.retrans.traffic | number | tcp | The total amount of bytes in retransmitted PDUs emitted by the server |
| server.retrans.traffic.ratio | number | tcp | The ratio of retransmitted traffic to the entire traffic emitted by the server |
| server.rsts | number | tcp | The number of RST packets emitted by the server |
| server.rsts.ratio | number | tcp | The average number of server RST packets in a connection |
| server.rt | number | bootp citrix citrix_channels databases ftp kerberos ldap ntlm smb tcp tls |
The average server response time (SRT) |
| server.rt.count | number | bootp citrix citrix_channels databases ftp kerberos ldap ntlm smb tcp tls |
The number of server response times |
| server.rt.deviation | number | bootp citrix citrix_channels databases ftp kerberos ldap ntlm smb tcp tls |
The deviation of the server response time |
| server.rtt | number | tcp | The average round-trip time for PDUs (protocol data units) emitted by the client |
| server.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the client |
| server.rtt.deviation | number | tcp | The deviation of the round-trip time for PDUs (protocol data units) emitted by the client |
| server.seqnum_frames | number | tcp | Number of packets that increment the TCP seqnum emitted by the server |
| server.serial_number | string | tls | The unique serial number of the server's digital certificate |
| server.signalization.last_code | number | voip | Last SIP or MGCP response code |
| server.signalization.payload | number | voip | The total amount of bytes of data (without headers) in all signalization PDUs (protocol data units) emitted by the server |
| server.signalization.pdus | number | voip | The total number of signalization PDUs (protocol data units) emitted by the server |
| server.signalization.rd | number | voip | The average retransmission delay for signalization PDUs (protocol data units) emitted by the server |
| server.signalization.rd.count | number | voip | The number of retransmission delays for signalization PDUs (protocol data units) emitted by the server |
| server.signalization.rd.deviation | number | voip | The deviation of the retransmission delay for signalization PDUs (protocol data units) emitted by the server |
| server.signalization.retrans.pdus.ratio | number | voip | The ratio of retransmissions to the total number of signalization PDUs (protocol data units) emitted by the server |
| server.signalization.rt | number | voip | The average server response time for signalization PDUs (protocol data units) |
| server.signalization.rt.count | number | voip | The number of server response times for signalization PDUs (protocol data units) |
| server.signalization.rt.deviation | number | voip | The deviation of the server response time for signalization PDUs (protocol data units) |
| server.signalization.rtt | number | voip | The average round-trip time for signalization PDUs (protocol data units) emitted by the client |
| server.signalization.rtt.count | number | voip | The number of round-trip times for signalization PDUs (protocol data units) emitted by the client |
| server.signalization.rtt.deviation | number | voip | The deviation of the round-trip time for signalization PDUs (protocol data units) emitted by the client |
| server.signalization.traffic | number | voip | The total amount of bytes in signalization PDUs (protocol data units) emitted by the server |
| server.signature | string | tls | The server signature |
| server.single.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the client between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| server.single.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the client between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| server.single.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the client between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| server.time | time | kerberos | Current time on the server |
| server.time.is_illformed | bool | kerberos | Is server time ill formed? |
| server.traffic | number | arp bootp dce_rpc dns ftp icmp ipsec kerberos ldap non_ip ntlm other_ip rdp socks5 ssh tcp tls udp vnc voip |
The total amount of bytes emitted by the server |
| server.vlan | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The inner VLAN id on the server side of the transaction (alias of server.vlans.inner) |
| server.vlans | array | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The VLAN ids on the server side of the transaction. The first VLAN id represents the outer VLAN and the last VLAN id represents the inner VLAN |
| server.vlans.count | number | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The number of VLANs on the server side of the transaction |
| server.vlans.inner | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The inner VLAN id on the server side of the transaction |
| server.vlans.outer | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The outer VLAN id on the server side of the transaction |
| server.zero_windows | number | tcp | The number of zero-window size packets emitted by the server |
| server.zero_windows.ratio | number | tcp | The ratio of zero-window size to the total number of packets emitted by the server |
| server.zone.id | zone_id | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The zone id of the server |
| server.zone.name | zone | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The zone of the server |
| server_handle | string | dce_rpc | Server handle |
| server_name | string | tls | The Server Name Indication of the conversation |
| signalization.pdus | number | voip | The total number of signalization PDUs (protocol data units) in both directions |
| signalization.rd.count | number | voip | The total number of retransmission delays for signalization PDUs (protocol data units) in both directions |
| signalization.rd.deviation | number | voip | The deviation of the retransmission delay for signalization PDUs (protocol data units) in both directions |
| signalization.rd.total | number | voip | The sum of both client and server average retransmission delays for signalization PDUs (protocol data units) |
| signalization.retrans.pdus.ratio | number | voip | The ratio of retransmissions to the total number of signalization PDUs (protocol data units) in both directions |
| signalization.rtt.count | number | voip | The total number of round-trip times for signalization PDUs (protocol data units) in both directions |
| signalization.rtt.deviation | number | voip | The deviation of the round-trip time for signalization PDUs (protocol data units) in both directions |
| signalization.rtt.total | number | voip | The sum of both client and server average round-trip times |
| signalization.traffic | number | voip | The total amount of bytes in signalization PDUs (protocol data units) in both directions |
| smb.change_time | time | smb | Change time |
| smb.command | smbcommand | smb | The SMB command |
| smb.command.code | number | smb | The raw SMB command |
| smb.create_options | smb_create_options | smb | The options to be applied when creating or opening the file |
| smb.creation_time | time | smb | Creation time |
| smb.delete_on_close | bool | smb | Delete on close |
| smb.desired_access | smb_desired_access | smb | Access rights used in access-control entries (ACEs) |
| smb.file_attributes | smb_file_attributes | smb | File attributes |
| smb.file_info_class | smb_file_info_class | smb | Information class |
| smb.file_info_class.code | number | smb | The raw information class |
| smb.info_type | smb_info_type | smb | Information type |
| smb.last_access_time | time | smb | Last access time |
| smb.last_write_time | time | smb | Last write time |
| smb.new_file_name | string | smb | New file name |
| smb.sha256 | sha256 | smb | The sha256 hash |
| smb.status | smbstatus | smb | The SMB status |
| smb.subcommand | smbsubcommand | smb | The SMB subcommand |
| smb.subcommand.code | number | smb | The raw SMB subcommand |
| smb.version | smb_version | smb | The SMB protocol version |
| socks5.address.type | socks5_address_type | socks5 | Type of address contained within client request |
| socks5.authentication_method | socks5_authentication_method | socks5 | Selected authentication method |
| socks5.command | socks5_command | socks5 | Client request command code |
| socks5.response.status | socks5_response_status | socks5 | Server response status code |
| socks5.target.ip | ip | socks5 | Desired destination address |
| software | string | http | The software in the Server header of the HTTP response |
| source.common_name | string | tls | The Common Name of the source certificate |
| source.compressed.pdus | number | citrix_channels | The number of compressed source PDUs (protocol data units) |
| source.compressed.pdus.ratio | number | citrix_channels | The ratio of compressions to the total number of PDUs (protocol data units) emitted by the source |
| source.data | number | tls | The total number of source data PDUs (protocol data units) |
| source.datasource.kind | pktsourcekind | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The packet source type (pcap file, netflow, network iface, rpcapd) on which this traffic has been captured (source-side) |
| source.datasource.name | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The packet source name on which this traffic has been captured (source-side) |
| source.datasource.pair | pktsourcepair | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The packet source type and name on which this traffic has been captured (source-side) |
| source.diffserv | diffserv | icmp other_ip tcp udp |
The source differentiated service |
| source.dtt | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The average data-transfer time for PDUs (protocol data units) emitted by the source |
| source.dtt.count | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The number of data-transfer times for PDUs (protocol data units) emitted by the source |
| source.dtt.deviation | number | citrix citrix_channels databases http kerberos ldap ntlm smb tcp tls |
The deviation of the data-transfer time for PDUs (protocol data units) emitted by the source |
| source.dupacks | number | tcp | The number of duplicated ACK packets from the source |
| source.dupacks.ratio | number | tcp | The ratio of duplicated ACKs to the total number of packets emitted by the source |
| source.emtu | number | icmp non_ip other_ip tcp udp |
The maximum payload in a single ethernet packet emmited by the source in these conversations (this value is assumed to be the MTU of the source's network interface, although the actual MTU value might be greater) |
| source.error.ip | ip | icmp | The IP address of the source, as it appears in the headers of the ICMP error message |
| source.error.port | port | icmp | The port of the source, as it appears in the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| source.error.zone.id | zone_id | icmp | The zone ID of the source, determined using the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| source.error.zone.name | zone | icmp | The zone of the source, determined using the TCP/UDP PDU (protocol data unit) transported by the ICMP error message |
| source.expiration | time | tls | The expiration date of the source certificate |
| source.file | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The name of the Pcap File used as traffic source (source-side) |
| source.fins | number | tcp | The number of FIN packets emitted by the source |
| source.fins.ratio | number | tcp | The average number of source FIN packets in a connection |
| source.hostname | hostname | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The hostname of the source |
| source.initial.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the destination between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| source.initial.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the destination between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| source.initial.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the destination between the very first payload packet (after the TCP handshake) and the corresponding ACK |
| source.interface | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The name of the network interface on which this traffic has been captured (source-side) |
| source.ip | ip | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The IP address of the source |
| source.ja3 | tls_fingerprint | rdp tls |
The JA3 source fingerprint |
| source.keepalives | number | citrix | The number of keep alives from the source |
| source.key.bits | number | tls | The number of bits in the source key |
| source.key.type | keytype | tls | The type of the source key |
| source.mac | mac | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The MAC address of the source |
| source.meta | number | tls | The total number of source metadata (handshake, change cipher spec & alerts PDU types) |
| source.multiple.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the destination between a series of packets and a single ACK for all of them (more than 1). |
| source.multiple.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the destination between a series of packets and a single ACK for all of them (more than 1). |
| source.multiple.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the destination between a series of packets and a single ACK for all of them (more than 1). |
| source.os | os | tcp | The source operating system |
| source.payload | number | arp bootp citrix citrix_channels dce_rpc ftp ipsec kerberos ldap ntlm rdp socks5 ssh tcp tls udp vnc voip |
The total amount of bytes of data (without headers) emitted by the source |
| source.payload.pdus | number | citrix citrix_channels tcp voip |
The total number of PDUs (protocol data units) with payload emitted by the source |
| source.payload.ratio | number | bootp citrix citrix_channels dce_rpc ftp kerberos ldap ntlm rdp socks5 tcp tls udp vnc voip |
The ratio of payload bytes to the entire traffic emitted by the source |
| source.pdus | number | arp bootp citrix citrix_channels dce_rpc dns ftp icmp ipsec kerberos ldap non_ip ntlm other_ip rdp socks5 ssh tcp udp vnc voip |
The total number of PDUs (protocol data units) at applicative level emitted by the source |
| source.port | port | citrix citrix_channels databases dce_rpc ftp http ipsec kerberos ldap ntlm rdp smb socks5 ssh tcp tls udp vnc voip |
The TCP/UDP port of the source |
| source.rd | number | tcp | The average retransmission delay for PDUs emitted by the source |
| source.rd.count | number | tcp | The number of retransmission delays for PDUs emitted by the source |
| source.rd.deviation | number | tcp | The deviation of the retransmission delay for PDUs emitted by the source |
| source.remote | pktsourcename | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The name of the network interface on which this traffic has been captured via rpcapd (source-side) |
| source.retrans.payload | number | tcp | The total amount of bytes of data (without headers) in retransmitted PDUs emitted by the source |
| source.retrans.pdus | number | tcp | The total number of retransmitted PDUs emitted by the source |
| source.retrans.pdus.ratio | number | tcp | The ratio of retransmissions to the total number of PDUs (protocol data units) with payload emitted by the source |
| source.retrans.traffic | number | tcp | The total amount of bytes in retransmitted PDUs emitted by the source |
| source.retrans.traffic.ratio | number | tcp | The ratio of retransmitted traffic to the entire traffic emitted by the source |
| source.rsts | number | tcp | The number of RST packets emitted by the source |
| source.rsts.ratio | number | tcp | The average number of source RST packets in a connection |
| source.rtt | number | tcp | The average round-trip time for PDUs (protocol data units) emitted by the destination |
| source.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the destination |
| source.rtt.deviation | number | tcp | The deviation of the round-trip time for PDUs (protocol data units) emitted by the destination |
| source.seqnum_frames | number | tcp | Number of packets that increment the TCP seqnum emitted by the source |
| source.serial_number | string | tls | The unique serial number of the source's digital certificate |
| source.signalization.payload | number | voip | The total amount of bytes of data (without headers) in all signalization PDUs (protocol data units) emitted by the source |
| source.signalization.pdus | number | voip | The total number of signalization PDUs (protocol data units) emitted by the source |
| source.signalization.rd | number | voip | The average retransmission delay for signalization PDUs (protocol data units) emitted by the source |
| source.signalization.rd.count | number | voip | The number of retransmission delays for signalization PDUs (protocol data units) emitted by the source |
| source.signalization.rd.deviation | number | voip | The deviation of the retransmission delay for signalization PDUs (protocol data units) emitted by the source |
| source.signalization.retrans.pdus.ratio | number | voip | The ratio of retransmissions to the total number of signalization PDUs (protocol data units) emitted by the source |
| source.signalization.rtt | number | voip | The average round-trip time for signalization PDUs (protocol data units) emitted by the destination |
| source.signalization.rtt.count | number | voip | The number of round-trip times for signalization PDUs (protocol data units) emitted by the destination |
| source.signalization.rtt.deviation | number | voip | The deviation of the round-trip time for signalization PDUs (protocol data units) emitted by the destination |
| source.signalization.traffic | number | voip | The total amount of bytes in signalization PDUs (protocol data units) emitted by the source |
| source.signature | string | tls | The source signature |
| source.single.rtt.count | number | tcp | The number of round-trip times for PDUs (protocol data units) emitted by the destination between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| source.single.rtt.square_sum | number | tcp | The sum of the squared round-trip times for PDUs (protocol data units) emitted by the destination between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| source.single.rtt.sum | number | tcp | The total duration of round-trip times for PDUs (protocol data units) emitted by the destination between a packet and its ACK, when the acknowledge doesn't seem to cover multiple packets (and excluding the case of rtt.initial), |
| source.traffic | number | arp bootp dce_rpc dns ftp icmp ipsec kerberos ldap non_ip ntlm other_ip rdp socks5 ssh tcp tls udp vnc voip |
The total amount of bytes emitted by the source |
| source.vlan | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The inner VLAN id on the source side of the transaction (alias of source.vlans.inner) |
| source.vlans | array | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The VLAN ids on the source side of the transaction. The first VLAN id represents the outer VLAN and the last VLAN id represents the inner VLAN |
| source.vlans.count | number | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The number of VLANs on the source side of the transaction |
| source.vlans.inner | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The inner VLAN id on the source side of the transaction |
| source.vlans.outer | vlan | bootp citrix citrix_channels databases dce_rpc dns ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
The outer VLAN id on the source side of the transaction |
| source.zero_windows | number | tcp | The number of zero-window size packets emitted by the source |
| source.zero_windows.ratio | number | tcp | The ratio of zero-window size to the total number of packets emitted by the source |
| source.zone.id | zone_id | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The zone id of the source |
| source.zone.name | zone | arp bootp citrix citrix_channels databases dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp smb socks5 ssh tcp tls udp vnc voip |
The zone of the source |
| source_proto | number | kerberos | Protocol source |
| ssh.authentications.count | number | ssh | Total number of authentication attempts |
| ssh.authentications.success | number | ssh | Total number of successful authentication attempts |
| ssh.client.hassh | hassh | ssh | Client HASSH fingerprint |
| ssh.client.version | string | ssh | SSH client version |
| ssh.key_exchange.agreement | string | ssh | Key exchange agreement |
| ssh.login.packet_size | number | ssh | User login attempt packet size |
| ssh.max_time_to.login | number | ssh | Max time to login (user input delay) |
| ssh.max_time_to.newkey | number | ssh | Max time to newkey (user input delay) |
| ssh.min_time_to.login | number | ssh | Min time to login (user input delay) |
| ssh.min_time_to.newkey | number | ssh | Min time to newkey (user input delay) |
| ssh.server.hassh | hassh | ssh | Server HASSH fingerprint |
| ssh.server.version | string | ssh | SSH server version |
| subject | string | Email subject | |
| subnet.ip | ip | bootp | Client's subnet mask |
| successes | number | citrix databases dns smb vnc voip |
The number of successes |
| successes.ratio | number | citrix databases dns smb vnc voip |
The ratio of successes |
| syns | number | tcp | The number of SYN packets emitted by the client |
| syns.ratio | number | tcp | The average number of SYN packets in a connection |
| system | databasesystem | databases | The database system |
| target | string | ntlm | Target name |
| target.hostname | hostname | arp | Hostname of the target IP address |
| target.ip | ip | arp | Target Protocol Address |
| target.mac | mac | arp | Target MAC Address |
| target.port | port | socks5 | Desired destination port |
| tcp_pdus | number | http | The number of TCP packets that form up the HTTP queries and responses |
| time_exclusion.any | bool | bootp citrix citrix_channels databases dce_rpc dns flows ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
Was there any time exclusion? |
| time_exclusion.business_hours | bool | bootp citrix citrix_channels databases dce_rpc dns flows ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
Was there a business hours time exclusion? |
| time_exclusion.maintenance_windows | bool | bootp citrix citrix_channels databases dce_rpc dns flows ftp http icmp kerberos ldap non_ip ntlm other_ip rdp smb tcp tls udp vnc voip |
Was there a maintenance windows time exclusion? |
| timeouts | number | citrix | The number of flows that timeouted |
| timestamp | time | flows ntlm |
Timestamp |
| tls.version | tls_version | tls | The TLS protocol version |
| tls.version.is_weak | bool | tls | Is the TLS protocol version weak? |
| tls.version.major | number | tls | The TLS protocol major version |
| tls.version.minor | number | tls | The TLS protocol minor version |
| traffic | number | arp bootp dce_rpc dns ftp http icmp ipsec kerberos ldap non_ip ntlm other_ip rdp socks5 ssh tcp tls udp vnc voip |
The total amount of bytes in both directions |
| tree | path | smb | The tree this CIFS command relates to |
| tree.id | descriptor | smb | The id of the tree this CIFS command relates to |
| ttl | number | dns | Time interval (in seconds) that the resource record may be cached before it should be discarded |
| unclosed | number | tcp | The number of TCP sessions that didn't properly end |
| url | url | http | The path, query and fragment parts of the URL |
| url.base | url | http | The URL without the query string and fragment |
| url.path | path | http | The URL path |
| user | string | citrix citrix_channels databases ftp ldap ntlm smb socks5 |
The user |
| user.experience | number | tcp | The end-user experience (sum of RTTs, DTTs and SRT) |
| user_agent | useragent | http | The user-agent |
| uuid | uuid | bootp citrix citrix_channels databases dce_rpc dns ftp http ipsec kerberos ldap ntlm rdp smb socks5 ssh tcp tls vnc voip |
The unique identifier of this session |
| vendor | string | bootp | The vendor type and configuration of a DHCP client |
| vnc.client.version | vnc_version | vnc | client Version |
| vnc.client.version.major | number | vnc | The client Major Version |
| vnc.client.version.minor | number | vnc | The client Minor Version |
| vnc.dest.version | vnc_version | vnc | destination Version |
| vnc.dest.version.major | number | vnc | The destination Major Version |
| vnc.dest.version.minor | number | vnc | The destination Minor Version |
| vnc.encryption | vnc_encryption_type | vnc | VNC Encryption Type |
| vnc.server.version | vnc_version | vnc | server Version |
| vnc.server.version.major | number | vnc | The server Major Version |
| vnc.server.version.minor | number | vnc | The server Minor Version |
| vnc.source.version | vnc_version | vnc | source Version |
| vnc.source.version.major | number | vnc | The source Major Version |
| vnc.source.version.minor | number | vnc | The source Minor Version |
| vnc.supported.encryptions | array | vnc | VNC Supported Encryption Types |
| voice.count | number | voip | Number of packets where we had voice in the conversation |
| warnings | number | smb vnc |
The number of warnings |
| warnings.ratio | number | smb | The ratio of warnings to the total number of SMB queries |
| zero_windows | number | tcp | The total number of zero-window size packets in both directions |
| zero_windows.ratio | number | tcp | The ratio of zero-window size to the total number of packets in both directions |
| Name | JSON Type | Available Values | Custom Values Allowed |
|——|———–|——————|———————–|
| alerttypes | array
### alerttypes | Name | Value | Description | | — | —-| —-| | Close Notify | 0 | This message notifies the recipient that the sender will not send any more messages on this connection.| | Unexpected Message | 1 | An inappropriate message was received.| | Bad MAC Record | 2 | This alert is returned if a record is received with an incorrect MAC.| | Decryption Failed | 3 | This alert was used in some earlier versions of TLS, and may have permitted certain attacks against the CBC mode.| | Record Overflow | 4 | A TLSCiphertext record was received that had a length more than 2^14+2048 bytes, or a record decrypted to a TLSCompressed record with more than 2^14+1024 bytes.| | Decompression Failure | 5 | The decompression function received improper input (e.g., data that would expand to excessive length).| | Handshake Failure | 6 | Reception of a handshake failure alert message indicates that the sender was unable to negotiate an acceptable set of security parameters given the options available.| | No Certificate | 7 | This alert was used in SSLv3 but not any version of TLS.| | Bad Certificate | 8 | A certificate was corrupt, contained signatures that did not verify correctly, etc.| | Unsupported Certificate | 9 | A certificate was of an unsupported type.| | Certificate Revoked | 10 | A certificate was revoked by its signer.| | Certificate Expired | 11 | A certificate has expired or is not currently valid.| | Certificate Unknown | 12 | Some other (unspecified) issue arose in processing the certificate, rendering it unacceptable.| | Illegal Parameter | 13 | A field in the handshake was out of range or inconsistent with other fields.| | Unknown CA | 14 | A valid certificate chain or partial chain was received, but the certificate was not accepted because the CA certificate could not be located or couldn't be matched with a known, trusted CA.| | Access Denied | 15 | A valid certificate was received, but when access control was applied, the sender decided not to proceed with negotiation.| | Decode Error | 16 | A message could not be decoded because some field was out of the specified range or the length of the message was incorrect.| | Decrypt Error | 17 | A handshake cryptographic operation failed, including being unable to correctly verify a signature or validate a Finished message.| | Export Restriction | 18 | This alert was used in some earlier versions of TLS.| | Protocol Version | 19 | The protocol version the client has attempted to negotiate is recognized but not supported.| | Insufficient Security | 20 | Returned instead of a handshake failure when a negotiation has failed specifically because the server requires ciphers more secure than those supported by the client.| | Internal Error | 21 | An internal error unrelated to the peer or the correctness of the protocol (such as a memory allocation failure) makes it impossible to continue.| | User Cancelled | 22 | This handshake is being canceled for some reason unrelated to a protocol failure.| | No Renegotiation | 23 | Sent by the client in response to a hello request or by the server in response to a client hello after initial handshaking.| | Unsupported Extension | 24 | Sent by clients that receive an extended server hello containing an extension that they did not put in the corresponding client hello.|
### application_source | Name | Value | | — | —-| | Not classified | 0 - 0x0 | | Accedian | 1 - 0x1 | | SasS | 3 - 0x3 |
### calldirection | Name | Value | | — | —-| | Unknown | None | | Inbound | 0 - 0x0 | | Outbound | 1 - 0x1 |
### callstate | Name | Value | | — | —-| | In ring | 0 - 0x0 | | Hang down | 1 - 0x1 | | Dial | 2 - 0x2 | | Out ring | 3 - 0x3 | | Voice | 4 - 0x4 | | Hang up | 5 - 0x5 | | Closed | 6 - 0x6 |
### channel This field does not allow any custom items.
| Name | Category | Value | Description |
|---|---|---|---|
| CTXSCRN | Audio and video management | 0 - 0x0 | CTXSCRN |
| CTXLPT1 | Printer and scanner management | 1 - 0x1 | CTXLPT1: Printer mapping for non-spooling client (Thin client devices) - vdcpm30N.dll |
| CTXLPT2 | Printer and scanner management | 2 - 0x2 | CTXLPT2: Printer mapping for non-spooling client (Thin client devices) - vdcpm30N.dll |
| CTXSBR | Audio and video management | 3 - 0x3 | CTXSBR: Browser acceleration - vdtw30n.dll |
| CTXCPM | Printer and scanner management | 4 - 0x4 | CTXCPM: Printer mapping for client spooler - vdcpm30N.dll |
| CTXCOM1 | Printer and scanner management | 5 - 0x5 | CTXCOM1: Printer mapping for non-spooling client (Thin client devices) - vdcom30N.dll |
| CTXCOM2 | Printer and scanner management | 6 - 0x6 | CTXCOM2: Printer mapping for non-spooling client (Thin client devices) - vdcom30N.dll |
| CTXCCM | Peripherals forwarding (like USB) | 7 - 0x7 | CTXCCM: Client COM port mapping - vdcom30N.dll |
| CTXTW | Audio and video management | 8 - 0x8 | CTXTW: Remote Windows screen update (ThinWire) - vdtw30n.dll |
| CTXCDM | Peripherals forwarding (like USB) | 9 - 0x9 | CTXCDM: Client drive mapping - vdcdm30n.dll |
| SHADOW | Unknown | 10 - 0xA | SHADOW |
| CTXOEM | Implementation and usage defined by O.E.M. | 11 - 0xB | CTXOEM: Used by Original Equipment Manufacturers |
| CTXOEM2 | Implementation and usage defined by O.E.M. | 12 - 0xC | CTXOEM2: Used by Original Equipment Manufacturers |
| CTXCLIP | Audio and video management | 13 - 0xD | CTXCLIP: Client clipboard - vdclipn.dll |
| CTXCAM | Audio and video management | 14 - 0xE | CTXCAM: Client audio mapping - vdcamN.dll |
| CTXDRTP | Unknown | 15 - 0xF | |
| CTXTWI | Audio and video management | 16 - 0x10 | CTXTWI: Seamless Windows screen update data (ThinWire) |
| CTXZLFK | Audio and video management | 17 - 0x11 | CTXZLFK: Local Text Echo and Keyboard Feedback / Screen latency reduction (fonts) - vdzlcn.dll, vdfon30n.dll |
| CTXTUI | Audio and video management | 18 - 0x12 | Transparent User Interface |
| CTXCTL | Core Citrix channels (updates, licensing, configuration, …) | 19 - 0x13 | CTXCTL: Citrix control virtual channel - vdctln.dll |
| CTXSCRD | Authentication related | 20 - 0x14 | CTXSCRD: Smartcard - vdscardn.dll |
| CTXEUEM | Core Citrix channels (updates, licensing, configuration, …) | 21 - 0x15 | CTXEUEM: End user experience monitoring - vdeuemn.dll |
| CTXLIC | Core Citrix channels (updates, licensing, configuration, …) | 22 - 0x16 | CTXLIC: License management - wfica32.exe |
| CTXMM | Audio and video management | 23 - 0x17 | CTXMM: Windows Multimedia redirection - vdmmn.dll |
| CTXSSPI | Authentication related | 24 - 0x18 | CTXSSPI: Kerberos |
| CTXTWN | Printer and scanner management | 25 - 0x19 | CTXTWN: TWAIN redirection - vdtwn.dll |
| CITRIXD | Unknown | 26 - 0x1A | |
| PNPREDI | Unknown | 27 - 0x1B | |
| CTXSENS | Audio and video management | 28 - 0x1C | Location and sensor |
| CTXMTCH | Audio and video management | 29 - 0x1D | CTXMTCH: Multitouch |
| CTXLFP | Audio and video management | 30 - 0x1E | CTXLFP: Framehawk Display channel over UDP-like transport |
| CTXGUSB | Peripherals forwarding (like USB) | 31 - 0x1F | CTXGUSB: USB redirection - vdgusbn.dll |
| CTXFLSH | Audio and video management | 32 - 0x20 | CTXFLSH: Flash redirection - vdflash.dll |
| CTXFLS2 | Audio and video management | 33 - 0x21 | CTXFLS2 |
| CTXD3D | Audio and video management | 34 - 0x22 | CTXD3D: Direct3D virtual channel adapter - vd3dn.dll |
| CTXPN | Unknown | 35 - 0x23 | CTXPN: Program Neighborhood - vdpnn.dll |
| CTXZLC | Audio and video management | 36 - 0x24 | CTXZLC: Screen latency reduction (screen) - vdzlcn.dll |
| CTXSPMK | Unknown | 37 - 0x25 | |
| CARANOC | Unknown | 38 - 0x26 | CARANOC |
| AURTCX | Unknown | 39 - 0x27 | AURTCX |
| IMP1166 | Unknown | 40 - 0x28 | |
| SPECIAL_THINWIRE | Audio and video management | 41 - 0x29 | SPECIAL_THINWIRE |
| ESCAPE | Core Citrix channels (updates, licensing, configuration, …) | 42 - 0x2A | ESCAPE |
| BASE | Core Citrix channels (updates, licensing, configuration, …) | 43 - 0x2B | BASE |
| CTXVFM | Audio and video management | 44 - 0x2C | CTXVFM: Video server (not ThinWire, deprecated) |
| CTXCM | Core Citrix channels (updates, licensing, configuration, …) | 45 - 0x2D | CTXCM: Client management (auto client update) - vdcmN.dll |
| CTXPASS | Audio and video management | 46 - 0x2E | CTXPASS: Transparent key pass-through - vdkbhook.dll |
| CTXTW1 | Audio and video management | 47 - 0x2F | CTXTW1: Seamless Windows screen update (ThinWire) - vdtwin.dll |
| PSPXSBE | Unknown | 48 - 0x30 | |
| MHA_VC | Unknown | 49 - 0x31 | |
| EVDSSO | Unknown | 50 - 0x32 | |
| CTXMOB | Unknown | 51 - 0x33 | |
| PSPCTRL | Unknown | 52 - 0x34 | |
| PSPMIX | Unknown | 53 - 0x35 | |
| PSPSBEX | Unknown | 54 - 0x36 | |
| PSPXMIX | Unknown | 55 - 0x37 |
### ciphersuite | Name | Value | | — | —-| | null with null null | 0 - 0x0 | | RSA with null MD5 | 1 - 0x1 | | RSA with null SHA | 2 - 0x2 | | RSA export with RC4 40 MD5 | 3 - 0x3 | | RSA with RC4 128 MD5 | 4 - 0x4 | | RSA with RC4 128 SHA | 5 - 0x5 | | RSA export with RC2 CBC 40 MD5 | 6 - 0x6 | | RSA with IDEA CBC SHA | 7 - 0x7 | | RSA export with DES40 CBC SHA | 8 - 0x8 | | RSA with DES CBC SHA | 9 - 0x9 | | RSA with 3DES EDE CBC SHA | 10 - 0xA | | DH DSS export with DES40 CBC SHA | 11 - 0xB | | DH DSS with DES CBC SHA | 12 - 0xC | | DH DSS with 3DES EDE CBC SHA | 13 - 0xD | | DH RSA export with DES40 CBC SHA | 14 - 0xE | | DH RSA with DES CBC SHA | 15 - 0xF | | DH RSA with 3DES EDE CBC SHA | 16 - 0x10 | | DHE DSS export with DES40 CBC SHA | 17 - 0x11 | | DHE DSS with DES CBC SHA | 18 - 0x12 | | DHE DSS with 3DES EDE CBC SHA | 19 - 0x13 | | DHE RSA export with DES40 CBC SHA | 20 - 0x14 | | DHE RSA with DES CBC SHA | 21 - 0x15 | | DHE RSA with 3DES EDE CBC SHA | 22 - 0x16 | | DH anon export with RC4 40 MD5 | 23 - 0x17 | | DH anon with RC4 128 MD5 | 24 - 0x18 | | DH anon export with DES40 CBC SHA | 25 - 0x19 | | DH anon with DES CBC SHA | 26 - 0x1A | | DH anon with 3DES EDE CBC SHA | 27 - 0x1B | | KRB5 with DES CBC SHA | 30 - 0x1E | | KRB5 with 3DES EDE CBC SHA | 31 - 0x1F | | KRB5 with RC4 128 SHA | 32 - 0x20 | | KRB5 with IDEA CBC SHA | 33 - 0x21 | | KRB5 with DES CBC MD5 | 34 - 0x22 | | KRB5 with 3DES EDE CBC MD5 | 35 - 0x23 | | KRB5 with RC4 128 MD5 | 36 - 0x24 | | KRB5 with IDEA CBC MD5 | 37 - 0x25 | | KRB5 export with DES CBC 40 SHA | 38 - 0x26 | | KRB5 export with RC2 CBC 40 SHA | 39 - 0x27 | | KRB5 export with RC4 40 SHA | 40 - 0x28 | | KRB5 export with DES CBC 40 MD5 | 41 - 0x29 | | KRB5 export with RC2 CBC 40 MD5 | 42 - 0x2A | | KRB5 export with RC4 40 MD5 | 43 - 0x2B | | PSK with null SHA | 44 - 0x2C | | DHE PSK with null SHA | 45 - 0x2D | | RSA PSK with null SHA | 46 - 0x2E | | RSA with AES 128 CBC SHA | 47 - 0x2F | | DH DSS with AES 128 CBC SHA | 48 - 0x30 | | DH RSA with AES 128 CBC SHA | 49 - 0x31 | | DHE DSS with AES 128 CBC SHA | 50 - 0x32 | | DHE RSA with AES 128 CBC SHA | 51 - 0x33 | | DH anon with AES 128 CBC SHA | 52 - 0x34 | | RSA with AES 256 CBC SHA | 53 - 0x35 | | DH DSS with AES 256 CBC SHA | 54 - 0x36 | | DH RSA with AES 256 CBC SHA | 55 - 0x37 | | DHE DSS with AES 256 CBC SHA | 56 - 0x38 | | DHE RSA with AES 256 CBC SHA | 57 - 0x39 | | DH anon with AES 256 CBC SHA | 58 - 0x3A | | RSA with null SHA256 | 59 - 0x3B | | RSA with AES 128 CBC SHA256 | 60 - 0x3C | | RSA with AES 256 CBC SHA256 | 61 - 0x3D | | DH DSS with AES 128 CBC SHA256 | 62 - 0x3E | | DH RSA with AES 128 CBC SHA256 | 63 - 0x3F | | DHE DSS with AES 128 CBC SHA256 | 64 - 0x40 | | RSA with CAMELLIA 128 CBC SHA | 65 - 0x41 | | DH DSS with CAMELLIA 128 CBC SHA | 66 - 0x42 | | DH RSA with CAMELLIA 128 CBC SHA | 67 - 0x43 | | DHE DSS with CAMELLIA 128 CBC SHA | 68 - 0x44 | | DHE RSA with CAMELLIA 128 CBC SHA | 69 - 0x45 | | DH anon with CAMELLIA 128 CBC SHA | 70 - 0x46 | | ECDH ECDSA with DES CBC SHA | 73 - 0x49 | | RSA export1024 with RC4 56 MD5 | 96 - 0x60 | | RSA export1024 with RC2 CBC 56 MD5 | 97 - 0x61 | | RSA export1024 with DES CBC SHA | 98 - 0x62 | | DHE DSS export1024 with DES CBC SHA | 99 - 0x63 | | RSA export1024 with RC4 56 SHA | 100 - 0x64 | | DHE DSS export1024 with RC4 56 SHA | 101 - 0x65 | | DHE DSS with RC4 128 SHA | 102 - 0x66 | | DHE RSA with AES 128 CBC SHA256 | 103 - 0x67 | | DH DSS with AES 256 CBC SHA256 | 104 - 0x68 | | DH RSA with AES 256 CBC SHA256 | 105 - 0x69 | | DHE DSS with AES 256 CBC SHA256 | 106 - 0x6A | | DHE RSA with AES 256 CBC SHA256 | 107 - 0x6B | | DH anon with AES 128 CBC SHA256 | 108 - 0x6C | | DH anon with AES 256 CBC SHA256 | 109 - 0x6D | | GOSTR341094 with 28147 CNT IMIT | 128 - 0x80 | | GOSTR341001 with 28147 CNT IMIT | 129 - 0x81 | | GOSTR341094 with null GOSTR3411 | 130 - 0x82 | | GOSTR341001 with null GOSTR3411 | 131 - 0x83 | | RSA with CAMELLIA 256 CBC SHA | 132 - 0x84 | | DH DSS with CAMELLIA 256 CBC SHA | 133 - 0x85 | | DH RSA with CAMELLIA 256 CBC SHA | 134 - 0x86 | | DHE DSS with CAMELLIA 256 CBC SHA | 135 - 0x87 | | DHE RSA with CAMELLIA 256 CBC SHA | 136 - 0x88 | | DH anon with CAMELLIA 256 CBC SHA | 137 - 0x89 | | PSK with RC4 128 SHA | 138 - 0x8A | | PSK with 3DES EDE CBC SHA | 139 - 0x8B | | PSK with AES 128 CBC SHA | 140 - 0x8C | | PSK with AES 256 CBC SHA | 141 - 0x8D | | DHE PSK with RC4 128 SHA | 142 - 0x8E | | DHE PSK with 3DES EDE CBC SHA | 143 - 0x8F | | DHE PSK with AES 128 CBC SHA | 144 - 0x90 | | DHE PSK with AES 256 CBC SHA | 145 - 0x91 | | RSA PSK with RC4 128 SHA | 146 - 0x92 | | RSA PSK with 3DES EDE CBC SHA | 147 - 0x93 | | RSA PSK with AES 128 CBC SHA | 148 - 0x94 | | RSA PSK with AES 256 CBC SHA | 149 - 0x95 | | RSA with seed CBC SHA | 150 - 0x96 | | DH DSS with seed CBC SHA | 151 - 0x97 | | DH RSA with seed CBC SHA | 152 - 0x98 | | DHE DSS with seed CBC SHA | 153 - 0x99 | | DHE RSA with seed CBC SHA | 154 - 0x9A | | DH anon with seed CBC SHA | 155 - 0x9B | | RSA with AES 128 GCM SHA256 | 156 - 0x9C | | RSA with AES 256 GCM SHA384 | 157 - 0x9D | | DHE RSA with AES 128 GCM SHA256 | 158 - 0x9E | | DHE RSA with AES 256 GCM SHA384 | 159 - 0x9F | | DH RSA with AES 128 GCM SHA256 | 160 - 0xA0 | | DH RSA with AES 256 GCM SHA384 | 161 - 0xA1 | | DHE DSS with AES 128 GCM SHA256 | 162 - 0xA2 | | DHE DSS with AES 256 GCM SHA384 | 163 - 0xA3 | | DH DSS with AES 128 GCM SHA256 | 164 - 0xA4 | | DH DSS with AES 256 GCM SHA384 | 165 - 0xA5 | | DH anon with AES 128 GCM SHA256 | 166 - 0xA6 | | DH anon with AES 256 GCM SHA384 | 167 - 0xA7 | | PSK with AES 128 GCM SHA256 | 168 - 0xA8 | | PSK with AES 256 GCM SHA384 | 169 - 0xA9 | | DHE PSK with AES 128 GCM SHA256 | 170 - 0xAA | | DHE PSK with AES 256 GCM SHA384 | 171 - 0xAB | | RSA PSK with AES 128 GCM SHA256 | 172 - 0xAC | | RSA PSK with AES 256 GCM SHA384 | 173 - 0xAD | | PSK with AES 128 CBC SHA256 | 174 - 0xAE | | PSK with AES 256 CBC SHA384 | 175 - 0xAF | | PSK with null SHA256 | 176 - 0xB0 | | PSK with null SHA384 | 177 - 0xB1 | | DHE PSK with AES 128 CBC SHA256 | 178 - 0xB2 | | DHE PSK with AES 256 CBC SHA384 | 179 - 0xB3 | | DHE PSK with null SHA256 | 180 - 0xB4 | | DHE PSK with null SHA384 | 181 - 0xB5 | | RSA PSK with AES 128 CBC SHA256 | 182 - 0xB6 | | RSA PSK with AES 256 CBC SHA384 | 183 - 0xB7 | | RSA PSK with null SHA256 | 184 - 0xB8 | | RSA PSK with null SHA384 | 185 - 0xB9 | | RSA with CAMELLIA 128 CBC SHA256 | 186 - 0xBA | | DH DSS with CAMELLIA 128 CBC SHA256 | 187 - 0xBB | | DH RSA with CAMELLIA 128 CBC SHA256 | 188 - 0xBC | | DHE DSS with CAMELLIA 128 CBC SHA256 | 189 - 0xBD | | DHE RSA with CAMELLIA 128 CBC SHA256 | 190 - 0xBE | | DH anon with CAMELLIA 128 CBC SHA256 | 191 - 0xBF | | RSA with CAMELLIA 256 CBC SHA256 | 192 - 0xC0 | | DH DSS with CAMELLIA 256 CBC SHA256 | 193 - 0xC1 | | DH RSA with CAMELLIA 256 CBC SHA256 | 194 - 0xC2 | | DHE DSS with CAMELLIA 256 CBC SHA256 | 195 - 0xC3 | | DHE RSA with CAMELLIA 256 CBC SHA256 | 196 - 0xC4 | | DH anon with CAMELLIA 256 CBC SHA256 | 197 - 0xC5 | | empty renegotiation info SCSV | 255 - 0xFF | | AES 128 GCM SHA256 | 4865 - 0x1301 | | AES 256 GCM SHA384 | 4866 - 0x1302 | | CHACHA20 POLY1305 SHA256 | 4867 - 0x1303 | | AES 128 CCM SHA256 | 4868 - 0x1304 | | AES 128 CCM 8 SHA256 | 4869 - 0x1305 | | fallback SCSV | 22016 - 0x5600 | | ECDH ECDSA with null SHA | 49153 - 0xC001 | | ECDH ECDSA with RC4 128 SHA | 49154 - 0xC002 | | ECDH ECDSA with 3DES EDE CBC SHA | 49155 - 0xC003 | | ECDH ECDSA with AES 128 CBC SHA | 49156 - 0xC004 | | ECDH ECDSA with AES 256 CBC SHA | 49157 - 0xC005 | | ECDHE ECDSA with null SHA | 49158 - 0xC006 | | ECDHE ECDSA with RC4 128 SHA | 49159 - 0xC007 | | ECDHE ECDSA with 3DES EDE CBC SHA | 49160 - 0xC008 | | ECDHE ECDSA with AES 128 CBC SHA | 49161 - 0xC009 | | ECDHE ECDSA with AES 256 CBC SHA | 49162 - 0xC00A | | ECDH RSA with null SHA | 49163 - 0xC00B | | ECDH RSA with RC4 128 SHA | 49164 - 0xC00C | | ECDH RSA with 3DES EDE CBC SHA | 49165 - 0xC00D | | ECDH RSA with AES 128 CBC SHA | 49166 - 0xC00E | | ECDH RSA with AES 256 CBC SHA | 49167 - 0xC00F | | ECDHE RSA with null SHA | 49168 - 0xC010 | | ECDHE RSA with RC4 128 SHA | 49169 - 0xC011 | | ECDHE RSA with 3DES EDE CBC SHA | 49170 - 0xC012 | | ECDHE RSA with AES 128 CBC SHA | 49171 - 0xC013 | | ECDHE RSA with AES 256 CBC SHA | 49172 - 0xC014 | | ECDH anon with null SHA | 49173 - 0xC015 | | ECDH anon with RC4 128 SHA | 49174 - 0xC016 | | ECDH anon with 3DES EDE CBC SHA | 49175 - 0xC017 | | ECDH anon with AES 128 CBC SHA | 49176 - 0xC018 | | ECDH anon with AES 256 CBC SHA | 49177 - 0xC019 | | SRP SHA with 3DES EDE CBC SHA | 49178 - 0xC01A | | SRP SHA RSA with 3DES EDE CBC SHA | 49179 - 0xC01B | | SRP SHA DSS with 3DES EDE CBC SHA | 49180 - 0xC01C | | SRP SHA with AES 128 CBC SHA | 49181 - 0xC01D | | SRP SHA RSA with AES 128 CBC SHA | 49182 - 0xC01E | | SRP SHA DSS with AES 128 CBC SHA | 49183 - 0xC01F | | SRP SHA with AES 256 CBC SHA | 49184 - 0xC020 | | SRP SHA RSA with AES 256 CBC SHA | 49185 - 0xC021 | | SRP SHA DSS with AES 256 CBC SHA | 49186 - 0xC022 | | ECDHE ECDSA with AES 128 CBC SHA256 | 49187 - 0xC023 | | ECDHE ECDSA with AES 256 CBC SHA384 | 49188 - 0xC024 | | ECDH ECDSA with AES 128 CBC SHA256 | 49189 - 0xC025 | | ECDH ECDSA with AES 256 CBC SHA384 | 49190 - 0xC026 | | ECDHE RSA with AES 128 CBC SHA256 | 49191 - 0xC027 | | ECDHE RSA with AES 256 CBC SHA384 | 49192 - 0xC028 | | ECDH RSA with AES 128 CBC SHA256 | 49193 - 0xC029 | | ECDH RSA with AES 256 CBC SHA384 | 49194 - 0xC02A | | ECDHE ECDSA with AES 128 GCM SHA256 | 49195 - 0xC02B | | ECDHE ECDSA with AES 256 GCM SHA384 | 49196 - 0xC02C | | ECDH ECDSA with AES 128 GCM SHA256 | 49197 - 0xC02D | | ECDH ECDSA with AES 256 GCM SHA384 | 49198 - 0xC02E | | ECDHE RSA with AES 128 GCM SHA256 | 49199 - 0xC02F | | ECDHE RSA with AES 256 GCM SHA384 | 49200 - 0xC030 | | ECDH RSA with AES 128 GCM SHA256 | 49201 - 0xC031 | | ECDH RSA with AES 256 GCM SHA384 | 49202 - 0xC032 | | ECDHE PSK with RC4 128 SHA | 49203 - 0xC033 | | ECDHE PSK with 3DES EDE CBC SHA | 49204 - 0xC034 | | ECDHE PSK with AES 128 CBC SHA | 49205 - 0xC035 | | ECDHE PSK with AES 256 CBC SHA | 49206 - 0xC036 | | ECDHE PSK with AES 128 CBC SHA256 | 49207 - 0xC037 | | ECDHE PSK with AES 256 CBC SHA384 | 49208 - 0xC038 | | ECDHE PSK with null SHA | 49209 - 0xC039 | | ECDHE PSK with null SHA256 | 49210 - 0xC03A | | ECDHE PSK with null SHA384 | 49211 - 0xC03B | | RSA with ARIA 128 CBC SHA256 | 49212 - 0xC03C | | RSA with ARIA 256 CBC SHA384 | 49213 - 0xC03D | | DH DSS with ARIA 128 CBC SHA256 | 49214 - 0xC03E | | DH DSS with ARIA 256 CBC SHA384 | 49215 - 0xC03F | | DH RSA with ARIA 128 CBC SHA256 | 49216 - 0xC040 | | DH RSA with ARIA 256 CBC SHA384 | 49217 - 0xC041 | | DHE DSS with ARIA 128 CBC SHA256 | 49218 - 0xC042 | | DHE DSS with ARIA 256 CBC SHA384 | 49219 - 0xC043 | | DHE RSA with ARIA 128 CBC SHA256 | 49220 - 0xC044 | | DHE RSA with ARIA 256 CBC SHA384 | 49221 - 0xC045 | | DH anon with ARIA 128 CBC SHA256 | 49222 - 0xC046 | | DH anon with ARIA 256 CBC SHA384 | 49223 - 0xC047 | | ECDHE ECDSA with ARIA 128 CBC SHA256 | 49224 - 0xC048 | | ECDHE ECDSA with ARIA 256 CBC SHA384 | 49225 - 0xC049 | | ECDH ECDSA with ARIA 128 CBC SHA256 | 49226 - 0xC04A | | ECDH ECDSA with ARIA 256 CBC SHA384 | 49227 - 0xC04B | | ECDHE RSA with ARIA 128 CBC SHA256 | 49228 - 0xC04C | | ECDHE RSA with ARIA 256 CBC SHA384 | 49229 - 0xC04D | | ECDH RSA with ARIA 128 CBC SHA256 | 49230 - 0xC04E | | ECDH RSA with ARIA 256 CBC SHA384 | 49231 - 0xC04F | | RSA with ARIA 128 GCM SHA256 | 49232 - 0xC050 | | RSA with ARIA 256 GCM SHA384 | 49233 - 0xC051 | | DHE RSA with ARIA 128 GCM SHA256 | 49234 - 0xC052 | | DHE RSA with ARIA 256 GCM SHA384 | 49235 - 0xC053 | | DH RSA with ARIA 128 GCM SHA256 | 49236 - 0xC054 | | DH RSA with ARIA 256 GCM SHA384 | 49237 - 0xC055 | | DHE DSS with ARIA 128 GCM SHA256 | 49238 - 0xC056 | | DHE DSS with ARIA 256 GCM SHA384 | 49239 - 0xC057 | | DH DSS with ARIA 128 GCM SHA256 | 49240 - 0xC058 | | DH DSS with ARIA 256 GCM SHA384 | 49241 - 0xC059 | | DH anon with ARIA 128 GCM SHA256 | 49242 - 0xC05A | | DH anon with ARIA 256 GCM SHA384 | 49243 - 0xC05B | | ECDHE ECDSA with ARIA 128 GCM SHA256 | 49244 - 0xC05C | | ECDHE ECDSA with ARIA 256 GCM SHA384 | 49245 - 0xC05D | | ECDH ECDSA with ARIA 128 GCM SHA256 | 49246 - 0xC05E | | ECDH ECDSA with ARIA 256 GCM SHA384 | 49247 - 0xC05F | | ECDHE RSA with ARIA 128 GCM SHA256 | 49248 - 0xC060 | | ECDHE RSA with ARIA 256 GCM SHA384 | 49249 - 0xC061 | | ECDH RSA with ARIA 128 GCM SHA256 | 49250 - 0xC062 | | ECDH RSA with ARIA 256 GCM SHA384 | 49251 - 0xC063 | | PSK with ARIA 128 CBC SHA256 | 49252 - 0xC064 | | PSK with ARIA 256 CBC SHA384 | 49253 - 0xC065 | | DHE PSK with ARIA 128 CBC SHA256 | 49254 - 0xC066 | | DHE PSK with ARIA 256 CBC SHA384 | 49255 - 0xC067 | | RSA PSK with ARIA 128 CBC SHA256 | 49256 - 0xC068 | | RSA PSK with ARIA 256 CBC SHA384 | 49257 - 0xC069 | | PSK with ARIA 128 GCM SHA256 | 49258 - 0xC06A | | PSK with ARIA 256 GCM SHA384 | 49259 - 0xC06B | | DHE PSK with ARIA 128 GCM SHA256 | 49260 - 0xC06C | | DHE PSK with ARIA 256 GCM SHA384 | 49261 - 0xC06D | | RSA PSK with ARIA 128 GCM SHA256 | 49262 - 0xC06E | | RSA PSK with ARIA 256 GCM SHA384 | 49263 - 0xC06F | | ECDHE PSK with ARIA 128 CBC SHA256 | 49264 - 0xC070 | | ECDHE PSK with ARIA 256 CBC SHA384 | 49265 - 0xC071 | | ECDHE ECDSA with CAMELLIA 128 CBC SHA256 | 49266 - 0xC072 | | ECDHE ECDSA with CAMELLIA 256 CBC SHA384 | 49267 - 0xC073 | | ECDH ECDSA with CAMELLIA 128 CBC SHA256 | 49268 - 0xC074 | | ECDH ECDSA with CAMELLIA 256 CBC SHA384 | 49269 - 0xC075 | | ECDHE RSA with CAMELLIA 128 CBC SHA256 | 49270 - 0xC076 | | ECDHE RSA with CAMELLIA 256 CBC SHA384 | 49271 - 0xC077 | | ECDH RSA with CAMELLIA 128 CBC SHA256 | 49272 - 0xC078 | | ECDH RSA with CAMELLIA 256 CBC SHA384 | 49273 - 0xC079 | | RSA with CAMELLIA 128 GCM SHA256 | 49274 - 0xC07A | | RSA with CAMELLIA 256 GCM SHA384 | 49275 - 0xC07B | | DHE RSA with CAMELLIA 128 GCM SHA256 | 49276 - 0xC07C | | DHE RSA with CAMELLIA 256 GCM SHA384 | 49277 - 0xC07D | | DH RSA with CAMELLIA 128 GCM SHA256 | 49278 - 0xC07E | | DH RSA with CAMELLIA 256 GCM SHA384 | 49279 - 0xC07F | | DHE DSS with CAMELLIA 128 GCM SHA256 | 49280 - 0xC080 | | DHE DSS with CAMELLIA 256 GCM SHA384 | 49281 - 0xC081 | | DH DSS with CAMELLIA 128 GCM SHA256 | 49282 - 0xC082 | | DH DSS with CAMELLIA 256 GCM SHA384 | 49283 - 0xC083 | | DH anon with CAMELLIA 128 GCM SHA256 | 49284 - 0xC084 | | DH anon with CAMELLIA 256 GCM SHA384 | 49285 - 0xC085 | | ECDHE ECDSA with CAMELLIA 128 GCM SHA256 | 49286 - 0xC086 | | ECDHE ECDSA with CAMELLIA 256 GCM SHA384 | 49287 - 0xC087 | | ECDH ECDSA with CAMELLIA 128 GCM SHA256 | 49288 - 0xC088 | | ECDH ECDSA with CAMELLIA 256 GCM SHA384 | 49289 - 0xC089 | | ECDHE RSA with CAMELLIA 128 GCM SHA256 | 49290 - 0xC08A | | ECDHE RSA with CAMELLIA 256 GCM SHA384 | 49291 - 0xC08B | | ECDH RSA with CAMELLIA 128 GCM SHA256 | 49292 - 0xC08C | | ECDH RSA with CAMELLIA 256 GCM SHA384 | 49293 - 0xC08D | | PSK with CAMELLIA 128 GCM SHA256 | 49294 - 0xC08E | | PSK with CAMELLIA 256 GCM SHA384 | 49295 - 0xC08F | | DHE PSK with CAMELLIA 128 GCM SHA256 | 49296 - 0xC090 | | DHE PSK with CAMELLIA 256 GCM SHA384 | 49297 - 0xC091 | | RSA PSK with CAMELLIA 128 GCM SHA256 | 49298 - 0xC092 | | RSA PSK with CAMELLIA 256 GCM SHA384 | 49299 - 0xC093 | | PSK with CAMELLIA 128 CBC SHA256 | 49300 - 0xC094 | | PSK with CAMELLIA 256 CBC SHA384 | 49301 - 0xC095 | | DHE PSK with CAMELLIA 128 CBC SHA256 | 49302 - 0xC096 | | DHE PSK with CAMELLIA 256 CBC SHA384 | 49303 - 0xC097 | | RSA PSK with CAMELLIA 128 CBC SHA256 | 49304 - 0xC098 | | RSA PSK with CAMELLIA 256 CBC SHA384 | 49305 - 0xC099 | | ECDHE PSK with CAMELLIA 128 CBC SHA256 | 49306 - 0xC09A | | ECDHE PSK with CAMELLIA 256 CBC SHA384 | 49307 - 0xC09B | | RSA with AES 128 CCM | 49308 - 0xC09C | | RSA with AES 256 CCM | 49309 - 0xC09D | | DHE RSA with AES 128 CCM | 49310 - 0xC09E | | DHE RSA with AES 256 CCM | 49311 - 0xC09F | | RSA with AES 128 CCM 8 | 49312 - 0xC0A0 | | RSA with AES 256 CCM 8 | 49313 - 0xC0A1 | | DHE RSA with AES 128 CCM 8 | 49314 - 0xC0A2 | | DHE RSA with AES 256 CCM 8 | 49315 - 0xC0A3 | | PSK with AES 128 CCM | 49316 - 0xC0A4 | | PSK with AES 256 CCM | 49317 - 0xC0A5 | | DHE PSK with AES 128 CCM | 49318 - 0xC0A6 | | DHE PSK with AES 256 CCM | 49319 - 0xC0A7 | | PSK with AES 128 CCM 8 | 49320 - 0xC0A8 | | PSK with AES 256 CCM 8 | 49321 - 0xC0A9 | | PSK DHE with AES 128 CCM 8 | 49322 - 0xC0AA | | PSK DHE with AES 256 CCM 8 | 49323 - 0xC0AB | | ECDHE ECDSA with AES 128 CCM | 49324 - 0xC0AC | | ECDHE ECDSA with AES 256 CCM | 49325 - 0xC0AD | | ECDHE ECDSA with AES 128 CCM 8 | 49326 - 0xC0AE | | ECDHE ECDSA with AES 256 CCM 8 | 49327 - 0xC0AF | | ECJPAKE with AES 128 CCM 8 | 49407 - 0xC0FF | | ECDHE RSA with CHACHA20 POLY1305 SHA256 | 52392 - 0xCCA8 | | ECDHE ECDSA with CHACHA20 POLY1305 SHA256 | 52393 - 0xCCA9 | | DHE RSA with CHACHA20 POLY1305 SHA256 | 52394 - 0xCCAA | | PSK with CHACHA20 POLY1305 SHA256 | 52395 - 0xCCAB | | ECDHE PSK with CHACHA20 POLY1305 SHA256 | 52396 - 0xCCAC | | DHE PSK with CHACHA20 POLY1305 SHA256 | 52397 - 0xCCAD | | RSA PSK with CHACHA20 POLY1305 SHA256 | 52398 - 0xCCAE | | ECDHE PSK with AES 128 GCM SHA256 | 53249 - 0xD001 | | ECDHE PSK with AES 256 GCM SHA384 | 53250 - 0xD002 | | ECDHE PSK with AES 128 CCM 8 SHA256 | 53251 - 0xD003 | | ECDHE PSK with AES 128 CCM SHA256 | 53253 - 0xD005 | | RSA with ESTREAM SALSA20 SHA1 | 58384 - 0xE410 | | RSA with SALSA20 SHA1 | 58385 - 0xE411 | | ECDHE RSA with ESTREAM SALSA20 SHA1 | 58386 - 0xE412 | | ECDHE RSA with SALSA20 SHA1 | 58387 - 0xE413 | | ECDHE ECDSA with ESTREAM SALSA20 SHA1 | 58388 - 0xE414 | | ECDHE ECDSA with SALSA20 SHA1 | 58389 - 0xE415 | | PSK with ESTREAM SALSA20 SHA1 | 58390 - 0xE416 | | PSK with SALSA20 SHA1 | 58391 - 0xE417 | | ECDHE PSK with ESTREAM SALSA20 SHA1 | 58392 - 0xE418 | | ECDHE PSK with SALSA20 SHA1 | 58393 - 0xE419 | | RSA PSK with ESTREAM SALSA20 SHA1 | 58394 - 0xE41A | | RSA PSK with SALSA20 SHA1 | 58395 - 0xE41B | | DHE PSK with ESTREAM SALSA20 SHA1 | 58396 - 0xE41C | | DHE PSK with SALSA20 SHA1 | 58397 - 0xE41D | | DHE RSA with ESTREAM SALSA20 SHA1 | 58398 - 0xE41E | | DHE RSA with SALSA20 SHA1 | 58399 - 0xE41F |
### databasecommand This field does not allow any custom items.
| Name | Value |
|---|---|
| SELECT | 256 - 0x100 |
| INSERT | 512 - 0x200 |
| UPDATE | 768 - 0x300 |
| DELETE | 1024 - 0x400 |
| CREATE | 1280 - 0x500 |
| CREATE TABLE | 1281 - 0x501 |
| CREATE INDEX | 1282 - 0x502 |
| CREATE VIEW | 1283 - 0x503 |
| DROP | 1536 - 0x600 |
| DROP TABLE | 1537 - 0x601 |
| DROP INDEX | 1538 - 0x602 |
| DROP VIEW | 1539 - 0x603 |
| ALTER | 1792 - 0x700 |
| ALTER TABLE | 1793 - 0x701 |
| PREPARE | 2048 - 0x800 |
| EXECUTE | 2304 - 0x900 |
| BEGIN | 61440 - 0xF000 |
| COMMIT | 61696 - 0xF100 |
| ROLLBACK | 61952 - 0xF200 |
| FETCH | 62208 - 0xF300 |
| CLOSE | 62464 - 0xF400 |
| EMPTY | 62720 - 0xF500 |
### databasesystem | Name | Value | | — | —-| | DB2 (DRDA) | DRDA | | MongoDB | MongoDB | | MySQL / MariaDB | MySQL | | PostgreSQL | PostgreSQL | | Microsoft SQL Server / Sybase | TDS(msg) | | Oracle | TNS | | IBM Informix | Informix |
### dcerpc_flag | Name | Value | | — | —-| | DISPATCH_METHOD | 1 - 0x1 | | DISPATCH_PROPERTYGET | 2 - 0x2 | | DISPATCH_PROPERTYPUT | 4 - 0x4 | | DISPATCH_PROPERTYPUTREF | 8 - 0x8 | | DISPATCH_zeroVarResult | 131072 - 0x20000 | | DISPATCH_zeroExcepInfo | 262144 - 0x40000 | | DISPATCH_zeroArgErr | 524288 - 0x80000 |
### dcerpc_uuid This field does not allow any custom items.
| Name | Category | Value |
|---|---|---|
| Microsoft Distributed Component Object Model (DCOM) - IUnknown Interface | MS DCOM Services | 00000000-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IClassFactory Interface | MS DCOM Services | 00000001-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IBindCtx Interface | MS DCOM Services | 0000000e-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IEnumUnknown Interface | MS DCOM Services | 00000100-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IPersist Interface | MS DCOM Services | 0000010c-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IDataObject Interface | MS DCOM Services | 0000010e-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IID_IRemUnknown Interface | MS DCOM Services | 00000131-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - ILocalSystemActivator Interface | MS DCOM Services | 00000132-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IRunDown Interface | MS DCOM Services | 00000134-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IInterfaceFromWindowProp Interface | MS DCOM Services | 00000135-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - ISCMActivator Interface | MS DCOM Services | 00000136-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IDLLHost Interface | MS DCOM Services | 00000141-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IID_IRemUnknown2 Interface | MS DCOM Services | 00000143-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - ISystemActivator Interface | MS DCOM Services | 000001a0-0000-0000-c000-000000000046 |
| Microsoft OLE Automation Protocol - IDispatch Interface | MS OLE Automation | 00020400-0000-0000-c000-000000000046 |
| Microsoft OLE Automation Protocol - ITypeInfo Interface | MS OLE Automation | 00020401-0000-0000-c000-000000000046 |
| Microsoft OLE Automation Protocol - ITypeLib Interface | MS OLE Automation | 00020402-0000-0000-c000-000000000046 |
| Microsoft OLE Automation Protocol - ITypeComp Interface | MS OLE Automation | 00020403-0000-0000-c000-000000000046 |
| Microsoft OLE Automation Protocol - IEnumVARIANT Interface | MS OLE Automation | 00020404-0000-0000-c000-000000000046 |
| Microsoft OLE Automation Protocol - ITypeLib2 Interface | MS OLE Automation | 00020411-0000-0000-c000-000000000046 |
| Microsoft OLE Automation Protocol - ITypeInfo2 Interface | MS OLE Automation | 00020412-0000-0000-c000-000000000046 |
| Microsoft Explorer - Browser - IShellView Interface | MS Explorer Browser | 000214e3-0000-0000-c000-000000000046 |
| Microsoft Distributed Component Object Model (DCOM) - IShellFolder Interface | MS DCOM Services | 000214e6-0000-0000-c000-000000000046 |
| Microsoft Explorer - Browser - ICommDlgBrowser Interface | MS Explorer Browser | 000214f1-0000-0000-c000-000000000046 |
| Microsoft Update Agent Management Protocol - IWindowsDriverUpdate4 Interface | MS Update Agent | 004c6a2b-0c19-4c69-9f5c-a269b2560db9 |
| Microsoft iSCSI Software Target Management Protocol - IWTDiskMgr CLSID | MS ISTM iSCSI | 0144084b-e09e-4f45-a56b-dcdc9f379f5e |
| Microsoft iSCSI Software Target Management Protocol - IHostMgr3 Interface | MS ISTM iSCSI | 01454b97-c6a5-4685-bea8-9779c88ab990 |
| Microsoft Message Queuing - ActiveX Client - MSMQOutgoingQueueManagement | MS Message Queuing | 0188401c-247a-4fed-99c6-bf14119d7055 |
| Microsoft Message Queuing - ActiveX Client - IMSMQCollection Interface | MS Message Queuing | 0188ac2f-ecb3-4173-9779-635ca2039c72 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostPropertyCollection Interface | MS IIS | 0191775e-bcff-445a-b4f4-3bdda54e2816 |
| Microsoft Shadow Copy Management Protocol - IVssEnumMgmtObject interface | MS Volume Shadow Copy | 01954e6b-9254-4e6e-808c-c9e05d007696 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IEnumWbemClassObject Interface | MS WMI | 027947e1-d731-11ce-a357-000000000001 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsRemovable Interface | MS Virtual Disk | 0316560b-5db4-4ed9-bbb5-213436ddc0d9 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostElementSchemaCollection Interface | MS IIS | 0344cdda-151e-4cbf-82da-66ae61e97754 |
| Microsoft Telnet Server Remote Administration Protocol (MS-TSRAP) - IID_IManageTelnetSessions Interface | MS Telnet Server | 034634fd-ba3f-11d1-856a-00a0c944138c |
| Microsoft Performance Logs and Alerts Protocol - IDataCollector Interface | MS Perf Logs & Alerts | 038374ff-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IDataCollectorCollection Interface | MS Perf Logs & Alerts | 03837502-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IPerformanceCounterDataCollector Interface | MS Perf Logs & Alerts | 03837506-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - ITraceDataCollector Interface | MS Perf Logs & Alerts | 0383750b-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - ITraceDataProviderCollection Interface | MS Perf Logs & Alerts | 03837510-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - ITraceDataProvider Interface | MS Perf Logs & Alerts | 03837512-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IConfigurationDataCollector Interface | MS Perf Logs & Alerts | 03837514-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IAlertDataCollector Interface | MS Perf Logs & Alerts | 03837516-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IApiTracingDataCollector Interface | MS Perf Logs & Alerts | 0383751a-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IDataCollectorSet Interface | MS Perf Logs & Alerts | 03837520-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IDataCollectorSetCollection Interface | MS Perf Logs & Alerts | 03837524-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IValueMapItem Interface | MS Perf Logs & Alerts | 03837533-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IValueMap Interface | MS Perf Logs & Alerts | 03837534-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - Ischedule Interface | MS Perf Logs & Alerts | 0383753a-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IScheduleCollection Interface | MS Perf Logs & Alerts | 0383753d-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IDataManager Interface | MS Perf Logs & Alerts | 03837541-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IFolderAction Interface | MS Perf Logs & Alerts | 03837543-098b-11d8-9414-505054503030 |
| Microsoft Performance Logs and Alerts Protocol - IFolderActionCollection Interface | MS Perf Logs & Alerts | 03837544-098b-11d8-9414-505054503030 |
| Microsoft Universal Plug and Play (UPNP) - IUPnPHttpHeaderControl Interface | MS UPNP | 0405af4f-8b5c-447c-80f2-b75984a31f3c |
| Microsoft Distributed Component Object Model (DCOM) - ISearchRoot Interface | MS DCOM Services | 04c18ccf-1f57-4cbd-88cc-3900f5195ce3 |
| Microsoft Update Agent Management Protocol - IUpdateSearcher3 Interface | MS Update Agent | 04c6895d-eaf2-4034-97f3-311de9be413a |
| Microsoft Failover Cluster: Setup and Validation Protocol - ClusterSetup Interface | MS Failover Cluster | 04d55210-b6ac-4248-9e69-2a569d1d2ab6 |
| Microsoft Internet Information Server - Gopher Publishing Service | MS IIS | 04fcb220-fcfd-11cd-bec8-00aa0047ae4e |
| Microsoft Windows Security Center | MS Security | 06bba54a-be05-49f9-b0a0-30f790261023 |
| Microsoft Distributed Component Object Model (DCOM) - IWMPContentProviderFactory Interface | MS DCOM Services | 06e333e4-667e-466d-9e34-4a8d5e36e012 |
| Microsoft Exchange - System Attendant Service - Version 1.0 | MS Exchange | 06ed1d30-d3d3-11cd-b80e-00aa004b9c30 |
| Microsoft Remote Data Services (RDS) Transport Protocol (superseded by SOAP and DCOM) - IDataFactory2 Interface | MS Remote Data Services | 070669eb-b52f-11d1-9270-00c04fbbbfb3 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostConstantValue Interface | MS IIS | 0716caf8-7d05-4a46-8099-77594be91394 |
| Microsoft Program Compatibility Assistant Service - PcaSvc Interface | MS Misc Services | 0767a036-0d22-48aa-ba69-b619480f38cb |
| Microsoft File Server Resource Manager Protocol - IFsrmFileManagementJob Interface | MS File Server | 0770687e-9f36-4d6f-8778-599d188461c9 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsDisk Interface | MS Virtual Disk | 07e5c822-f00c-47a1-8fce-b244da56fd06 |
| Microsoft Update Agent Management Protocol - IUpdateCollection Interface | MS Update Agent | 07f7438c-7709-4ca5-b518-91279288134e |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsService Interface | MS Virtual Disk | 0818a8ef-9ba9-40d8-a6f9-e22833cc771e |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - IMessenger Interface | MS Removable Storage | 081e7188-c080-4ff3-9238-29f66d6cabfd |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostChildElementCollection Interface | MS IIS | 08a90f5f-0702-48d6-b45f-02a9885a9768 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostChangeHandler Interface | MS IIS | 09829352-87c2-418d-8d79-4133969a489d |
| Microsoft Scheduler Service - idletask operations | MS Scheduler | 0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsServiceHba Interface | MS Virtual Disk | 0ac13689-3134-47c6-a17c-4669216801be |
| Microsoft Portmapper Service - localepmp Interface | MS Portmapper | 0b0a6584-9e0f-11cf-a3cf-00805f68cb1b |
| Microsoft Remote Authorization API Protocol (MS-RAA) - authzr Interface | MS Security | 0b1c2170-5732-4e0e-8cd3-d9b16f3b84d7 |
| Microsoft Print System Asynchronous Notification Protocol (MS-PAN) - IRPCAsyncNotify Interface | MS Print | 0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 |
| Microsoft Update Agent Management Protocol - IUpdateServiceManager2 Interface | MS Update Agent | 0bb8531d-7e8d-424f-986c-a0b8f60a3e7b |
| Microsoft Update Agent Management Protocol - IWindowsDriverUpdateEntryCollection Interface | MS Update Agent | 0d521700-a372-4bef-828b-3d00c10adebd |
| Microsoft Cryptographic Services - ICertProtect | MS Crypto | 0d72a7d4-6148-11d1-b4aa-00c04fb66ea0 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostSectionGroup Interface | MS IIS | 0dd8a158-ebe6-4008-a1d9-b7ecc8f1104b |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - ICatalogTableRead Interface | MS COM+ Remote Admin | 0e3d6630-b46b-11d1-9d2d-006008b0e5ca |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - ICatalogTableWrite Interface | MS COM+ Remote Admin | 0e3d6631-b46b-11d1-9d2d-006008b0e5ca |
| Microsoft Exchange - Information Store - exchange_store_information Interface | MS Exchange | 0e4a0156-dd5d-11d2-8c2f-00c04fb6bcde |
| Microsoft Remote Data Services (RDS) Transport Protocol (superseded by SOAP and DCOM) - IDataFactory Interface | MS Remote Data Services | 0eac4842-8763-11cf-a743-00aa00a3f00d |
| Microsoft Distributed Transaction Coordinator (DTC) - ITransaction Interface | MS DTC | 0fb15084-af41-11ce-bd2b-204c4f4f5020 |
| Microsoft iSCSI Software Target Management Protocol - IEnumLMMountPoint Interface | MS ISTM iSCSI | 100da538-3f4a-45ab-b852-709148152789 |
| Microsoft Explorer - Browser - ICommDlgBrowser2 Interface | MS Explorer Browser | 10339516-2894-11d2-9039-00c04f8eeb3e |
| Microsoft Message Queuing - Queue Manager to Queue Manager Protocol - qm2qm Interface | MS Message Queuing | 1088a980-eae5-11d0-8d9b-00a02453c337 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsProviderInterface | MS Virtual Disk | 10c5e575-7984-4e81-a56b-431f5f92ae42 |
| SoftICE DriverStudio Remote Control - winice.dat | SI DriverStudio RC | 10d1800c-af75-4249-b7a2-484dec69ed3a |
| Microsoft Exchange - Information Store - Function I | MS Exchange | 10f24e8e-0fa6-11d2-a910-00c04f990f3b |
| Microsoft Protected Storage Service | MS Storage | 11220835-5b26-4d94-ae86-c3e475a809de |
| Microsoft Trusted Platform Module Virtual Smart Card Management Protocol - ITpmVirtualSmartCardManager Interface | MS TPM Smart Card Mgt | 112b1dff-d9dc-41f7-869f-d67fee7cb591 |
| Microsoft Update Agent Management Protocol - IUpdate3 Interface | MS Update Agent | 112eda6b-95b3-476f-9d90-aee82c6b8181 |
| Microsoft Virtual Disk Service (VDS) Protocol - IEnumVdsObject Interface | MS Virtual Disk | 118610b7-8d94-4030-b5b8-500889788e4e |
| Microsoft Terminal Server Services - Runtime Interface - LSM Notification Interface | MS Terminal Server | 11899a43-2b68-4a76-92e3-a3d6ad8c26ce |
| Microsoft Failover Cluster: Setup and Validation Protocol - IClusterStorage3 Interface | MS Failover Cluster | 11942d87-a1de-4e7f-83fb-a840d9c5928d |
| Microsoft Terminal Server Services - LSMAPI - TermSrvPrivate Interface | MS Terminal Server | 11f25515-c879-400a-989e-b074d5f092fe |
| Microsoft Failover Cluster: Setup and Validation Protocol - IClusterStorage2 Interface | MS Failover Cluster | 12108a88-6858-4467-b92f-e6cf4568dfb6 |
| Microsoft Print System Remote Protocol (MS-RPRN) - Winspool Interface or IPSec Policy Agent Endpoint | MS Indeterminate | 12345678-1234-abcd-ef00-0123456789ab |
| Microsoft Netlogon Remote Protocol (MS-NRPC) - Netlogon Interface | MS Security | 12345678-1234-abcd-ef00-01234567cffb |
| Microsoft Local Security Authority Remote Protocol - lsarpc Interface | MS Security | 12345778-1234-abcd-ef00-0123456789ab |
| Microsoft Security Account Manager (SAMR) - samr Interface | MS Security | 12345778-1234-abcd-ef00-0123456789ac |
| Microsoft Terminal Server Services - SessEnvPublicRpc Interface | MS Terminal Server | 1257b580-ce2f-4109-82d6-a9459d0bf6bc |
| Microsoft File Server Resource Manager Protocol - IFsrmActionCommand Interface | MS File Server | 12937789-e247-4917-9c20-f3ee9c7ee783 |
| Microsoft PSFactoryBuffer Interface | MS Svchost | 1299cf18-c4f5-4b6a-bb0f-2299f0398e27 |
| Microsoft Message Queuing - ActiveX Client - IMSMQApplication2 Interface | MS Message Queuing | 12a30900-7300-11d2-b0e6-00e02c074f6b |
| Microsoft Secondary Logon Service | MS Security | 12b81e99-f207-4a4c-85d3-77b42f76fd14 |
| Microsoft Secure Desktop LRPC interface | MS Secure Desktop | 12e65dd8-887f-41ef-91bf-8d816c42c2e7 |
| Microsoft Intersite Messaging Service - ismserv_ip | MS Intersite Messaging | 130ceefb-e466-11d1-b78b-00c04fa32883 |
| Microsoft Disk Management Remote Protocol - IVolumeClient3 Interface | MS Disk Management | 135698d2-3a37-4d26-99df-e2bb6ae3ac61 |
| Microsoft iSCSI Software Target Management Protocol - IEnumWTDiskLunMapping Interface | MS ISTM iSCSI | 1396de6f-a794-4b11-b93f-6b69a5b47bae |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsPack2 Interface | MS Virtual Disk | 13b50bff-290a-47dd-8558-b7c58db1a71a |
| Microsoft Update Agent Management Protocol - IUpdate2 Interface | MS Update Agent | 144fe9b0-d23d-4a8b-8634-fb4457533b7a |
| Microsoft Exchange - Information Store - Function II | MS Exchange | 1453c42c-0fa6-11d2-a910-00c04f990f3b |
| Microsoft ExtendedError Remote Data Structure (MS-EERR) - ExtendedError Interface | MS EERR | 14a8831c-bc82-11d2-8a64-0008c7457e5d |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsServiceIscsi Interface | MS Virtual Disk | 14fbe036-3ed7-4e10-90e9-a5ff991aff01 |
| Microsoft Update Agent Management Protocol - IUpdateService2 Interface | MS Update Agent | 1518b460-6518-4172-940f-c75883b24ceb |
| Microsoft Exchange Directory Referral (Request For Response - RFR) - exchange_ds_rfr Interface | MS Exchange | 1544f5e0-613c-11d1-93df-00c04fd7bd09 |
| Microsoft File Server Resource Manager Protocol - IFsrmQuotaBase Interface | MS File Server | 1568a795-3924-4118-b74b-68d8f0fa5daf |
| Microsoft File Server Resource Manager Protocol - IFsrmStorageModuleDefinition Interface | MS File Server | 15a81350-497d-4aba-80e9-d4dbcc5521fe |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsServiceSw Interface | MS Virtual Disk | 15fc031c-0652-4306-b2c3-f558b8f837e2 |
| Microsoft Active Directory Backup and Restore Services - JetRest Interface | MS Active Directory | 16e0cf3a-a604-11d0-96b1-00a0c91ece30 |
| Microsoft Messenger Service Remote Protocol - msgsvc operations for name management methods | MS Messenger | 17fdd703-1827-4e34-79d4-24a55c53bb37 |
| Microsoft iSCSI Software Target Management Protocol - IWTDisk3 Interface | MS ISTM iSCSI | 1822a95e-1c2b-4d02-ab25-cc116dd9dbde |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - ICatalogSession Interface | MS COM+ Remote Admin | 182c40fa-32e4-11d0-818b-00a0c9231c29 |
| Microsoft Distributed Component Object Model (DCOM) - Interface | MS DCOM Services | 18f70770-8e64-11cf-9af1-0020af6e72f4 |
| Microsoft iSCSI Software Target Management Protocol - IEnumPortal Interface | MS ISTM iSCSI | 1995785d-2a1e-492f-8923-e621eaca39d9 |
| Microsoft Exchange - Database Service | MS Exchange | 1a190310-bb9c-11cd-90f8-00aa00466520 |
| Microsoft Trusted Platform Module Virtual Smart Card Management Protocol - ITpmVirtualSmartCardManagerStatusCallback Interface | MS TPM Smart Card Mgt | 1a1bb35f-abb8-451c-a1ae-33d98f1bef4a |
| Microsoft Internet Security and Acceleration (ISA) - Management Console | MS ISA | 1a77dcb2-97b3-4ffb-9ee7-8f42529841ab |
| Microsoft Message Queuing - Queue Manager Remote Read Protocol - RemoteRead Interface | MS Message Queuing | 1a9134dd-7b39-45ba-ad88-44d01ca47f28 |
| Microsoft Windows Deployment Services Control Protocol (MS-WDSC) - WdsRpcInterface Interface | MS Deployment Services | 1a927394-352e-4553-ae3f-7cf4aafca620 |
| Microsoft Routing and Remote Access Service | MS Remote Access | 1aa7f844-c7f5-11d0-a376-00c04fc9da04 |
| Microsoft Explorer - Browser - IFolderView2 Interface | MS Explorer Browser | 1af3a467-214f-4298-908e-06b03e0b39f9 |
| Microsoft iSCSI Software Target Management Protocol - ISnsMgr Interface | MS ISTM iSCSI | 1b1c4d1c-abc4-4d3a-8c22-547fba3aa8a0 |
| Microsoft File Server Resource Manager Protocol - IFsrmMutableCollection Interface | MS File Server | 1bb617b8-3886-49dc-af82-a6c90fa35dda |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVolumeOnline Interface | MS Virtual Disk | 1be2275a-b315-4f70-9e44-879b3a2a53f2 |
| Microsoft Windows Management Instrumentation (WMI) - WBEM providers - IWbemProviderInitSink Interface | MS WMI | 1be41571-91dd-11d1-aeb2-00c04fb68820 |
| Microsoft Windows Management Instrumentation (WMI) - WBEM providers - IWbemProviderInit Interface | MS WMI | 1be41572-91dd-11d1-aeb2-00c04fb68820 |
| Microsoft Internet Information Services (IIS) - POP3 - Service | MS IIS | 1be617c0-31a5-11cf-a7d8-00805f48a135 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemFetchSmartEnum Interface | MS WMI | 1c1c45ee-4395-11d2-b60b-00104b703efd |
| Microsoft Active Directory DSROLE Service | MS Active Directory | 1cbcad78-df0b-4934-b558-87839ea501c9 |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - ICatalog64BitSupport Interface | MS COM+ Remote Admin | 1d118904-94b3-4a64-9fa6-ed432666a7b9 |
| Microsoft Debugging Helper Service | MS Debugging | 1d55b526-c137-46c5-ab79-638f2a68e869 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVDisk Interface | MS Virtual Disk | 1e062b84-e5e6-4b4b-8a25-67b81e8f13e8 |
| Microsoft Terminal Server Services - LSMAPI - TermSrvAdmin Interface | MS Terminal Server | 1e665584-40fe-4450-8f6e-802362399694 |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IImport2 Interface | MS COM+ Remote Admin | 1f7b1697-ecb2-4cbb-8a0e-75c427f4a6f0 |
| Microsoft Task Scheduler Service Remote Protocol - ATSvc | MS Scheduler | 1ff70682-0a51-30e8-076d-740be8cee98b |
| Microsoft Distributed Component Object Model (DCOM) - AppInfo Interface | MS DCOM Services | 201ef99a-7fa0-444c-9399-19ba84f12a1a |
| Microsoft File Server Resource Manager Protocol - IFsrmFileScreenTemplate Interface | MS File Server | 205bebf8-dd93-452a-95a6-32b566b35828 |
| Microsoft Routing and Remote Access Service (RRAS) Management Protocol - rasrpc Interface | MS Remote Access | 20610036-fa22-11cf-9823-00a0c911e5df |
| Microsoft DFS Replication Helper Protocol - IServerHealthReport2 Interface | MS DFS Replication | 20d15747-6c48-4254-a358-65039fd8c63c |
| Microsoft Shadow Copy Management Protocol - IVssDifferentialSoftwareSnapshotMgmt Interface | MS Volume Shadow Copy | 214a0f28-b737-4026-b847-4f9e37d79529 |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IWRMConfig Interface | MS System Resource | 21546ae8-4da5-445e-987f-627fea39c5e8 |
| Microsoft Unified Background Process Manager - ubpmtaskhostchannel Interface | MS UBPM | 22716894-fd8e-4462-9783-09e6d9531f16 |
| Microsoft Internet Information Services (IIS) - Application Host COM - AppHostAdminManager | MS IIS | 228fb8f7-fb53-4fd5-8c7b-ff59de606c5b |
| Microsoft File Server Resource Manager Protocol - IFsrmObject Interface | MS File Server | 22bcef93-4a3f-4183-89f9-2f8b8a628aee |
| Microsoft Network Profile Service - INotifyNetworkEvents Interface | MS Network Profile | 22d2e146-1a68-40b8-949c-8fd848b415e6 |
| Microsoft Update Agent Management Protocol - IUpdateServiceManager Interface | MS Update Agent | 23857e3c-02ba-44a3-9423-b1c900805f37 |
| Microsoft Component Object Model Plus (COM+) Tracker Service Protocol - IProcessDump Interface | MS COM+ Tracker | 23c9dd26-2355-4fe2-84de-f779a238adbd |
| Microsoft Internet Information Services (IIS) - IMAP4 Service | MS IIS | 2465e9e0-a873-11d0-930b-00a0c90ab17c |
| Microsoft iSCSI Software Target Management Protocol - ISnsMgr CLSID | MS ISTM iSCSI | 24f9c1a9-b22e-4e24-bec9-4af0a4d96736 |
| Trend Micro ServerProtect | TM SRVPROTECT | 25288888-bd5b-11d1-9d53-0080c83a5c2c |
| Microsoft Network Profile Service - IEnumNetwork Interface | MS Network Profile | 26656eaa-54eb-4e6f-8f85-4f0ef901a406 |
| Microsoft File Server Resource Manager Protocol - IFsrmReportManager Interface | MS File Server | 27b899fe-6ffa-4481-a184-d3daade8a02b |
| Microsoft Update Agent Management Protocol - IUpdate4 Interface | MS Update Agent | 27e94b0d-5139-49a2-9a61-93522dc54652 |
| Microsoft iSCSI Software Target Management Protocol - IDirectoryEnum Interface | MS ISTM iSCSI | 28bc8d5e-ca4b-4f54-973c-ed9622d2b3ac |
| Microsoft Failover Cluster: Setup and Validation Protocol - IClusterNetwork2 Interface | MS Failover Cluster | 2931c32c-f731-4c56-9feb-3d5f1c5e72bf |
| Microsoft Internet Information Services (IIS) - IMSAdminBaseW - IWamAdmin Interface | MS IIS | 29822ab7-f302-11d0-9953-00c04fd919c1 |
| Microsoft Internet Information Services (IIS) - IMSAdminBaseW - IWamAdmin2 Interface | MS IIS | 29822ab8-f302-11d0-9953-00c04fd919c1 |
| Microsoft Network Profile Service - INetworkInterface Interface | MS Network Profile | 2a1c9eb2-df62-4154-b800-63278fcb8037 |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IResourceManager2 Interface | MS System Resource | 2a3eb639-d134-422d-90d8-aaa1b5216202 |
| Microsoft Network Profile Service - INotifyNetworkInterfaceEvents Interface | MS Network Profile | 2abc0864-9677-42e5-882a-d415c556c284 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsHbaPort Interface | MS Virtual Disk | 2abd757f-2851-4997-9a13-47d2a885d6ca |
| Microsoft Internet Information Services (IIS) - Application Host COM - AppHostWritableAdminManager | MS IIS | 2b72133b-3f5b-4602-8952-803546ce3344 |
| Microsoft Distributed Transaction Coordinator (DTC) - WinRM Interface | MS DTC | 2b7ee790-e8c8-4820-97db-cdff70129887 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemRefreshingServices Interface | MS WMI | 2c9273e0-1dc3-11d3-b364-00105a1f8177 |
| Microsoft Message Queuing - ActiveX Client - IMSMQTransaction2 Interface | MS Message Queuing | 2ce0c5b0-6e67-11d2-b0e6-00e02c074f6b |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostMethodSchema Interface | MS IIS | 2d9915fb-9d42-4328-b782-1b46819fab9e |
| Microsoft File Server Resource Manager Protocol - IFsrmActionReport Interface | MS File Server | 2dbe63c4-b340-48a0-a5b0-158e07fc567e |
| Microsoft Group Policy Client Service - IGroupPolicyUtilities Interface | MS Security | 2eb08e3e-639f-4fba-97b1-14f878961076 |
| Microsoft Update Agent Management Protocol - IAutomaticUpdatesSettings Interface | MS Update Agent | 2ee48f22-af3c-405f-8970-f71be12ee9a2 |
| Microsoft Terminal Server Services - Licensing - LCRPC Operations | MS Terminal Server | 2f59a331-bf7d-48cb-9ec5-7c090d76e8b8 |
| Microsoft Network Dynamic Data Exchange Service - nddeapi | MS Network DDE | 2f5f3220-c126-1076-b549-074d078619da |
| Microsoft Telephony Remote Protocol - tapsrv Interface | MS Telephony | 2f5f6520-ca46-1067-b319-00dd010662da |
| Microsoft Telephony Remote Protocol - remotesp Interface | MS Telephony | 2f5f6521-ca47-1068-b319-00dd010662db |
| Microsoft Unimodem LRPC Endpoint | MS Telephony | 2f5f6521-cb55-1059-b446-00df0bce31db |
| Microsoft Windows Firewall - FwRpc Interface | MS Security | 2fb92682-6599-42dc-ae13-bd2ca89bd11c |
| Microsoft Distributed Link Tracking - Workstation Protocol | MS DLT | 300f3532-38cc-11d0-a3f0-0020af6b0add |
| Microsoft Name Resolution Proxy (NRP) RPC interface - NRP Server Endpoint - NameResolutionProxy Interface | MS Name Resolution Proxy | 30adc50c-5cbc-46ce-9a0e-91914789e23c |
| Microsoft iSCSI Software Target Management Protocol - IStatusNotify Interface | MS ISTM iSCSI | 312cc019-d5cd-4ca7-8c10-9e0a661f147e |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostMappingExtension Interface | MS IIS | 31a83ea0-c0e4-4a2c-8a01-353cc2a4c60a |
| Microsoft WinLogon - Profile Mapper | MS Security | 326731e3-c1c0-4a69-ae20-7d9044a4ea5c |
| Microsoft File Server Resource Manager Protocol - IFsrmPropertyCondition Interface | MS File Server | 326af66f-2ac0-4f68-bf8c-4759f054fa29 |
| SoftICE DriverStudio Remote Control | SI DriverStudio RC | 32d90706-b698-4029-b236-e18ebff582b1 |
| Microsoft Unified Background Process Manager - ubpmrpc Interface | MS UBPM | 33511f95-5b84-4dcc-b6cc-3f4b21da53e1 |
| Microsoft Remote Registry Protocol / Microsoft Remote Shutdown Protocol - WinReg Interface | MS Remote Services | 338cd001-2244-31f1-aaaa-900038001003 |
| Microsoft Message Queuing - ActiveX Client - MSMQQueueManagement | MS Message Queuing | 33b6d07e-f27d-42fa-b2d7-bf82e11e9374 |
| Microsoft Windows Management Instrumentation (WMI) - Offline Files Provider - IOfflineFilesEventsFilter Interface | MS WMI | 33fc4e1b-0716-40fa-ba65-6e62a84a846f |
| Microsoft Licensing Logging Service - llsrpc Interface | MS Security | 342cfd40-3c6c-11ce-a893-08002b2e9c6d |
| Microsoft iSCSI Software Target Management Protocol - IEnumIDMethod Interface | MS ISTM iSCSI | 345b026b-5802-4e38-ac75-795e08b0b83f |
| Microsoft WinHttp Auto-Proxy Service | MS WinHttp Auto-Proxy | 3473dd4d-2e88-4006-9cba-22570909dd10 |
| Microsoft iSCSI Software Target Management Protocol - IWTDisk2 Interface | MS ISTM iSCSI | 348a0821-69bb-4889-a101-6a9bde6fa720 |
| Microsoft Explorer - Browser - IExplorerBrowserEvents Interface | MS Explorer Browser | 361bbdc7-e6ee-4e13-be58-58e2240c810f |
| Microsoft Service Control Manager Remote Protocol (MS-SCMR) - svcctl Interface | MS SCM | 367abb81-9844-35f1-ad32-98f038001003 |
| Microsoft WinLogin - Profile Mapper | MS Security | 369ce4f0-0fdc-11d3-bde8-00c04f8eee78 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostConfigLocation Interface | MS IIS | 370af178-7758-4dad-8146-7391f6e18585 |
| Microsoft File Server Resource Manager Protocol - IFsrmQuota Interface | MS File Server | 377f739d-9647-4b8e-97d2-5ffce6d759cd |
| Microsoft Task Scheduler Service Remote Protocol - SASec | MS Scheduler | 378e52b0-c0a9-11cf-822d-00aa0051e40f |
| Microsoft Exchange - Undocumented Interface 2 | MS Exchange | 37fc1b02-da36-4b27-a745-bf2f58a98ff6 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsAdvancedDisk3 Interface | MS Virtual Disk | 3858c0d5-0f35-4bf5-9714-69874963bc36 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsIscsiInitiatorPortal | MS Virtual Disk | 38a0a9ab-7cc8-4693-ac07-1f28bd03c3da |
| Microsoft Exchange - Message Transfer Agent (MTA) Service - exchange_mta_qadmin Interface | MS Exchange | 38a94e72-a9bc-11d2-8faf-00c04fa378ff |
| Microsoft File Server Resource Manager Protocol - IFsrmReportJob Interface | MS File Server | 38e87280-715c-4c7d-a280-ea1651a19fef |
| Microsoft Directory Services Setup Remote Protocol (MS-DSSP) | MS Active Directory | 3919286a-b10c-11d0-9ba8-00c04fd92ef5 |
| Microsoft File Server Resource Manager Protocol - IFsrmDerivedObjectsResult Interface | MS File Server | 39322a2d-38ee-4d0d-8095-421a80849a82 |
| Microsoft Message Queuing - ActiveX Client - MSMQManagement | MS Message Queuing | 39ce96fe-f4c5-4484-a143-4c2d5d324229 |
| Microsoft Disk Management Remote Protocol - IDMRemoteServer Interface | MS Disk Management | 3a410f21-553f-11d1-8e5e-00a0c92c9d5d |
| Microsoft Update Agent Management Protocol - ICategoryCollection Interface | MS Update Agent | 3a56bfb8-576c-43f7-9335-fe4838fd7e37 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsPack Interface | MS Virtual Disk | 3b69d7f5-9d94-4648-91ca-79939ba263bf |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - INtmsObjectManagement3 Interface | MS Removable Storage | 3bbed8d9-2c9a-4b21-8936-acb2f995be6c |
| Microsoft DHCP Client Service | MS DHCP | 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 |
| Microsoft DHCPv6 Client Service | MS DHCP | 3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 |
| Microsoft iSCSI Software Target Management Protocol - IWTGeneral2 Interface | MS ISTM iSCSI | 3c73848a-a679-40c5-b101-c963e67f9949 |
| Microsoft Trusted Platform Module Virtual Smart Card Management Protocol - ITpmVirtualSmartCardManager3 Interface | MS TPM Smart Card Mgt | 3c745a97-f375-4150-be17-5950f694c699 |
| Microsoft Exchange - Recipient Update Service Interface | MS Exchange | 3cb4be69-9ba1-448c-9a44-a1f759a1878a |
| Microsoft Failover Cluster: Setup and Validation Protocol - ClusterFirewall Interface | MS Failover Cluster | 3cfee98c-fb4b-44c6-bd98-a1db14abca3f |
| Microsoft Terminal Server Services - Licensing | MS Terminal Server | 3d267954-eeb7-11d1-b94e-00c04fa3080d |
| Computer Associates - Antivirus / e-Trust Antivirus / Threat Manager | CA AntiVir | 3d742890-397c-11cf-9bf1-00805f88cb72 |
| Microsoft OLE Container - IAsyncOperation / IDataObjectAsyncCapability Interface | MS OLE Container | 3d8b0590-f691-11d2-8ea9-006097df5bd4 |
| Microsoft Protected Storage Service - BackupKey Remote Protocol - BackupKey Interface | MS Storage | 3dde7c30-165d-11d1-ab8f-00805f14db40 |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IContainerControl Interface | MS COM+ Remote Admin | 3f3b1b86-dbbe-11d1-9da6-00805f85cfe3 |
| Microsoft SQL Server RPC | MS SQL Server | 3f99b900-4d87-101b-99b7-aa0004007f07 |
| Microsoft Windows Audio Service - Audio Server | MS Audio | 3faf4738-3a21-4307-b46c-fdda9bb8c0d5 |
| Microsoft iSCSI Software Target Management Protocol - IEnumSession Interface | MS ISTM iSCSI | 40cc8569-6d23-4005-9958-e37f08ae192b |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsDisk2 Interface | MS Virtual Disk | 40f73c8b-687d-4a13-8d96-3d7f2e683936 |
| Microsoft Message Queuing - Queue Manager Management Protocol - qmmgmt Interface | MS Message Queuing | 41208ee0-e970-11d1-9b9e-00e02c064c39 |
| Microsoft Service Control Manager - ISCM | MS SCM | 412f241e-c12a-11ce-abff-0020af6e7a17 |
| Microsoft Failover Cluster: Setup and Validation Protocol - ClusterUpdate Interface | MS Failover Cluster | 4142dd5d-3472-4370-8641-de7856431fb0 |
| Microsoft File Server Resource Manager Protocol - IFsrmQuotaTemplateManager Interface | MS File Server | 4173ac41-172d-4d52-963c-fdc7e415f717 |
| Microsoft Exchange - Server | MS Exchange | 41f5fae1-e0ac-414c-a721-0d287466cb23 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemWCOSmartEnum Interface | MS WMI | 423ec01e-2e35-11d2-b604-00104b703efd |
| Microsoft File Server Resource Manager Protocol - IFsrmFileGroupManager Interface | MS File Server | 426677d5-018c-485c-8a51-20b86d00bdc4 |
| Microsoft File Server Resource Manager Protocol - IFsrmQuotaObject Interface | MS File Server | 42dc3511-61d5-48ae-b6dc-59fc00c0a8d6 |
| Microsoft iSCSI Software Target Management Protocol - IEnumSession2 Interface | MS ISTM iSCSI | 442931d5-e522-4e64-a181-74e98a4e1748 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemContext Interface | MS WMI | 44aca674-e8fc-11d0-a07c-00c04fb68820 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemCallResult Interface | MS WMI | 44aca675-e8fc-11d0-a07c-00c04fb68820 |
| Microsoft Terminal Server Services - Gateway Server Protocol - TsProxyRpcInterface Interface | MS Terminal Server | 44e265dd-7daf-42cd-8560-3cdb6e7a2729 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostPropertySchema | MS IIS | 450386db-7409-4667-935e-384dbbee2a9e |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - ICatalogUtils Interface | MS COM+ Remote Admin | 456129e2-1078-11d2-b0f9-00805fc73204 |
| Microsoft DNS Client Service - Windows XP and above - DnsResolver | MS DNS | 45776b01-5956-4485-9f80-f428f7d60129 |
| Microsoft Remote Administrative Interface: WINS protocol - winsif Interface | MS WINS | 45f52c28-7f9f-101a-b52b-08002b2efabe |
| Microsoft Update Agent Management Protocol - IUpdateIdentity Interface | MS Update Agent | 46297823-9940-4c09-aed9-cd3ea6d05968 |
| Microsoft Remote Data Services (RDS) Transport Protocol (superseded by SOAP and DCOM) - IDataFactory3 Interface | MS Remote Data Services | 4639db2a-bfc5-11d2-9318-00c04fbbbfb3 |
| Microsoft Exchange - System Attendant Service - Version 16.0 | MS Exchange | 469d6ec0-0d87-11ce-b13f-00aa003bac6c |
| Microsoft File Server Resource Manager Protocol - IFsrmPropertyDefinition2 Interface | MS File Server | 47782152-d16c-4229-b4e1-0ddfe308b9f6 |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - ICapabilitySupport Interface | MS COM+ Remote Admin | 47cde9a1-0bf6-11d2-8016-00c04fb9988e |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IWRMCalendar Interface | MS System Resource | 481e06cf-ab04-4498-8ffe-124a0a34296d |
| Microsoft Winlogon - IProfileDialog | MS Security | 4825ea41-51e3-4c2a-8406-8f2d2698395f |
| Microsoft File Server Resource Manager Protocol - IFsrmQuotaManagerEx Interface | MS File Server | 4846cb01-d430-494f-abb4-b1054999fb09 |
| Microsoft Terminal Server Services - Runtime Interface - LSM Session Interface | MS Terminal Server | 484809d6-4239-471b-b5bc-61df8c23ac48 |
| Microsoft Failover Cluster: Setup and Validation Protocol - IClusterSetup Interface | MS Failover Cluster | 491260b5-05c9-40d9-b7f2-1f7bdae0927f |
| Microsoft Terminal Server Services - Runtime Interface - TermSrv Listener Interface | MS Terminal Server | 497d95a6-2d27-4bf5-9bbd-a6046957133c |
| Microsoft Update Agent Management Protocol - IWindowsDriverUpdate3 Interface | MS Update Agent | 49ebd502-4a96-41bd-9e3e-4c5057f4250c |
| Microsoft Update Agent Management Protocol - IAutomaticUpdates2 Interface | MS Update Agent | 4a2f5c31-cfd9-410e-b7fb-29a653973a0f |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventSubscription Interface | MS COM+ Event System | 4a6b0e15-2e38-11d1-9965-00c04fbbb345 |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventSubscription2 Interface | MS COM+ Event System | 4a6b0e16-2e38-11d1-9965-00c04fbbb345 |
| Microsoft File Server Resource Manager Protocol - IFsrmProperty Interface | MS File Server | 4a73fee4-4102-4fcc-9ffb-38614f9ee768 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsServiceInitialization Interface | MS Virtual Disk | 4afc3636-db01-4052-80c3-03bbcb8d3c69 |
| Microsoft Simple Service Discovery Protocol (SSDP) Service - ssdpsrv Interface | MS SSDP | 4b112204-0e19-11d3-b42b-0000f81feb9f |
| Microsoft Server Service Remote Protocol (MS-SRVS) - srvsvc Interface | MS Sharing | 4b324fc8-1670-01d3-1278-5a47bf6ee188 |
| Microsoft DFS Replication Helper Protocol - IADProxy Interface | MS DFS Replication | 4bb8ab1d-9ef9-4100-8eb6-dd4b4e418b72 |
| Microsoft Disk Management Remote Protocol - IVolumeClient2 Interface | MS Disk Management | 4bdafc52-fe6a-11d2-93f8-00105a11164a |
| Microsoft File Server Resource Manager Protocol - IFsrmActionEventLog Interface | MS File Server | 4c8f96c3-5d94-4f37-a4f4-f56ab463546f |
| Microsoft Update Agent Management Protocol - IUpdateSearcher2 Interface | MS Update Agent | 4cbdcb2d-1589-4beb-bd1c-3e582ff0add0 |
| Microsoft Distributed Component Object Model (DCOM) - Remote Activation | MS DCOM Services | 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 |
| Microsoft Distributed Link Tracking - Central Manager Protocol | MS DLT | 4da1c422-943d-11d1-acae-00c04fc2aa3f |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVolumePlex Interface | MS Virtual Disk | 4daa0135-e1d1-40f1-aaa5-3cc1e53221c3 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVolumeMF2 Interface | MS Virtual Disk | 4dbcee9a-6343-4651-b85f-5e75d74d983c |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostConfigException Interface | MS IIS | 4dfa1df3-8900-4bc7-bbb5-d1a458c52410 |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventSystem Interface | MS COM+ Event System | 4e14fb9f-2e22-11d1-9964-00c04fbbb345 |
| Microsoft iSCSI Software Target Management Protocol - ISnapshotMgr Interface | MS ISTM iSCSI | 4e65a71e-4ede-4886-be67-3c90a08d1f29 |
| Microsoft Component Object Model Plus (COM+) Tracker Service Protocol - IComTrackingInfoEvents Interface | MS COM+ Tracker | 4e6cdcc9-fb25-4fd5-9cc5-c9f4b6559cec |
| Microsoft iSCSI Software Target Management Protocol - ISnapshotMgr CLSID | MS ISTM iSCSI | 4e7645fa-1a95-416c-b38f-ad574a3c3e57 |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - INtmsLibraryControl1 Interface | MS Removable Storage | 4e934f30-341a-11d1-8fb1-00a024cb6019 |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IWRMAccounting Interface | MS System Resource | 4f7ca01c-a9e5-45b6-b142-2332a1339c1d |
| Microsoft Internet Information Services (IIS) - NNTP Service | MS IIS | 4f82f460-0e21-11cf-909e-00805f48a135 |
| Microsoft Distributed File System (DFS) - netdfs Interface | MS DFS | 4fc742e0-4a10-11cf-8273-00aa004ae673 |
| Microsoft Update Agent Management Protocol - IUpdateExceptionCollection : IDispatch Interface | MS Update Agent | 503626a3-8e14-4729-9355-0fe664bd2321 |
| Computer Associates BrightStor - Message Engine [Vulnerability 1] | CA BrightStor | 506b1890-14c8-11d1-bbc3-00805fa6962e |
| Microsoft Windows DNS Server | MS DNS | 50abc2a4-574d-40b3-9d66-ee4fd5fba076 |
| Microsoft File Server Resource Manager Protocol - IFsrmPipelineModuleDefinition Interface | MS File Server | 515c1277-2c81-440e-8fcf-367921ed4f59 |
| Microsoft Key Management Server (KMS) - RequestActivation Interface | MS Security | 51c82175-844e-4750-b0d8-ec255555bc06 |
| Microsoft Exchange - Store Service AsyncEMSMDB Interface | MS Exchange | 5261574a-4572-206e-b268-6b199213b4e4 |
| Microsoft iSCSI Software Target Management Protocol - IWTDiskMgr Interface | MS ISTM iSCSI | 52ba97e7-9364-4134-b9cb-f8415213bdd8 |
| Microsoft Server Cluster - Configuration Protocol (MC-CCFG) - IClusCfgAsyncEvictCleanup Interface | MS Server Cluster | 52c80b95-c1ad-4240-8d89-72e9fa84025e |
| Microsoft Exchange - Undocumented Interface 4 | MS Exchange | 52d3f3f5-248c-4d74-a01f-a06e41d5cd59 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsDiskPartitionMF Interface | MS Virtual Disk | 538684e0-ba3d-4bc0-aca9-164aff85c2a9 |
| Microsoft Terminal Server Services - Runtime Interface - TSVIPPublic Interface | MS Terminal Server | 53b46b02-c73b-4a3e-8dee-b16b80672fc0 |
| Microsoft Internet Information Services (IIS) - WWW Publishing Service | MS IIS | 53e75790-d96b-11cd-ba18-08002b2dfead |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemLoginHelper Interface | MS WMI | 541679ab-2e5f-11d3-b34e-00104bcc4b4a |
| Microsoft Windows Client Certificate Enrollment Protocol (MS-WCCE) - ICertRequestD2 - Interface | MS Security | 5422fd3a-d4b8-4cef-a12e-e87d4ca22e90 |
| Microsoft Update Agent Management Protocol - IUpdateDownloadContent | MS Update Agent | 54a2cb2d-9a0c-48b6-8a50-9abb69ee2d02 |
| Microsoft iSCSI Software Target Management Protocol - IEnumWTDisk Interface | MS ISTM iSCSI | 56e65ea5-cdff-4391-ba76-006e42c2d746 |
| Microsoft Licensing Logging Service - lls_license Interface | MS Security | 57674cd0-5200-11ce-a897-08002b2e9c6d |
| Microsoft iSCSI Software Target Management Protocol - IWTDiskMgr2 Interface | MS ISTM iSCSI | 592381e5-8d3c-42e9-b7de-4e77a1f75ae4 |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IWRMMachineGroup Interface | MS System Resource | 59602eb6-57b0-4fd8-aa4b-ebf06971fe15 |
| Microsoft Messenger Service Remote Protocol - msgsvcsend operations for the NetrSendMessage method | MS Messenger | 5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostConstantValueCollection Interface | MS IIS | 5b5a68e6-8b9f-45e1-8199-a95ffccdffff |
| Microsoft Message Queuing - Management Service - qmrepl Interface | MS Message Queuing | 5b5b3580-b0e0-11d1-b92d-0060081e87f0 |
| Microsoft DHCP Server - dhcpsrv2 Interface | MS DHCP | 5b821720-f63b-11d0-aad2-00c04fc324db |
| Microsoft Internet Information Services (IIS) - FTP Publishing Service | MS IIS | 5c89f409-09cc-101a-89f3-02608c4d2361 |
| Microsoft Terminal Server Services - Runtime Interface - Legacy - WinStation_RPC Operations | MS Terminal Server | 5ca4a760-ebb1-11cf-8611-00a0245420ed |
| Microsoft Protected Storage Service - Password Recovery | MS Storage | 5cbe92cb-f4be-45c9-9fc9-33e73e557b20 |
| Microsoft File Server Resource Manager Protocol - IFsrmFileScreen Interface | MS File Server | 5f6325d3-ce88-4733-84c1-2d6aefc5ea07 |
| Microsoft Routing and Remote Access Service - IRemoteSstpCertCheck | MS Remote Access | 5ff9bdf6-bd91-4d8b-a614-d6317acc8dd8 |
| Microsoft Fax Client Interface | MS Fax | 6099fc12-3eff-11d0-abd0-00c04fd91a4e |
| Microsoft Routing and Remote Access Service - IRemoteIPV6Config | MS Remote Access | 6139d8a4-e508-4ebb-bac7-d7f275145897 |
| Microsoft Update Agent Management Protocol - IWindowsDriverUpdate2 Interface | MS Update Agent | 615c4269-7a48-43bd-96b7-bf6ca27d6c3e |
| Microsoft Explorer - Browser - DShellFolderViewEvents Interface | MS Explorer Browser | 62112aa2-ebe4-11cf-a5fb-0020afe7292d |
| Microsoft Wireless Configuration Service | MS Remote Services | 621dff68-3c39-4c6c-aae3-e68e2c6503ad |
| Microsoft System Event Notification Service - SensNotify | MS Event | 629b9f66-556c-11d1-8dd2-00aa004abd5e |
| Computer Associates BrightStor ARCserve Backup Tape Engine | CA BrightStor | 62b93df0-8b02-11ce-876c-00805f842837 |
| Microsoft System Event Notification Service - SensApi | MS Event | 63fbe424-2029-11d1-8db8-00aa004abd5e |
| Microsoft iSCSI Software Target Management Protocol - IEnumResourceGroup Interface | MS ISTM iSCSI | 640038f1-d626-40d8-b52b-09660601d045 |
| Microsoft Message Queuing - ActiveX Client - IMSMQOutgoingQueueManagement Interface | MS Message Queuing | 64c478fb-f9b0-4695-8a7f-439ac94326d3 |
| Microsoft Portmapper Service - FwIdl | MS Portmapper | 64fe0b7f-9ef5-4553-a7db-9a1975777554 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostElement Interface | MS IIS | 64ff8ccc-b287-4dae-b08a-a72cbf45f453 |
| Microsoft DNS Client Service - Windows 2000 and before | MS DNS | 65a93890-fab9-43a3-b2a5-1e330ac28f11 |
| Microsoft IManagedObject Interface Protocol - IRemoteDispatch: IDispatch Interface | MS IManagedObject | 6619a740-8154-43be-a186-0319578e02db |
| Microsoft Routing and Remote Access Service - IRemoteNetworkConfig | MS Remote Access | 66a2db1b-d706-11d0-a37b-00c04fc9da04 |
| Microsoft Routing and Remote Access Service - IRemoteRouterRestart | MS Remote Access | 66a2db20-d706-11d0-a37b-00c04fc9da04 |
| Microsoft Routing and Remote Access Service - IRemoteSetDNSConfig | MS Remote Access | 66a2db21-d706-11d0-a37b-00c04fc9da04 |
| Microsoft Routing and Remote Access Service - IRemoteICFICSConfig | MS Remote Access | 66a2db22-d706-11d0-a37b-00c04fc9da04 |
| Microsoft iSCSI Software Target Management Protocol - IEnumSnapshot Interface | MS ISTM iSCSI | 66c9b082-7794-4948-839a-d8a5a616378f |
| Microsoft Update Agent Management Protocol - IAutomaticUpdates Interface | MS Update Agent | 673425bf-c082-4c7c-bdfd-569464b8e0ce |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemContext - Unmarshaler Interface | MS WMI | 674b6698-ee92-11d0-ad71-00c04fd8fdff |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVolumeMF3 Interface | MS Virtual Disk | 6788faf9-214e-4b85-ba59-266953616e09 |
| Microsoft Exchange - System Attendant Service - Version 3.0 | MS Exchange | 67df7c70-0f04-11ce-b13f-00aa003bac6c |
| Microsoft Routing and Remote Access Service - IRemoteStringIdConfig | MS Remote Access | 67e08fc2-2984-4b62-b92e-fc1aae64bbbb |
| Microsoft Explorer - Browser - IInputObject Interface | MS Explorer Browser | 68284faa-6a48-11d0-8c78-00c04fd918b4 |
| Microsoft File Server Resource Manager Protocol - IFsrmReportScheduler Interface | MS File Server | 6879caf9-6617-4484-8719-71c3d8645f94 |
| Microsoft Cryptographic Services - IKeySvc2 | MS Crypto | 68b58241-c259-4f03-a2e5-a2651dcbc930 |
| Microsoft Intersite Messaging Service - ismapi Interface | MS Intersite Messaging | 68dcd486-669e-11d1-ab0c-00c04fc2dcd2 |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - INtmsObjectInfo1 Interface | MS Removable Storage | 69ab7050-3059-11d1-8faf-00a024cb6019 |
| Microsoft Update Agent Management Protocol - IUpdate Interface | MS Update Agent | 6a92b07a-d821-4682-b423-5c805022cc4d |
| Microsoft Update Agent Management Protocol - IAutomaticUpdatesSettings2 Interface | MS Update Agent | 6abc136a-c3ca-4384-8171-cb2b1e59b8dc |
| Microsoft iSCSI Software Target Management Protocol - IEnumConnection Interface | MS ISTM iSCSI | 6aea6b26-0680-411d-8877-a148df3087d5 |
| Microsoft Firewall and Advanced Security Protocol (MS-FASP) - RemoteFW Interface | MS Security | 6b5bdd1e-528c-422c-af8c-a4079be4fe48 |
| Microsoft Common Internet File System (CIFS) - Browser Auxiliary Protocol - Browser Interface | MS CIFS Browser | 6bffd098-a112-3610-9833-012892020162 |
| Microsoft DHCP Server - dhcpsrv Interface | MS DHCP | 6bffd098-a112-3610-9833-46c3f874532d |
| Microsoft Workstation Service Remote Protocol - wkssvc Interface | MS Remote Services | 6bffd098-a112-3610-9833-46c3f87e345a |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IContainerControl2 Interface | MS COM+ Remote Admin | 6c935649-30a6-4211-8687-c4c83e5fe1c7 |
| Microsoft File Server Resource Manager Protocol - IFsrmAction Interface | MS File Server | 6cd6408a-ae60-463b-9ef1-e117534d69dc |
| Microsoft Explorer - Browser - IServiceProvider Interface | MS Explorer Browser | 6d5140c1-7436-11ce-8034-00aa006009fa |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsAdvancedDisk Interface | MS Virtual Disk | 6e6f6b40-977c-4069-bddd-ac710059f8c0 |
| Microsoft File Server Resource Manager Protocol - IFsrmPathMapper Interface | MS File Server | 6f4dbfff-6920-4821-a6c3-b7e94c1fd60c |
| Microsoft iSCSI Software Target Management Protocol - IWTDiskMgr4 Interface | MS ISTM iSCSI | 703e6b03-7ad1-4ded-ba0d-e90496ebc5de |
| Microsoft Message Queuing - Directory Service Protocol - dscomm2 Interface | MS Message Queuing | 708cca10-9569-11d1-b2a5-0060977d8118 |
| Microsoft Internet Information Services (IIS) - IMSAdminBaseW - IMSAdminBaseW Interface | MS IIS | 70b51430-b6ca-11d0-b9b9-00a0c922e750 |
| Microsoft Update Agent Management Protocol - IWindowsDriverUpdate5 Interface | MS Update Agent | 70cf5c82-8642-42bb-9dbc-0cfd263c6c4f |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVolume2 Interface | MS Virtual Disk | 72ae6713-dcbb-4a03-b36b-371f6ac6b53d |
| Microsoft Update Agent Management Protocol - ISearchJob Interface | MS Update Agent | 7366ea16-7a1a-4ea2-b042-973d3e9cd99b |
| Microsoft Distributed Transaction Coordinator (DTC) - DTCPing Interface | MS DTC | 75687379-aaaa-44f6-9512-080ac70f8ad9 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsOpenDisk Interface | MS Virtual Disk | 75c8f324-f715-4fe3-a28e-f9011b61a4a1 |
| Microsoft Update Agent Management Protocol - IUpdateService Interface | MS Update Agent | 76b3b17e-aed6-4da5-85f0-83587f81abe3 |
| Microsoft Exchange - Undocumented Interface 1 | MS Exchange | 76c0d124-a18e-49d4-adf1-d8c6ba868ea6 |
| Microsoft Message Queuing - Queue Manager Client Protocol - qmcomm2 Interface | MS Message Queuing | 76d12b80-3467-11d3-91ff-0090272f9ea3 |
| Microsoft Print System Asynchronous Remote Protocol (MS-PAR) - IRemoteWinspool Interface | MS Print | 76f03f96-cdfd-44fc-a22c-64950a001209 |
| Microsoft Message Queuing - Directory Service Protocol - dscomm Interface | MS Message Queuing | 77df7a80-f298-11d0-8358-00a024c480a8 |
| Microsoft OCSP Administration Protocol (MS-OCSPA) - IOCSPAdminD Interface | MS Security | 784b693d-95f3-420b-8126-365c098659f2 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostMethod Interface | MS IIS | 7883ca1c-1112-4447-84c3-52fbeb38069d |
| Microsoft Directory Replication Service (DRS) Remote Protocol - DSAOP Methods | MS Active Directory | 7c44d7d4-31d5-424c-bd5e-2b3e1f323d22 |
| Microsoft Internet Information Services (IIS) - IMSAdminBaseW - IIISApplicationAdmin Interface | MS IIS | 7c4e1804-e342-483d-a43e-a850cfcc8d18 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemObjectSink Interface | MS WMI | 7c857801-7381-11cf-884d-00aa004b2e24 |
| Microsoft Update Agent Management Protocol - IImageInformation Interface | MS Update Agent | 7c907864-346c-4aeb-8f3f-57da289f969f |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - IRobustNtmsMediaServices1 Interface | MS Removable Storage | 7d07f313-a53f-459a-bb12-012c15b1846e |
| Microsoft Message Queuing Service | MS Message Queuing | 7e048d38-ac08-4ff1-8e6b-f35dbab88d4a |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IAlternateLaunch Interface | MS COM+ Remote Admin | 7f43b400-1a0e-4d57-bbc9-6b0c65f7a889 |
| Microsoft Windows Firewall - Fw_Resource_Indication Interface | MS Security | 7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventClass3 Interface | MS COM+ Event System | 7fb7ea43-2d76-4ea8-8cd9-3decc270295e |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueueManagement Interface | MS Message Queuing | 7fbe7759-5760-444d-b8a5-5e7ab9a84cce |
| Microsoft Certificate Services Remote Administration Protocol - ICertAdminD2 Interface | MS Security | 7fe0d935-dda6-443f-85d0-1cfb58fe41dd |
| Microsoft Remote Administrative Interface: WINS protocol - winsi2 Interface | MS WINS | 811109bf-a4e1-11d1-ab54-00a0c91e9b45 |
| Microsoft IManagedObject Interface Protocol - IServicedComponentInfo Interface | MS IManagedObject | 8165b19e-8d3a-4d0b-80c8-97de310db583 |
| Microsoft Update Agent Management Protocol - IUpdateSession Interface | MS Update Agent | 816858a4-260d-4260-933a-2585f1abc76b |
| Microsoft Update Agent Management Protocol - ICategory Interface | MS Update Agent | 81ddc1b8-9d35-47a6-b471-5b80f519223b |
| Microsoft iSCSI Software Target Management Protocol - IEnumVolume Interface | MS ISTM iSCSI | 81fe3594-2495-4c91-95bb-eb5785614ec7 |
| Microsoft EventLog Remoting Service - eventlog Interface | MS Event | 82273fdc-e32a-18c3-3f78-827929dc23ea |
| Microsoft File Server Resource Manager Protocol - IFsrmActionEmail2 Interface | MS File Server | 8276702f-2532-4839-89bf-4872609a2ea4 |
| Microsoft Internet Information Services (IIS) - IMSAdminBaseW - IMSAdminBase2W Interface | MS IIS | 8298d101-f992-43b7-8eca-5052d885b995 |
| Microsoft Internet Information Services (IIS) - Inetinfo - IISAdmin Service | MS IIS | 82ad4280-036b-11cf-972c-00aa006887b0 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsAdviseSink Interface | MS Virtual Disk | 8326cd1d-cf59-4936-b786-5efc08798e25 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostConfigLocationCollection Interface | MS IIS | 832a32f7-b3ea-4b8c-b260-9a2923001184 |
| Microsoft Remote Assistance Initiation Protocol - IPCHCollection Interface | MS Remote Assistance | 833e4100-aff7-4ac3-aac2-9f24c1457bce |
| Microsoft Remote Assistance Initiation Protocol - ISAFSession Interface | MS Remote Assistance | 833e41aa-aff7-4ac3-aac2-9f24c1457bce |
| Microsoft Remote Assistance Initiation Protocol - IPCHService Interface | MS Remote Assistance | 833e4200-aff7-4ac3-aac2-9f24c1457bce |
| Microsoft Exchange - Function I | MS Exchange | 8384fc47-956a-4d1e-ab2a-1205014f96ec |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsSubSystemImportTarget Interface | MS Virtual Disk | 83bfb87f-43fb-4903-baa6-127f01029eec |
| Microsoft Exchange - System Attendant Service - Version 6.0 | MS Exchange | 83d72bf0-0d89-11ce-b13f-00aa003bac6c |
| Microsoft Windows File Protection Service | MS Security | 83da7c00-e84f-11d2-9807-00c04f8ec850 |
| Microsoft Remote Administrative Interface - Network Policy Server (NPS) Protocol - IIASDataStoreComServer Interface | MS Remote Services | 83e05bd5-aec1-4e58-ae50-e819c7296f67 |
| Microsoft Update Agent Management Protocol - IWindowsUpdateAgentInfo Interface | MS Update Agent | 85713fa1-7796-4fa2-be3b-e2d6124dd373 |
| Microsoft Failover Cluster: Setup and Validation Protocol - IClusterLog Interface | MS Failover Cluster | 85923ca7-1b6b-4e83-a2e4-f5ba3bfbb8a3 |
| Microsoft iSCSI Software Target Management Protocol - IWTDisk Interface | MS ISTM iSCSI | 866a78bc-a2fb-4ac4-94d5-db3041b4ed75 |
| Microsoft Task Scheduler Service Remote Protocol - ITaskSchedulerService | MS Scheduler | 86d35949-83c9-4044-b424-db363231fd0c |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - IClientSink Interface | MS Removable Storage | 879c8bbe-41b0-11d1-be11-00c04fb6bf70 |
| Microsoft Terminal Server Services - Runtime Interface - LSM Enumeration Interface | MS Terminal Server | 88143fd0-c28d-4b2b-8fef-8d882f6a9390 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVolume Interface | MS Virtual Disk | 88306bb2-e71f-478c-86a2-79da200a0f11 |
| Microsoft iSCSI Software Target Management Protocol - ISnapshot Interface | MS ISTM iSCSI | 883343f1-ceed-4e3a-8c1b-f0dadfce281e |
| Computer Associates BrightStor - Backup Agent RPC Server | CA BrightStor | 88435ee0-861a-11ce-b86b-00001b27f656 |
| Microsoft Failover Cluster: Setup and Validation Protocol - ClusterLog Interface | MS Failover Cluster | 88e7ac6d-c561-4f03-9a60-39dd768f867d |
| Microsoft Remote Shutdown Protocol - InitShutdown Interface | MS Remote Shutdown | 894de0c0-0d55-11d3-a322-00c04fa321a1 |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - INtmsObjectManagement2 Interface | MS Removable Storage | 895a2c86-270d-489d-a6c0-dc2a9b35280e |
| Microsoft Exchange - Store Service - exchange_store_admin2 Interface | MS Exchange | 89742ace-a9ed-11cf-9c0c-08002be7ae86 |
| Microsoft Distributed File System Replication Protocol (DFS-R) - FrsTransport Interface | MS File Replication | 897e2e5f-93f3-4376-9c9c-fd2277495c27 |
| Microsoft iSCSI Software Target Management Protocol - ILocalDeviceMgr Interface | MS ISTM iSCSI | 8ad608a4-6c16-4405-8879-b27910a68995 |
| Microsoft File Server Resource Manager Protocol - IFsrmQuotaManager Interface | MS File Server | 8bb68c7d-19d8-4ffb-809e-be4fc1734014 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - CLSID_WbemLevel1Login | MS WMI | 8bc3f05e-d86b-11d0-a075-00c04fb68820 |
| Microsoft Explorer - Browser - IKnownFolderManager Interface | MS Explorer Browser | 8be2d872-86aa-4d47-b776-32cca40c7018 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostPropertySchemaCollection Interface | MS IIS | 8bed2c68-a5fb-4b28-8581-a0dc5267419f |
| Microsoft iSCSI Software Target Management Protocol - IEnumVolume2 Interface | MS ISTM iSCSI | 8c58f6b3-4736-432a-891d-389de3505c7c |
| Microsoft Application Management Service | MS AMS | 8c7daf44-b6dc-11d1-9a4c-0020af6e7c57 |
| Microsoft Internet Information Services (IIS) - SMTP Service | MS IIS | 8cfb5d70-31a4-11cf-a7d8-00805f48a135 |
| Microsoft Cryptographic Service | MS Crypto | 8d0ffe72-d252-11d0-bf8f-00c04fd9126b |
| Microsoft iSCSI Software Target Management Protocol - ISessionManager Interface | MS ISTM iSCSI | 8d7ae740-b9c5-49fc-a11e-89171907cb86 |
| Microsoft Plug and Play Service - pnp Interface | MS Plug and Play | 8d9f4e40-a03d-11ce-8f69-08003e30051b |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - INtmsSession1 Interface | MS Removable Storage | 8da03f40-3419-11d1-8fb1-00a024cb6019 |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IRegister Interface | MS COM+ Remote Admin | 8db2180e-bd29-11d1-8b7e-00c04fd7a924 |
| Microsoft File Server Resource Manager Protocol - IFsrmFileGroup Interface | MS File Server | 8dd04909-0e34-4d55-afaa-89e1f1a1bbb9 |
| Microsoft Routing and Remote Access Service (RRAS) Management Protocol - dimsvc Interface | MS Remote Access | 8f09f000-b7ed-11ce-bbd2-00001a181cad |
| Microsoft Update Agent Management Protocol - IUpdateSearcher Interface | MS Update Agent | 8f45abf1-f9ae-4b95-a933-f0f66e5056ea |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsDisk3 Interface | MS Virtual Disk | 8f4b2f5d-ec15-4357-992f-473ef10975b9 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostConfigManager | MS IIS | 8f6d760f-f0cb-4d69-b5f6-848b33e9bdc6 |
| Microsoft W32Time Remote Protocol (MS-W32T) / Network Time Protocol Authentication Extensions (MS-SNTP) - W32Time Interface | MS W32Time | 8fb6d884-2388-11d0-8c35-00c04fda2795 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsDiskOnline Interface | MS Virtual Disk | 90681b1d-6a7f-48e8-9061-31b7aa125322 |
| Microsoft Distributed Transaction Coordinator (DTC) - Connection Manager: OleTx Transports Protocol - IXnRemote Operations | MS DTC | 906b0ce0-c70b-1067-b317-00dd010662da |
| Microsoft Update Agent Management Protocol - IUpdateSession3 Interface | MS Update Agent | 918efd1e-b5d8-4c90-8540-aeb9bdc56f9d |
| Microsoft Certificate Services - ICertPassage Remote Protocol - ICertPassage Interface | MS Security | 91ae6020-9e3c-11cf-8d7c-00aa00c091be |
| Microsoft Update Agent Management Protocol - IUpdateSession2 Interface | MS Update Agent | 91caf7b0-eb23-49ed-9937-c52d817f46f7 |
| Microsoft Security Configuration Editor Service | MS Security | 93149ca2-973b-11d1-8c39-00c04fb984f9 |
| Veritas Backup Exec Service | VR BKPSVC | 93841fd0-16ce-11ce-850d-02608c44967b |
| Microsoft Exchange - Store Service EMSMDBPOOL Interface | MS Exchange | 938fe036-ede6-4f6c-966e-a3d7300279c8 |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IWRMPolicy Interface | MS System Resource | 943991a5-b3fe-41fa-9696-7f7b656ee34b |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemServices Interface | MS WMI | 9556dc99-828c-11cf-a37e-00aa003240c7 |
| Microsoft WinLogon - IRPCSCLogon | MS Security | 95958c94-a424-4055-b62b-b7f4d5c47770 |
| Microsoft File Server Resource Manager Protocol - IFsrmCommittableCollection Interface | MS File Server | 96deb3b5-8b91-4a2a-9d93-80a35d8aa847 |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IRegister2 Interface | MS COM+ Remote Admin | 971668dc-c3fe-4ea1-9643-0c7230f494a1 |
| Microsoft Component Object Model Plus (COM+) Protocol - ITransactionStream Interface | MS COM+ | 97199110-db2e-11d1-a251-0000f805ca53 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsAdvancedDisk2 Interface | MS Virtual Disk | 9723f420-9355-42de-ab66-e31bb15beeac |
| Microsoft Portmapper Service | MS Portmapper | 975201b0-59ca-11d0-a8d5-00a0c90d8051 |
| Microsoft Internet Information Services (IIS) - InetInfo Service - Version 2.0 | MS IIS | 97f83d5c-1994-11d1-a90d-00c04fb960f8 |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IReplicationUtil Interface | MS COM+ Remote Admin | 98315903-7be5-11d2-adc1-00a02463d6e7 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsCreatePartitionEx Interface | MS Virtual Disk | 9882f547-cfc3-420b-9750-00dfbec50662 |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventSystem2 Interface | MS COM+ Event System | 99cc098f-a48a-4e9c-8e58-965c0afc19d5 |
| Microsoft Exchange - Store Service - exchange_store_admin3 Interface | MS Exchange | 99e64010-b032-11d0-97a4-00c04fd6551d |
| Microsoft Distributed Component Object Model (DCOM) - IOXIDResolver/IObjectExporter Interface | MS DCOM Services | 99fcfec4-5260-101b-bbcb-00aa0021347a |
| Microsoft File Server Resource Manager Protocol - IFsrmQuotaTemplateImported Interface | MS File Server | 9a2bf113-a329-44cc-809a-5c00fce8da40 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemClassObject Interface | MS WMI | 9a653086-174f-11d2-b5f9-00104b703efd |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsSwProvider Interface | MS Virtual Disk | 9aa58360-ce33-4f92-b658-ed24b14425b8 |
| Microsoft Update Agent Management Protocol - IUpdateServiceCollection Interface | MS Update Agent | 9b0353aa-0e52-44ff-b8b0-1f7fa0437f88 |
| Microsoft Distributed Component Object Model (DCOM) - Process Launcher | MS DCOM Services | 9b8699ae-0e44-47b1-8e7f-86a461d7ecdc |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostAdminManager Interface | MS IIS | 9be77978-73ed-4a9a-87fd-13f09fec1b13 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsDiskPartitionMF2 Interface | MS Virtual Disk | 9cbe50ca-f2d2-4bf4-ace1-96896b729625 |
| Microsoft Exchange - Message Transfer Agent (MTA) Service | MS Exchange | 9e8ee830-4459-11ce-979b-00aa005ffebe |
| Microsoft Exchange - Mail Transfer Agent (MTA) exchange_mta Interface | MS Exchange | 9e8ee830-4559-11ce-979b-00aa005ffebe |
| Microsoft WinLogon - GetUserToken Service | MS Security | a002b3a0-c9b7-11d1-ae88-0080c75e4ec1 |
| Microsoft File Replication Service (FRS) - PerfFrs Interface | MS File Replication | a00c021c-2be2-11d2-b678-0000f87a8f8e |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventSystemInitialize Interface | MS COM+ Event System | a0e8f27a-888c-11d1-b763-00c04fb926af |
| Microsoft File Server Resource Manager Protocol - IFsrmQuotaTemplate Interface | MS File Server | a2efab31-295e-46bb-b976-e86d58b52e8b |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemBackupRestoreEx : IWbemBackupRestore Interface | MS WMI | a359dec5-e813-4834-8a2a-ba7f1d777d76 |
| Microsoft Remote Desktop Protocol: Smart Card Virtual Channel Extension (MS-RDPESC) - type_scard_pack Interface | MS Remote | a35af600-9cf4-11cd-a076-08002b2bd711 |
| Microsoft Update Agent Management Protocol - IUpdateException Interface | MS Update Agent | a376dd5e-09d4-427f-af7c-fed5b6e1c1d6 |
| Microsoft Update Agent Management Protocol - IUpdateExceptionCollection Interface | MS Update Agent | a37d00f5-7bb0-4953-b414-f9e98326f2e8 |
| Microsoft Exchange - Store Service - exchange_store_admin1 Interface | MS Exchange | a4f1db00-ca47-1067-b31e-00dd010662da |
| Microsoft Exchange - Store Service EMSMDB Interface | MS Exchange | a4f1db00-ca47-1067-b31f-00dd010662da |
| Microsoft Internet Information Services (IIS) - InetInfo Service - Version 3.0 | MS IIS | a520d06e-11de-11d2-ab59-00c04fa3590c |
| Microsoft iSCSI Software Target Management Protocol - IEnumDisk2 Interface | MS ISTM iSCSI | a5ecfc73-0013-4a9e-951c-59bf9735fdda |
| Microsoft Failover Cluster: Setup and Validation Protocol - ClusterCleanup Interface | MS Failover Cluster | a6d3e32b-9814-4409-8de3-cfa673e6d3de |
| Microsoft Update Agent Management Protocol - IUpdateHistoryEntryCollection Interface | MS Update Agent | a7f04f3c-a290-435b-aadf-a116c3357a5c |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - ICatalogTableInfo Interface | MS COM+ Remote Admin | a8927a41-d3ce-11d1-8472-006008b0e5ca |
| Microsoft File Server Remote VSS Protocol (MS-FSRVP) - FileServerVssAgent Interface | MS File Server | a8e0653c-2744-4389-a61d-7373df8b2292 |
| Microsoft Internet Security and Acceleration (ISA) - AD-LDS - ISASTGCTRL | MS ISA | a9b96d49-2c75-4917-a178-06b6f08261cc |
| Microsoft Exchange - Information Store - Undocumented Interface 1 | MS Exchange | a9e05b20-6f57-4e24-a540-52412017e6ff |
| Microsoft Internet Information Services (IIS) - COM GUID/UUID Service - IADMCOMSINK Interface | MS IIS | a9e69612-b80d-11d0-b9b9-00a0c922e750 |
| Microsoft Domain Name System (DNS) Server | MS DNS | aae9ac90-ce13-11cf-919e-08002be23c64 |
| Microsoft iSCSI Software Target Management Protocol - ISessionManager CLSID | MS ISTM iSCSI | ad069971-edc5-4357-a132-430dad479d2b |
| Microsoft File Server Resource Manager Protocol - IFsrmFileGroupImported Interface | MS File Server | ad55f10b-5f11-4be7-94ef-d9ee2e470ded |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostConfigFile Interface | MS IIS | ada4e6fb-e025-401e-a5d0-c3134a281f07 |
| Microsoft Shadow Copy Management Protocol - IVssEnumObject Interface | MS Volume Shadow Copy | ae1c7110-2f60-11d3-8a39-00c04f72d8e3 |
| Microsoft Print System Asynchronous Notification Protocol (MS-PAN) - IRPCRemoteObject Interface | MS Print | ae33069b-a2a8-46ee-a235-ddfd339be281 |
| Microsoft Distributed Transaction Coordinator (DTC) - Remote Management Interface | MS DTC | afa8bd80-7d8a-11c9-bef4-08002b102989 |
| Microsoft File Server Resource Manager Protocol - IFsrmClassificationRule Interface | MS File Server | afc052c2-5315-45ab-841b-c6db0e120148 |
| Microsoft Central Access Policy Identifier (ID) - Retrieval Protocol (MS-CAPR) - lsacap Interface | MS Security | afc07e2e-311c-4435-808c-c483ffeec7c9 |
| Microsoft iSCSI Software Target Management Protocol - IHost Interface | MS ISTM iSCSI | b0076fec-a921-4034-a8ba-090bc6d03bde |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - INtmsObjectManagement1 Interface | MS Removable Storage | b057dc50-3059-11d1-8faf-00a024cb6019 |
| Microsoft iSCSI Software Target Management Protocol - IHostMgr Interface | MS ISTM iSCSI | b06a64e3-814e-4ff9-afac-597ad32517c7 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsIscsiInitiatorAdapter Interface | MS Virtual Disk | b07fedd4-1682-4440-9189-a39b55194dc5 |
| Microsoft iSCSI Software Target Management Protocol - ILocalDeviceMgr2 Interface | MS ISTM iSCSI | b0d1ac4b-f87a-49b2-938f-d439248575b2 |
| Microsoft Distributed Component Object Model (DCOM) - IConnectionPointContainer Interface | MS DCOM Services | b196b284-bab4-101a-b69c-00aa00341d07 |
| Microsoft Distributed Component Object Model (DCOM) - IEnumConnectionPoints Interface | MS DCOM Services | b196b285-bab4-101a-b69c-00aa00341d07 |
| Microsoft Distributed Component Object Model (DCOM) - IConnectionPoint Interface | MS DCOM Services | b196b286-bab4-101a-b69c-00aa00341d07 |
| Microsoft Distributed Component Object Model (DCOM) - IEnumConnections Interface (obsolete) | MS DCOM Services | b196b287-bab4-101a-b69c-00aa00341d07 |
| Microsoft Internet Security and Acceleration (ISA) - Management Console (MMC) | MS ISA | b347203c-14bb-4878-8b7a-0a12f9b8076a |
| Microsoft Update Agent Management Protocol - IWindowsDriverUpdate Interface | MS Update Agent | b383cd1a-5ce9-4504-9f63-764b1236f191 |
| Microsoft Commerce Server Staging (CSS) - Replication Service | MS CSS | b3df47c0-a95a-11cf-aa26-00aa00c148b9 |
| Microsoft Exchange - Function II | MS Exchange | b4757e80-a0e4-46b4-876a-3ae4a548ee07 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVdProvider | MS Virtual Disk | b481498c-8354-45f9-84a0-0bdd2832a91f |
| Microsoft iSCSI Software Target Management Protocol - IHost2 Interface | MS ISTM iSCSI | b4fa8e86-2517-4a88-bd67-75447219eee4 |
| Microsoft Update Agent Management Protocol - IAutomaticUpdatesSettings3 Interface | MS Update Agent | b587f5c3-f57e-485f-bbf5-0d181c5cd0dc |
| Microsoft Component Object Model Plus (COM+) Tracker Service Protocol - IGetTrackingData Interface | MS COM+ Tracker | b60040e0-bcf3-11d1-861d-0080c729264d |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsServiceUninstallDisk Interface | MS Virtual Disk | b6b22da8-f903-4be7-b492-c09d875ac9da |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostSectionDefinitionCollection Interface | MS IIS | b7d381ee-8860-47a1-8af4-1f33b2b1f325 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostMethodInstance Interface | MS IIS | b80f3c42-60e0-4ae0-9007-f52852d3dbed |
| Microsoft Group Key Distribution Protocol (MS-GKDI) - ISDKey Interface | MS Active Directory | b9785960-524f-11df-8b6d-83dcded72085 |
| Microsoft Failover Cluster: Management API - ClusAPI Interface | MS Failover Cluster | b97db8b2-4c63-11cf-bff6-08002be23f2f |
| Microsoft Portmapper Service - IROT Interface | MS Portmapper | b9e79e60-3d52-11ce-aaa1-00006901293f |
| Microsoft Exchange - Topology Information Server Interface | MS Exchange | b9fadb8d-53a1-41d7-b763-88d884b6b829 |
| Microsoft iSCSI Software Target Management Protocol - IWTGeneral CLSID | MS ISTM iSCSI | baa4a577-202d-49c7-a6bb-10ee914ee199 |
| Microsoft File Server Resource Manager Protocol - IFsrmClassifierModuleDefinition Interface | MS File Server | bb36ea26-6318-4b8c-8592-f72dd602e7a5 |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - INtmsNotifySink Interface | MS Removable Storage | bb39332c-bfee-4380-ad8a-badc8aff5bb6 |
| Microsoft iSCSI Software Target Management Protocol - IEnumDisk Interface | MS ISTM iSCSI | bb39e296-ad26-42c5-9890-5325333bb11e |
| Microsoft Active Directory Technical Specification - Claims Interface | MS Active Directory | bba9cb76-eb0c-462c-aa1b-5d8c34415701 |
| Microsoft Update Agent Management Protocol - IUpdateDownloadContentCollection Interface | MS Update Agent | bc5513c8-b3b8-4bf7-a4d4-361c0d8c88ba |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IWRMResourceGroup Interface | MS System Resource | bc681469-9dd9-4bf4-9b3d-709f69efe431 |
| Microsoft Internet Information Services (IIS) - IMSAdminBaseW - IIISCertObj Interface | MS IIS | bd0c73bc-805b-4043-9c30-9a28d64dd7d2 |
| Microsoft Exchange - Function III | MS Exchange | bd5790c9-d855-42b0-990f-3dfed8c184b3 |
| Microsoft Terminal Server Services - Runtime Interface - TermSrv Interface | MS Terminal Server | bde95fdf-eee0-45de-9e12-e5a61cd0d4fe |
| Microsoft Update Agent Management Protocol - IUpdateHistoryEntry Interface | MS Update Agent | be56a644-af0e-4e0e-a311-c1d8e695cbff |
| Microsoft Message Queuing - ActiveX Client - IMSMQManagement Interface | MS Message Queuing | be5f0241-e489-4957-8cc4-a452fcf3e23e |
| Microsoft File Server Resource Manager Protocol - IFsrmFileScreenException Interface | MS File Server | bee7ce02-df77-4515-9389-78f01c5afc1a |
| Microsoft Exchange - Information Store - Undocumented Interface 2 | MS Exchange | bf6dd426-77b4-44b3-984e-d413fc075562 |
| Microsoft Internet Information Services (IIS) - Admin Service | MS IIS | bfa951d1-2f0e-11d3-bfd1-00c04fa3490a |
| Microsoft iSCSI Software Target Management Protocol - ISessionManager2 Interface | MS ISTM iSCSI | c10a76d8-1fe4-4c2f-b70d-665265215259 |
| Microsoft Update Agent Management Protocol - IUpdate5 Interface | MS Update Agent | c1c2f21a-d2f4-4902-b5c6-8a081c19a890 |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IImport Interface | MS COM+ Remote Admin | c2be6970-df9e-11d1-8b87-00c04fd7a924 |
| Microsoft Update Agent Management Protocol - IUpdateHistoryEntry2 Interface | MS Update Agent | c2bfb780-4539-4132-ab8c-0a8772013ab6 |
| Microsoft Remote Administrative Interface - Network Policy Server (NPS) Protocol - IIASDataStoreComServer2 Interface | MS Remote Services | c323be28-e546-4c23-a81b-d6ad8d8fac7b |
| Microsoft Windows Audio Service - Audio Remote Procedure Call (RPC) | MS Audio | c386ca3e-9061-4a72-821e-498d83be188f |
| Microsoft IManagedObject Interface Protocol - IManagedObject : IUnknown Interface | MS IManagedObject | c3fcc19e-a970-11d2-8b5a-00a0c9b7c9c4 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - CLSID_WbemBackupRestore | MS WMI | c49e32c6-bc8b-11d2-85d4-00105a1f8304 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemBackupRestoreEx Interface | MS WMI | c49e32c7-bc8b-11d2-85d4-00105a1f8304 |
| Microsoft DFS Replication Helper Protocol - IADProxy2 Interface | MS DFS Replication | c4b0c7d9-abe0-4733-a1e1-9fdedf260c7a |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostSectionDefinition Interface | MS IIS | c5c04795-321c-4014-8fd6-d44658799393 |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IResourceManager Interface | MS System Resource | c5cebee2-9df5-4cdd-a08c-c2471bc144b4 |
| Microsoft Encrypting File System Remote (EFSR) Protocol - lsarpc Interface | MS Security | c681d488-d850-11d0-8c52-00c04fd90f7e |
| Microsoft Portmapper Service - IMachineActivatorControl Interface | MS Portmapper | c6f3ee72-ce7e-11d1-b71e-00c04fc3111a |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - ICatalogUtils2 interface | MS COM+ Remote Admin | c726744e-5735-4f08-8286-c510ee638fb6 |
| Microsoft Failover Cluster: Setup and Validation Protocol - ClusterStorage2 Interface | MS Failover Cluster | c72b09db-4d53-4f41-8dcc-2d752ab56f7c |
| Microsoft Exchange - exchange_unknown Interface | MS Exchange | c840a7dc-42c0-1a10-b4b9-08002b2fe182 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostElementCollection | MS IIS | c8550bff-5281-4b1e-ac34-99b6fa38464d |
| Microsoft Explorer - Browser - ICommDlgBrowser3 Interface | MS Explorer Browser | c8ad25a1-3294-41ee-8165-71174bd01c57 |
| Microsoft Web Distributed Authoring and Versioning (WebDAV) Client Service - davclntrpc Interface | MS WDAV | c8cb7687-e6d3-11d2-a958-00c04f682e16 |
| Microsoft Protected Storage Service - IPStoreProv | MS Storage | c9378ff1-16f7-11d0-a0b2-00aa0061426a |
| Microsoft Update Agent Management Protocol - IUpdateDownloadContent2 Interface | MS Update Agent | c97ad11b-f257-420b-9d9f-377f733f6f68 |
| Microsoft File Server Resource Manager Protocol - IFsrmRule Interface | MS File Server | cb0df960-16f5-4495-9079-3f9360d831df |
| Microsoft Service Witness Protocol - Witness Interface | MS Witness | ccd8c074-d0e5-4a40-92b4-d074faa6ba28 |
| Microsoft Explorer - Browser - IFolderView Interface | MS Explorer Browser | cde725b0-ccc9-4519-917e-325d72fab4ce |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IExport Interface | MS COM+ Remote Admin | cfadac84-e12c-11d1-b34c-00c04f990d54 |
| Microsoft File Server Resource Manager Protocol - IFsrmFileScreenTemplateManager Interface | MS File Server | cfe36cba-1949-4e74-a14f-f1d580ceaf13 |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - INtmsMediaServices1 Interface | MS Removable Storage | d02e4be0-3419-11d1-8fb1-00a024cb6019 |
| Microsoft File Replication Service (FRS) - NtFrsApi Interface | MS File Replication | d049b186-814f-11d1-9a3c-00c04fc9b232 |
| Microsoft Disk Management Remote Protocol - IVolumeClient Interface | MS Disk Management | d2d79df5-3400-11d0-b40b-00aa005ff586 |
| Microsoft Disk Management Remote Protocol - IDMNotify Interface | MS Disk Management | d2d79df7-3400-11d0-b40b-00aa005ff586 |
| Microsoft File Server Resource Manager Protocol - IFsrmClassificationManager Interface | MS File Server | d2dc89da-ee91-48a0-85d8-cc72a56f7d04 |
| Microsoft IPSEC Policy Agent | MS Security | d335b8f6-cb31-11d0-b0f9-006097ba4e54 |
| Microsoft Remote Procedure Call (RPC) Locator Service - NsiC | MS Locator | d3fbb514-0e3b-11cb-8fad-08002b1d29c3 |
| Microsoft Update Agent Management Protocol - ISearchResult | MS Update Agent | d40cff62-e08c-4498-941a-01e25f0fd33c |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemLoginClientID Interface | MS WMI | d4781cd6-e5d3-44df-ad94-930efe48a887 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsAsync Interface | MS Virtual Disk | d5d23b6d-5a55-4492-9889-397a3c2d2dbc |
| Microsoft Failover Cluster: Setup and Validation Protocol - IClusterCleanup Interface | MS Failover Cluster | d6105110-8917-41a5-aa32-8e0aa2933dc9 |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - Removable Storage Manager Class | MS Removable Storage | d61a27c6-8f53-11d0-bfa0-00a024151983 |
| Microsoft File Server Resource Manager Protocol - IFsrmActionEmail Interface | MS File Server | d646567d-26ae-4caa-9f84-4e0aad207fca |
| Microsoft Internet Connection Firewall | MS ICFW | d674a233-5829-49dd-90f0-60cf9ceb7129 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVolumeShrink Interface | MS Virtual Disk | d68168c9-82a2-4f85-b6e9-74707c49a58f |
| Microsoft iSCSI Software Target Management Protocol - IWTDiskMgr3 Interface | MS ISTM iSCSI | d6bd6d63-e8cb-4905-ab34-8a278c93197a |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostMethodCollection Interface | MS IIS | d6c7cd8f-bb8d-4f96-b591-d3a5f1320269 |
| Microsoft Remote Procedure Call (RPC) Locator Service - NsiS | MS Locator | d6d70ef0-0e3b-11cb-acc3-08002b1d29c3 |
| Microsoft Remote Procedure Call (RPC) Locator Service - NsiM | MS Locator | d6d70ef0-0e3b-11cb-acc3-08002b1d29c4 |
| Microsoft iSCSI Software Target Management Protocol - IWTGeneral Interface | MS ISTM iSCSI | d71b2cae-33e8-4567-ae96-3ccf31620be2 |
| Microsoft Message Queuing - ActiveX Client - IMSMQPrivateEvent Interface | MS Message Queuing | d7ab3341-c9d3-11d1-bb47-0080c7c5a2c0 |
| Microsoft Message Queuing - ActiveX Client - IMSMQQuery Interface | MS Message Queuing | d7d6e072-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQQuery | MS Message Queuing | d7d6e073-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - IMSMQMessage Interface | MS Message Queuing | d7d6e074-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQMessage | MS Message Queuing | d7d6e075-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueue Interface | MS Message Queuing | d7d6e076-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - IMSMQEvent Interface | MS Message Queuing | d7d6e077-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - DMSMQEventEvents Interface | MS Message Queuing | d7d6e078-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQQueue | MS Message Queuing | d7d6e079-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQEvent | MS Message Queuing | d7d6e07a-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueueInfo Interface | MS Message Queuing | d7d6e07b-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQQueueInfo | MS Message Queuing | d7d6e07c-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueueInfos Interface | MS Message Queuing | d7d6e07d-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQQueueInfos | MS Message Queuing | d7d6e07e-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - IMSMQTransaction Interface | MS Message Queuing | d7d6e07f-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQTransaction Interface | MS Message Queuing | d7d6e080-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - IMSMQCoordinatedTransactionDispenser Interface | MS Message Queuing | d7d6e081-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQCoordinatedTransactionDispenser | MS Message Queuing | d7d6e082-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - IMSMQTransactionDispenser Interface | MS Message Queuing | d7d6e083-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQTransactionDispenser | MS Message Queuing | d7d6e084-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - IMSMQApplication Interface | MS Message Queuing | d7d6e085-dccd-11d0-aa4b-0060970debae |
| Microsoft Message Queuing - ActiveX Client - MSMQApplication | MS Message Queuing | d7d6e086-dccd-11d0-aa4b-0060970debae |
| Microsoft Domain Name System (DNS) Server - Interface version 5.0 | MS DNS | d7f9e1c0-2247-11d1-ba89-00c04fd91268 |
| Microsoft File Server Resource Manager Protocol - IFsrmReport Interface | MS File Server | d8cc81d9-46b8-4fa4-bfa5-4aa9dec9b638 |
| Microsoft Remote Shutdown Protocol - WindowsShutdown Interface | MS Remote Shutdown | d95afe70-a6d5-4259-822e-2c84da1ddb0d |
| Microsoft Message Queuing - ActiveX Client - IMSMQMessage2 Interface | MS Message Queuing | d9933be0-a567-11d2-b0f3-00e02c074f6b |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsHwProvider Interface | MS Virtual Disk | d99bdaae-b13a-4178-9fdb-e27f16b4603e |
| Microsoft Windows Client Certificate Enrollment Protocol (MS-WCCE) - ICertRequestD - Interface | MS Security | d99e6e70-fc88-11d0-b498-00a0c90312f3 |
| Microsoft Certificate Services Remote Administration Protocol - ICertAdminD Interface | MS Security | d99e6e71-fc88-11d0-b498-00a0c90312f3 |
| Microsoft Update Agent Management Protocol - IInstallationBehavior Interface | MS Update Agent | d9a59339-e245-4dbd-9686-4d5763e39624 |
| Microsoft Exchange - Store Service - Admin Interface | MS Exchange | da107c01-2b50-44d7-9d5f-bfd4fd8e95ed |
| Microsoft Performance Counter Query Protocol (MS-PCQ) - PerflibV2 Interface | MS Performance | da5a86c5-12c2-4943-ab30-7f74a813d853 |
| Microsoft Removable Storage Manager (RSM) Remote Protocol - INtmsLibraryControl2 Interface | MS Removable Storage | db90832f-6910-4d46-9f5e-9fd6bfa73903 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemClassObject : Iunknown Interface | MS WMI | dc12a681-737f-11cf-884d-00aa004b2e24 |
| Computer Associates BrightStor - Message Engine [Vulnerability 2] | CA BrightStor | dc246bf0-7a7a-11ce-9f88-00805fe43838 |
| Microsoft iSCSI Software Target Management Protocol - IHostMgr2 Interface | MS ISTM iSCSI | dd6f0a28-248f-4dd3-afe9-71aed8f685c4 |
| Microsoft Update Agent Management Protocol - IUpdateServiceRegistration Interface | MS Update Agent | dde02280-12b3-4e0b-937b-6747f6acb286 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostCollectionSchema Interface | MS IIS | de095db1-5368-4d11-81f6-efef619b7bcf |
| Microsoft Disk Management Remote Protocol - IVolumeClient4 Interface | MS Disk Management | deb01010-3a37-4d26-99df-e2bb6ae3ac61 |
| Microsoft Encrypting File System Remote (EFSR) Protocol - efsrpc Interface | MS Security | df1941c5-fe89-4e79-bf10-463657acf44d |
| Microsoft Explorer - Browser - IExplorerBrowser Interface | MS Explorer Browser | dfd3b6b5-c10c-4be9-85f6-a66969f402f6 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsServiceLoader Interface | MS Virtual Disk | e0393303-90d4-4a97-ab71-e9b671ee2729 |
| Microsoft Explorer - Browser - IExplorerPaneVisibility Interface | MS Explorer Browser | e07010ec-bc17-44c0-97b0-46c7c95b9edc |
| Microsoft File Server Resource Manager Protocol - IFsrmFileScreenTemplateImported Interface | MS File Server | e1010359-3e5d-4ecd-9fe4-ef48622fdf30 |
| Microsoft iSCSI Software Target Management Protocol - IEnumHost Interface | MS ISTM iSCSI | e141fd54-b79e-4938-a6bb-d523c3d49ff1 |
| Microsoft iSCSI Software Target Management Protocol - IHostMgr CLSID | MS ISTM iSCSI | e14efe0b-fd3b-41ea-8e3b-88930445b944 |
| Microsoft Failover Cluster: Setup and Validation Protocol - ClusterNetwork2 Interface | MS Failover Cluster | e1568352-586d-43e4-933f-8e6dc4de317a |
| Microsoft Distributed Component Object Model (DCOM) - Endpoint Mapper Service (EPM) | MS DCOM Services | e1af8308-5d1f-11c9-91a4-08002b14a0fa |
| Microsoft iSCSI Software Target Management Protocol - IEnumSnsServer Interface | MS ISTM iSCSI | e2842c88-07c3-4eb0-b1a9-d3d95e76fef2 |
| Microsoft Remote Procedure Call Location Services Extensions (MS-RPCL) - Deprecated - LocToLoc Interface | MS Locator | e33c0cc4-0482-101a-bc0c-02608c6ba218 |
| Microsoft Directory Replication Service (DRS) Remote Protocol - DRSUAPI Methods | MS Active Directory | e3514235-4b06-11d1-ab04-00c04fc2dcd2 |
| Microsoft Failover Cluster: Setup and Validation Protocol - IClusterUpdate Interface | MS Failover Cluster | e3c9b851-c442-432b-8fc6-a7faafc09d3b |
| Microsoft Background Intelligent Transfer Service (BITS) - Peer Authentication Protocol - BitsPeerAuth Interface | MS BITS | e3d0d746-d2af-40fd-8a7a-0d7078bb7092 |
| Microsoft Distributed Component Object Model (DCOM) - ILocalObjectExporter Interface | MS DCOM Services | e60c73e6-88f9-11cf-9af1-0020af6e72f4 |
| Microsoft iSCSI Software Target Management Protocol - ILocalDeviceMgr3 Interface | MS ISTM iSCSI | e645744b-cae5-4712-acaf-13057f7195af |
| Microsoft DFS Replication Helper Protocol - IServerHealthReport Interface | MS DFS Replication | e65e8028-83e8-491b-9af7-aaf6bd51a0ce |
| Microsoft Client Service for NetWare - NWWKS | MS Network | e67ab081-9844-3521-9d32-834f038001c0 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostPathMapper Interface | MS IIS | e7927575-5cc3-403b-822e-328a6b904bee |
| Microsoft Update Agent Management Protocol - IAutomaticUpdatesResults Interface | MS Update Agent | e7a4d634-7942-4dd9-a111-82228ba33901 |
| Microsoft Windows System Resource Manager (WSRM) Protocol - ResourceManager Class | MS System Resource | e8bcffac-b864-4574-b2e8-f1fb21dfdc18 |
| Microsoft Internet Information Services (IIS) - ServiceControl | MS IIS | e8fb8620-588f-11d2-9d61-00c04f79c5fe |
| Microsoft File Server Resource Manager Protocol - IFsrmPropertyDefinitionValue Interface | MS File Server | e946d148-bd67-4178-8e22-1c44925ed710 |
| Microsoft SHAREDFAX Fax Server and FaxObs Server Interfaces | MS Fax | ea0a3165-4834-11d2-a6f8-00c04fa346cc |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostPropertyException Interface | MS IIS | eafe4895-a929-41ea-b14d-613e23f62b71 |
| Microsoft Message Queuing - ActiveX Client - IMSMQQuery2 Interface | MS Message Queuing | eba96b0e-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueueInfos2 Interface | MS Message Queuing | eba96b0f-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQCoordinatedTransactionDispenser2 Interface | MS Message Queuing | eba96b10-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQTransactionDispenser2 Interface | MS Message Queuing | eba96b11-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQEvent2 Interface | MS Message Queuing | eba96b12-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQTransaction3 Interface | MS Message Queuing | eba96b13-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQCoordinatedTransactionDispenser3 Interface | MS Message Queuing | eba96b14-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQTransactionDispenser3 Interface | MS Message Queuing | eba96b15-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQDestination Interface | MS Message Queuing | eba96b16-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQPrivateDestination Interface | MS Message Queuing | eba96b17-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - MSMQDestination | MS Message Queuing | eba96b18-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQQuery3 Interface | MS Message Queuing | eba96b19-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQMessage3 Interface | MS Message Queuing | eba96b1a-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueue3 Interface | MS Message Queuing | eba96b1b-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQEvent3 Interface | MS Message Queuing | eba96b1c-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueueInfo3 Interface | MS Message Queuing | eba96b1d-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueueInfos3 Interface | MS Message Queuing | eba96b1e-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQApplication3 Interface | MS Message Queuing | eba96b1f-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueue4 Interface | MS Message Queuing | eba96b20-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueueInfo4 Interface | MS Message Queuing | eba96b21-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueueInfos4 Interface | MS Message Queuing | eba96b22-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQMessage4 Interface | MS Message Queuing | eba96b23-2168-11d3-898c-00e02c074f6b |
| Microsoft Message Queuing - ActiveX Client - IMSMQQuery4 Interface | MS Message Queuing | eba96b24-2168-11d3-898c-00e02c074f6b |
| Microsoft Active Directory Backup and Restore Services - JetBack Interface | MS Active Directory | ecec0d70-a603-11d0-96b1-00a0c91ece30 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostProperty Interface | MS IIS | ed35f7a1-5024-4e7b-a44d-07ddaf4b524d |
| Microsoft Update Agent Management Protocol - IWindowsDriverUpdateEntry Interface | MS Update Agent | ed8bfe40-a60b-42ea-9652-817dfcfa23ec |
| Microsoft File Server Resource Manager Protocol - IFsrmPropertyDefinition Interface | MS File Server | ede0150f-e9a3-419c-877c-01fe5d24c5d3 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsVolumeMF Interface | MS Virtual Disk | ee2d5ded-6236-4169-931d-b9778ce03dc6 |
| Microsoft File Server Resource Manager Protocol - IFsrmFileManagementJobManager Interface | MS File Server | ee321ecb-d95e-48e9-907c-c7685a013235 |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueue2 Interface | MS Message Queuing | ef0574e0-06d8-11d3-b100-00e02c074f6b |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostElementSchema Interface | MS IIS | ef13d885-642c-4709-99ec-b89561c6bc69 |
| Microsoft Update Agent Management Protocol - IStringCollection Interface | MS Update Agent | eff90582-2ddc-480f-a06d-60f3fbc362c3 |
| Microsoft iSCSI Software Target Management Protocol - IEnumCachedInitiator Interface | MS ISTM iSCSI | f093fe3d-8131-4b73-a742-ef54c20b337b |
| Microsoft Remote Assistance Initiation Protocol - IRASrv Interface | MS Remote Assistance | f120a684-b926-447f-9df4-c966cb785648 |
| Microsoft Component Object Model Plus (COM+) Remote Administration Protocol Protocol - IExport2 Interface | MS COM+ Remote Admin | f131ea3e-b7be-480e-a60d-51cb2785779e |
| Microsoft iSCSI Software Target Management Protocol - ILocalDeviceMgr CLSID | MS ISTM iSCSI | f1d3a46c-2e1b-4d84-97da-b3742ad67871 |
| Microsoft Failover Cluster: Setup and Validation Protocol - IClusterFirewall Interface | MS Failover Cluster | f1d6c29c-8fbe-4691-8724-f6d8deaeafc8 |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemRemoteRefresher Interface | MS WMI | f1e9c5b2-f59b-11d2-b362-00105a1f8177 |
| Microsoft Exchange - Undocumented Interface 5 | MS Exchange | f1f21151-7185-4170-ac8d-9bb077c29bd3 |
| Microsoft Exchange - Undocumented Interface 3 | MS Exchange | f224209f-9076-40f7-98ad-5416dbfa178e |
| Microsoft Windows Management Instrumentation (WMI) - Remote Protocol - IWbemLevel1Login Interface | MS WMI | f309ad18-d86a-11d0-a075-00c04fb68820 |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IWRMProtocol Interface | MS System Resource | f31931a9-832d-481c-9503-887a0e6a79f0 |
| Microsoft File Server Resource Manager Protocol - IFsrmFileScreenBase Interface | MS File Server | f3637e80-5b22-4a2b-a637-bbb642b41cfc |
| Microsoft File Server Resource Manager Protocol - IFsrmSetting Interface | MS File Server | f411d4fd-14be-4260-8c40-03b7c95e608a |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEnumEventObject Interface Interface | MS COM+ Event System | f4a07d63-2e25-11d1-9964-00c04fbbb345 |
| Microsoft Cryptographic Services - ICatDBSvc | MS Crypto | f50aac00-c7f3-428e-a022-a6b71bfb9d43 |
| Microsoft File Replication Service (FRS) - exchange_drs - frsrpc Interface | MS File Replication | f5cc59b4-4264-101a-8c59-08002b2f8426 |
| Microsoft Exchange Name Service Provider Interface (NSPI) Proxy - exchange_nsp Interface | MS Exchange | f5cc5a18-4264-101a-8c59-08002b2f8426 |
| Microsoft Exchange - Active Directory Extended Directory Service (XDS) - exchange_xds Interface | MS Exchange | f5cc5a7c-4264-101a-8c59-08002b2f8426 |
| Microsoft Internet Information Services (IIS) - IMSAdminBaseW - IMSAdminBase3W Interface | MS IIS | f612954d-3b0b-4c56-9563-227b7be624b4 |
| Microsoft EventLog Remoting Protocol Version 6.0 - IEventService Interface | MS Event | f6beaff7-1e19-4fbb-9f8f-b89e2018337c |
| Microsoft Message Queuing - ActiveX Client - MSMQCollection | MS Message Queuing | f72b9031-2f0c-43e8-924e-e6052cdc493f |
| Microsoft File Server Resource Manager Protocol - IFsrmCollection Interface | MS File Server | f76fbf3b-8ddd-4b42-b05a-cb1c3ff1fee8 |
| Microsoft File Server Resource Manager Protocol - IFsrmAutoApplyQuota Interface | MS File Server | f82e5729-6aba-4740-bfc7-c7f58f75fb7b |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventObjectCollection Interface | MS COM+ Event System | f89ac270-d4eb-11d1-b682-00805fc79216 |
| Microsoft Exchange - Exchange System Attendant Cluster Interface (exchange_sysatt_cluster) | MS Exchange | f930c514-1215-11d3-99a5-00a0c9b61b04 |
| Microsoft Internet Information Services (IIS) - Application Host COM - IAppHostWritableAdminManager Interface | MS IIS | fa7660f6-7b3f-4237-a8bf-ed0ad0dcbbd9 |
| Microsoft Shadow Copy Management Protocol - IVssSnapshotMgmt Interface | MS Volume Shadow Copy | fa7df749-66e7-4986-a27f-e2f04ae53772 |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventClass Interface | MS COM+ Event System | fb2b72a0-7a68-11d1-88f9-0080c7d771bf |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventClass2 Interface | MS COM+ Event System | fb2b72a1-7a68-11d1-88f9-0080c7d771bf |
| Microsoft Component Object Model Plus (COM+) Event System Protocol - IEventSubscription3 Interface | MS COM+ Event System | fbc1d17d-c498-43a0-81af-423ddd530af6 |
| Microsoft Message Queuing - Management Service | MS Message Queuing | fc13257d-5567-4dea-898d-c6f9c48415a0 |
| Microsoft Virtual Disk Service (VDS) Protocol - IVdsServiceSAN Interface | MS Virtual Disk | fc5d23e8-a88b-41a5-8de0-2d2f73c5a630 |
| Microsoft Windows System Resource Manager (WSRM) Protocol - IWRMRemoteSessionMgmt Interface | MS System Resource | fc910418-55ca-45ef-b264-83d4ce7d30e0 |
| Microsoft Message Queuing - ActiveX Client - IMSMQQueueInfo2 Interface | MS Message Queuing | fd174a80-89cf-11d2-b0f2-00e02c074f6b |
| Microsoft Message Queuing - Queue Manager Client Protocol - qmcomm Interface | MS Message Queuing | fdb3a030-065f-11d1-bb9b-00a024ea5525 |
| Microsoft Trusted Platform Module Virtual Smart Card Management Protocol - ITpmVirtualSmartCardManager2 Interface | MS TPM Smart Card Mgt | fdf8a2b9-02de-47f4-bc26-aa85ab5e5267 |
| Microsoft iSCSI Software Target Management Protocol - IHost3 Interface | MS ISTM iSCSI | fe7f99f9-1dfb-4afb-9d00-6a8dd0aabf2c |
| Microsoft Telnet Server Remote Administration Protocol (MS-TSRAP) - CLSID_EnumTelnetClientsSvr Interface | MS Telnet Server | fe9e48a4-a014-11d1-855c-00a0c944138c |
| Microsoft File Server Resource Manager Protocol - IFsrmFileScreenManager Interface | MS File Server | ff4fa04e-5a94-4bda-a3a0-d5b4d3c52eba |
### dnsclass This field does not allow any custom items.
| Name | Value | Description |
|---|---|---|
| IN | 1 - 0x1 | Internet |
| CS | 2 - 0x2 | CSNET class (Obsolete - used only for examples) |
| CH | 3 - 0x3 | CHAOS class |
| HS | 4 - 0x4 | Hesiod |
### dnscode This field does not allow any custom items.
| Name | Value | Description |
|---|---|---|
| No DNS Response | -1 - 0x-1 | No DNS Response |
| NoError | 0 - 0x0 | No Error |
| FormErr | 1 - 0x1 | Format Error |
| ServFail | 2 - 0x2 | Server Failure |
| NXDomain | 3 - 0x3 | Non-Existent Domain |
| NotImp | 4 - 0x4 | Not Implemented |
| Refused | 5 - 0x5 | Query Refused |
| YXDomain | 6 - 0x6 | Name Exists when it should not |
| YXRRSet | 7 - 0x7 | RR Set Exists when it should not |
| NXRRSet | 8 - 0x8 | RR Set that should exist does not |
| NotAuth | 9 - 0x9 | Server Not Authoritative for zone |
| NotZone | 10 - 0xA | Name not contained in zone |
| BadSig/BadVers | 16 - 0x10 | TSIG Signature Failure OR Bad OPT version |
| BadKey | 17 - 0x11 | Key not recognized |
| BadTime | 18 - 0x12 | Signature out of time window |
| BadMode | 19 - 0x13 | Bad TKEY Mode |
| BadName | 20 - 0x14 | Duplicate key name |
| BadAlg | 21 - 0x15 | Algorithm not supported |
| BadTrunc | 22 - 0x16 | Bad Truncation |
### dnstype This field does not allow any custom items.
| Name | Value | Description |
|---|---|---|
| RESERVED | 0 - 0x0 | reserved type, sometimes mistakenly used by Microsoft protocols |
| A | 1 - 0x1 | a host address |
| NS | 2 - 0x2 | an authoritative name server |
| MD | 3 - 0x3 | a mail destination (Obsolete - use MX) |
| MF | 4 - 0x4 | a mail forwarder (Obsolete - use MX) |
| CNAME | 5 - 0x5 | the canonical name for an alias |
| SOA | 6 - 0x6 | marks the start of a zone of authority |
| MB | 7 - 0x7 | a mailbox domain name (EXPERIMENTAL) |
| MG | 8 - 0x8 | a mail group member (EXPERIMENTAL) |
| MR | 9 - 0x9 | a mail rename domain name (EXPERIMENTAL) |
| NULL | 10 - 0xA | a null RR (EXPERIMENTAL) |
| WKS | 11 - 0xB | a well known service description |
| PTR | 12 - 0xC | a domain name pointer |
| HINFO | 13 - 0xD | host information |
| MINFO | 14 - 0xE | mailbox or mail list information |
| MX | 15 - 0xF | mail exchange |
| TXT | 16 - 0x10 | text strings |
| RP | 17 - 0x11 | for Responsible Person |
| AFSDB | 18 - 0x12 | for AFS Data Base location |
| X25 | 19 - 0x13 | for X.25 PSDN address |
| ISDN | 20 - 0x14 | for ISDN address |
| RT | 21 - 0x15 | for Route Through |
| NSAP | 22 - 0x16 | for NSAP address, NSAP style A record |
| NSAP-PTR | 23 - 0x17 | for domain name pointer, NSAP style |
| SIG | 24 - 0x18 | for security signature |
| KEY | 25 - 0x19 | for security key |
| PX | 26 - 0x1A | X.400 mail mapping information |
| GPOS | 27 - 0x1B | Geographical Position |
| AAAA | 28 - 0x1C | a IP6 host address |
| LOC | 29 - 0x1D | Location Information |
| NXT | 30 - 0x1E | Next Domain - OBSOLETE |
| EID | 31 - 0x1F | Endpoint Identifier |
| NIMLOC/NB | 32 - 0x20 | Nimrod Locator OR Netbios |
| SRV/NBSTAT | 33 - 0x21 | Server Selection OR Netbios Stats |
| ATMA | 34 - 0x22 | ATM Address |
| NAPTR | 35 - 0x23 | Naming Authority Pointer |
| KX | 36 - 0x24 | Key Exchanger |
| CERT | 37 - 0x25 | CERT |
| A6 | 38 - 0x26 | A6 (Experimental) |
| DNAME | 39 - 0x27 | DNAME |
| SINK | 40 - 0x28 | SINK |
| OPT | 41 - 0x29 | OPT |
| APL | 42 - 0x2A | APL |
| DS | 43 - 0x2B | Delegation Signer |
| SSHFP | 44 - 0x2C | SSH Key Fingerprint |
| IPSECKEY | 45 - 0x2D | IPSECKEY |
| RRSIG | 46 - 0x2E | RRSIG |
| NSEC | 47 - 0x2F | NSEC |
| DNSKEY | 48 - 0x30 | DNSKEY |
| DHCID | 49 - 0x31 | DHCID |
| NSEC3 | 50 - 0x32 | NSEC3 |
| NSEC3PARAM | 51 - 0x33 | NSEC3PARAM |
| HIP | 55 - 0x37 | Host Identity Protocol |
| NINFO | 56 - 0x38 | NINFO |
| RKEY | 57 - 0x39 | RKEY |
| TALINK | 58 - 0x3A | Trust Anchor LINK |
| CDS | 59 - 0x3B | Child DS |
| SPF | 99 - 0x63 | |
| UINFO | 100 - 0x64 | |
| UID | 101 - 0x65 | |
| GID | 102 - 0x66 | |
| UNSPEC | 103 - 0x67 | |
| TKEY | 249 - 0xF9 | Transaction Key |
| TSIG | 250 - 0xFA | Transaction Signature |
| IXFR | 251 - 0xFB | incremental transfer |
| AXFR | 252 - 0xFC | transfer of an entire zone |
| MAILB | 253 - 0xFD | mailbox-related RRs (MB, MG or MR) |
| MAILA | 254 - 0xFE | mail agent RRs (Obsolete - see MX) |
| * | 255 - 0xFF | A request for all records |
| URI | 256 - 0x100 | URI |
| CAA | 257 - 0x101 | Certification Authority Authorization |
| TA | 32768 - 0x8000 | DNSSEC Trust Authorities |
| DLV | 32769 - 0x8001 | DNSSEC Lookaside Validation |
### email_command | Name | Value | | — | —-| | HELO | 0 - 0x0 | | EHLO | 1 - 0x1 | | MAIL FROM | 2 - 0x2 | | RCPT TO | 3 - 0x3 | | DATA | 4 - 0x4 | | NOOP | 5 - 0x5 | | HELP | 6 - 0x6 | | VRFY | 7 - 0x7 | | EXPN | 8 - 0x8 | | RSET | 9 - 0x9 | | QUIT | 10 - 0xA | | SEND | 11 - 0xB | | SOML | 12 - 0xC | | SAML | 13 - 0xD | | RELAY | 14 - 0xE | | TLS | 15 - 0xF | | TURN | 16 - 0x10 | | STARTTLS | 17 - 0x11 | | AUTH LOGIN | 18 - 0x12 | | AUTH | 19 - 0x13 | | ATRN | 20 - 0x14 | | BDAT | 21 - 0x15 | | ETRN | 22 - 0x16 | | USER | 23 - 0x17 | | PASS | 24 - 0x18 | | ENDMAIL | 25 - 0x19 |
### email_response_code | Name | Value | Description | | — | —-| —-| | SERVER_CONNECTION_ERROR | 101 - 0x65 | Server connection error (wrong server description or connection port| | SYSTEM_STATUS | 211 - 0xD3 | System status, or system help reply| | HELP | 214 - 0xD6 | Help message| | SERVICE_READY | 220 - 0xDC | <domain> Service ready| | SERVICE_CLOSING | 221 - 0xDD | <domain> Service closing transmission channel| | AUHENTICATION_SUCCESS | 235 - 0xEB | Authentication successful| | COMPLETED | 250 - 0xFA | Requested mail action okay, completed| | WILL_FORWARD | 251 - 0xFB | User not local; will forward to <forward-path>| | CANNOT_VRFY_BUT_ACCEPT | 252 - 0xFC | Cannot VRFY user, but will accept message and attempt delivery| | AUTH_INPUT | 334 - 0x14E | AUTH input| | START_MAIL | 354 - 0x162 | Start mail input; end with <CRLF>.<CRLF>| | SERVICE_UNAVAILABLE | 421 - 0x1A5 | <domain> Service not available, closing transmission channel| | MAILBOX_EXCEEDS_STORAGE_LIMIT | 422 - 0x1A6 | The recipient’s mailbox has exceeded its storage limit| | FILE_OVERLOAD | 431 - 0x1AF | File overload (too many messages sent to a particular domain)| | PASSWORD_TRANSITION_NEEDED | 432 - 0x1B0 | A password transition is needed| | NO_RESPONSE | 441 - 0x1B9 | No response from the recipient’s server| | CONNECTION_DROPPED | 442 - 0x1BA | Connection dropped| | INTERNAL_LOOP_OCCURRED | 446 - 0x1BE | Internal loop has occurred| | MAILBOX_UNAVAILABLE | 450 - 0x1C2 | Requested mail action not taken: mailbox unavailable| | LOCAL_ERROR | 451 - 0x1C3 | Requested action aborted: local error in processing| | INSUFFICIENT_SYSTEM_STORAGE | 452 - 0x1C4 | Requested action not taken: insufficient system storage| | TEMPORARY_AUTH_FAILED | 454 - 0x1C6 | Temporary authenticaion failed| | PARAMETERS_CANNOT_ACCOMODATE | 455 - 0x1C7 | Parameters cannot be accommodated| | SPAM_FILTER | 471 - 0x1D7 | Mail server error due to the local spam filter| | SYNTAX_ERROR_COMMAND | 500 - 0x1F4 | Syntax error, command unrecognized| | SYNTAX_ERROR_ARGUMENT | 501 - 0x1F5 | Syntax error in parameters or arguments| | COMMAND_NOT_IMPLEMENTED | 502 - 0x1F6 | Command not implemented| | BAD_COMMAND_SEQUENCE | 503 - 0x1F7 | Bad sequence of commands| | COMMAND_PARAMETER_NOT_IMPLEMENTED | 504 - 0x1F8 | Command parameter not implemented| | INVALID_EMAIL_ADDRESS | 510 - 0x1FE | Invalid email address| | DNS_ERROR | 512 - 0x200 | A DNS error (recheck the address of your recipients)| | TOTAL_MAILING_SIZE_EXCEEDS_LIMIT | 523 - 0x20B | The total size of your mailing exceeds the recipient server limits| | AUTHENTICATION_REQUIRED | 530 - 0x212 | Authentication required| | AUTHENTICATION_TOO_WEAK | 534 - 0x216 | Authentication mechanism is too weak| | INVALID_CREDENTIALS | 535 - 0x217 | Authentication credentials invalid| | ENCRYPTION_REQUIRED | 538 - 0x21A | Encryption required for requested authentication mechanism| | REJECTED_SPAM_FILTER | 541 - 0x21D | Message rejected by spam filter| | MAILBOX_UNAVAILABLE_2 | 550 - 0x226 | Requested action not taken: mailbox unavailable| | USER_NOT_LOCAL_TRY_FORWARD | 551 - 0x227 | User not local; please try <forward-path>| | EXCEEDED_STORAGE_ALLOCATION | 552 - 0x228 | Requested mail action aborted: exceeded storage allocation| | MAILBOX_NAME_NOT_ALLOWED | 553 - 0x229 | Requested action not taken: mailbox description not allowed| | TRANSACTION_FAILED | 554 - 0x22A | Transaction failed| | PARAMETERS_NOT_RECOGNISED | 555 - 0x22B | Parameters not recognized/ not implemented (response to MAIL FROM or RCPT TO)|
### encryption This field does not allow any custom items.
| Name | Value |
|---|---|
| Off | 0 - 0x0 |
| Off stream | 1 - 0x1 |
| Basic | 2 - 0x2 |
| Basic stream | 3 - 0x3 |
| Rc5 | 4 - 0x4 |
### ethernetprotocol This field does not allow any custom items.
| Name | Value |
|---|---|
| XEROX PUP | 512 - 0x200 |
| PUP Addr Trans | 513 - 0x201 |
| Nixdorf (conflicts with 802.3 Length Field) | 1024 - 0x400 |
| Ethernet II | 1528 - 0x5F8 |
| XEROX NS IDP | 1536 - 0x600 |
| XNS Address Translation | 1537 - 0x601 |
| DLog | 1632 - 0x660 |
| DLog | 1633 - 0x661 |
| IPv4 | 2048 - 0x800 |
| Valid Systems | 2049 - 0x801 |
| NBS Internet | 2050 - 0x802 |
| ECMA Internet | 2051 - 0x803 |
| Chaosnet | 2052 - 0x804 |
| X.25 Level 3 | 2053 - 0x805 |
| ARP | 2054 - 0x806 |
| XNS Compatability | 2055 - 0x807 |
| Frame Relay ARP | 2056 - 0x808 |
| Symbolics Private | 2076 - 0x81C |
| Wake-on-LAN (WOL) | 2114 - 0x842 |
| Xyplex | 2184 - 0x888 |
| Xyplex | 2185 - 0x889 |
| Xyplex | 2186 - 0x88A |
| WiMax Mac to Mac Packet | 2288 - 0x8F0 |
| G8BPQ AX.25 over Ethernet | 2303 - 0x8FF |
| Ungermann-Bass net debugr | 2304 - 0x900 |
| Xerox IEEE802.3 PUP | 2560 - 0xA00 |
| PUP Addr Trans | 2561 - 0xA01 |
| Banyan VINES | 2989 - 0xBAD |
| VINES Loopback | 2990 - 0xBAE |
| VINES Echo | 2991 - 0xBAF |
| Berkeley Trailer nego | 4096 - 0x1000 |
| Berkeley Trailer encap/IP | 4097 - 0x1001 |
| DCA - Multicast | 4660 - 0x1234 |
| Valid Systems | 5632 - 0x1600 |
| TRAIL - MS Network Monitor Summary Packet | 6532 - 0x1984 |
| Artificial Horizons | 6537 - 0x1989 |
| Datapoint Corporation | 6549 - 0x1995 |
| Cisco Group Multicast Protocol (CGMP) | 8193 - 0x2001 |
| GigaSMART Headers | 8933 - 0x22E5 |
| Multiple Stream Reservation Protocol (MSRP) | 8938 - 0x22EA |
| Audio Video Bridging Transport Protocol (AVBTP) | 8944 - 0x22F0 |
| Robust Header Compression (ROHC) | 8945 - 0x22F1 |
| Transparent Interconnection of Lots of Links (TRILL) | 8947 - 0x22F3 |
| Intermediate System to Intermediate System | 8948 - 0x22F4 |
| Intel Centrino Promiscuous Packets | 9298 - 0x2452 |
| 3Com NBP Virtual Circuit Datagram | 15360 - 0x3C00 |
| 3Com NBP System Control Datagram | 15361 - 0x3C01 |
| 3Com NBP Connect Request (Virtual CCT) | 15362 - 0x3C02 |
| 3Com NBP Connect Response | 15363 - 0x3C03 |
| 3Com NBP Connect Complete | 15364 - 0x3C04 |
| 3Com NBP Close Request (Virtual CCT) | 15365 - 0x3C05 |
| 3Com NBP Close Response | 15366 - 0x3C06 |
| 3Com NBP Datagram | 15367 - 0x3C07 |
| 3Com NBP Datagram Broadcast | 15368 - 0x3C08 |
| 3Com NBP Claim NetBIOS Name | 15369 - 0x3C09 |
| 3Com NBP Delete Netbios Name | 15370 - 0x3C0A |
| 3Com NBP Remote Adaptor Status Request | 15371 - 0x3C0B |
| 3Com NBP Remote Adaptor Response | 15372 - 0x3C0C |
| 3Com NBP Reset | 15373 - 0x3C0D |
| Ethernet Powerlink (EPL v1) | 15935 - 0x3E3F |
| PCS Basic Block Protocol | 16962 - 0x4242 |
| Information Modes Little Big LAN Diagnostic | 16972 - 0x424C |
| THD - Diddle | 17185 - 0x4321 |
| Information Modes Little Big LAN | 19522 - 0x4C42 |
| BBN Simnet | 21000 - 0x5208 |
| DEC Unassigned | 24576 - 0x6000 |
| DEC Maintenance Operation Protocol (MOP) | 24577 - 0x6001 |
| DEC Maintenance Operation Protocol (MOP) | 24578 - 0x6002 |
| DECNET Phase IV | 24579 - 0x6003 |
| DEC Local Area Transport (LAT) | 24580 - 0x6004 |
| DEC Diagnostic Protocol | 24581 - 0x6005 |
| DEC Customer Protocol | 24582 - 0x6006 |
| DEC Local Area VAX Cluster (LAVC) | 24583 - 0x6007 |
| DEC AMBER | 24584 - 0x6008 |
| DEC MUMPS | 24585 - 0x6009 |
| 3Com Corporation | 24592 - 0x6010 |
| 3Com Corporation | 24593 - 0x6011 |
| 3Com Corporation | 24594 - 0x6012 |
| 3Com Corporation | 24595 - 0x6013 |
| 3Com Corporation | 24596 - 0x6014 |
| Trans Ether Bridging | 25944 - 0x6558 |
| Raw Frame Relay | 25945 - 0x6559 |
| Ungermann-Bass download | 28672 - 0x7000 |
| Ungermann-Bass NIUs | 28673 - 0x7001 |
| Ungermann-Bass dia/loop | 28674 - 0x7002 |
| Ungermann-Bass (NMC to/from UB Bridge) | 28675 - 0x7003 |
| Ungermann-Bass Bridge Spanning Tree | 28676 - 0x7004 |
| OS/9 Microware | 28679 - 0x7007 |
| OS/9 Net | 28681 - 0x7009 |
| Sintrom (was LRT - England) | 28704 - 0x7020 |
| Sintrom (was LRT - England) | 28705 - 0x7021 |
| Sintrom (was LRT - England) | 28706 - 0x7022 |
| Sintrom (was LRT - England) | 28707 - 0x7023 |
| Sintrom (was LRT - England) | 28708 - 0x7024 |
| Sintrom (was LRT - England) | 28709 - 0x7025 |
| Sintrom (was LRT - England) | 28710 - 0x7026 |
| Sintrom (was LRT - England) | 28711 - 0x7027 |
| Sintrom (was LRT - England) | 28712 - 0x7028 |
| Sintrom (was LRT - England) | 28713 - 0x7029 |
| Proteon | 28720 - 0x7030 |
| Prime NTS (Network Terminal Service) | 28721 - 0x7031 |
| Cabletron | 28724 - 0x7034 |
| Cronus VLN | 32771 - 0x8003 |
| Cronus Direct | 32772 - 0x8004 |
| HP Probe | 32773 - 0x8005 |
| Nestar | 32774 - 0x8006 |
| AT&T | 32776 - 0x8008 |
| Excelan | 32784 - 0x8010 |
| SGI diagnostics | 32787 - 0x8013 |
| SGI network games | 32788 - 0x8014 |
| SGI reserved | 32789 - 0x8015 |
| SGI bounce server | 32790 - 0x8016 |
| Apollo Domain | 32793 - 0x8019 |
| Tymshare | 32815 - 0x802F |
| Tigan, Inc. | 32816 - 0x8030 |
| Reverse ARP | 32821 - 0x8035 |
| Aeonic Systems | 32822 - 0x8036 |
| IPX (Novell Netware) | 32823 - 0x8037 |
| DEC LANBridge Management | 32824 - 0x8038 |
| DEC DSM/DDP | 32825 - 0x8039 |
| DEC Argonaut Console | 32826 - 0x803A |
| DEC VAXELN | 32827 - 0x803B |
| DEC DNS Naming Service | 32828 - 0x803C |
| DEC Ethernet CSMA/CD Encryption Protocol | 32829 - 0x803D |
| DEC Distributed Time Service | 32830 - 0x803E |
| DEC LAN Traffic Monitor Protocol | 32831 - 0x803F |
| DEC PATHWORKS DECnet NETBIOS Emulation | 32832 - 0x8040 |
| DEC Local Area System Transport | 32833 - 0x8041 |
| DEC unassigned | 32834 - 0x8042 |
| Planning Research Corp. | 32836 - 0x8044 |
| AT&T | 32838 - 0x8046 |
| AT&T | 32839 - 0x8047 |
| DEC Availability Manager | 32840 - 0x8048 |
| ExperData | 32841 - 0x8049 |
| VMTP (Versatile Message Transaction Protocol) | 32859 - 0x805B |
| Stanford V Kernel prod. | 32860 - 0x805C |
| Evans & Sutherland | 32861 - 0x805D |
| Little Machines | 32864 - 0x8060 |
| Counterpoint Computers | 32866 - 0x8062 |
| Univ. of Mass. @ Amherst | 32869 - 0x8065 |
| Univ. of Mass. @ Amherst | 32870 - 0x8066 |
| Veeco Integrated Auto. | 32871 - 0x8067 |
| General Dynamics | 32872 - 0x8068 |
| AT&T | 32873 - 0x8069 |
| Autophon | 32874 - 0x806A |
| ComDesign | 32876 - 0x806C |
| Computgraphic Corp. | 32877 - 0x806D |
| Landmark Graphics Corporation | 32878 - 0x806E |
| Landmark Graphics Corporation | 32879 - 0x806F |
| Landmark Graphics Corporation | 32880 - 0x8070 |
| Landmark Graphics Corporation | 32881 - 0x8071 |
| Landmark Graphics Corporation | 32882 - 0x8072 |
| Landmark Graphics Corporation | 32883 - 0x8073 |
| Landmark Graphics Corporation | 32884 - 0x8074 |
| Landmark Graphics Corporation | 32885 - 0x8075 |
| Landmark Graphics Corporation | 32886 - 0x8076 |
| Landmark Graphics Corporation | 32887 - 0x8077 |
| Matra | 32890 - 0x807A |
| Dansk Data Elektronik | 32891 - 0x807B |
| Merit Internodal | 32892 - 0x807C |
| Vitalink Communications | 32893 - 0x807D |
| Vitalink Communications | 32894 - 0x807E |
| Vitalink Communications | 32895 - 0x807F |
| Vitalink TransLAN III | 32896 - 0x8080 |
| Counterpoint Computers | 32897 - 0x8081 |
| Counterpoint Computers | 32898 - 0x8082 |
| Counterpoint Computers | 32899 - 0x8083 |
| Xyplex | 32904 - 0x8088 |
| Xyplex | 32906 - 0x808A |
| Ethertalk (AppleTalk over Ethernet) | 32923 - 0x809B |
| Datability | 32924 - 0x809C |
| Datability | 32925 - 0x809D |
| Datability | 32926 - 0x809E |
| Spider Systems Ltd. | 32927 - 0x809F |
| Nixdorf Computers | 32931 - 0x80A3 |
| Siemens Gammasonics Inc. | 32932 - 0x80A4 |
| Siemens Gammasonics Inc. | 32933 - 0x80A5 |
| Siemens Gammasonics Inc. | 32934 - 0x80A6 |
| Siemens Gammasonics Inc. | 32935 - 0x80A7 |
| Siemens Gammasonics Inc. | 32936 - 0x80A8 |
| Siemens Gammasonics Inc. | 32937 - 0x80A9 |
| Siemens Gammasonics Inc. | 32938 - 0x80AA |
| Siemens Gammasonics Inc. | 32939 - 0x80AB |
| Siemens Gammasonics Inc. | 32940 - 0x80AC |
| Siemens Gammasonics Inc. | 32941 - 0x80AD |
| Siemens Gammasonics Inc. | 32942 - 0x80AE |
| Siemens Gammasonics Inc. | 32943 - 0x80AF |
| Siemens Gammasonics Inc. | 32944 - 0x80B0 |
| Siemens Gammasonics Inc. | 32945 - 0x80B1 |
| Siemens Gammasonics Inc. | 32946 - 0x80B2 |
| Siemens Gammasonics Inc. | 32947 - 0x80B3 |
| DCA Data Exchange Cluster | 32960 - 0x80C0 |
| DCA Data Exchange Cluster | 32961 - 0x80C1 |
| DCA Data Exchange Cluster | 32962 - 0x80C2 |
| DCA Data Exchange Cluster | 32963 - 0x80C3 |
| Banyan Systems | 32964 - 0x80C4 |
| Banyan Systems | 32965 - 0x80C5 |
| Pacer Software | 32966 - 0x80C6 |
| Applitek Corporation | 32967 - 0x80C7 |
| Intergraph Corporation | 32968 - 0x80C8 |
| Intergraph Corporation | 32969 - 0x80C9 |
| Intergraph Corporation | 32970 - 0x80CA |
| Intergraph Corporation | 32971 - 0x80CB |
| Intergraph Corporation | 32972 - 0x80CC |
| Harris Corporation | 32973 - 0x80CD |
| Harris Corporation | 32974 - 0x80CE |
| Taylor Instrument | 32975 - 0x80CF |
| Taylor Instrument | 32976 - 0x80D0 |
| Taylor Instrument | 32977 - 0x80D1 |
| Taylor Instrument | 32978 - 0x80D2 |
| Rosemount Corporation | 32979 - 0x80D3 |
| Rosemount Corporation | 32980 - 0x80D4 |
| IBM SNA Service on Ether | 32981 - 0x80D5 |
| Varian Associates | 32989 - 0x80DD |
| Transparent Remote File System (TRFS) | 32990 - 0x80DE |
| Transparent Remote File System (TRFS) | 32991 - 0x80DF |
| Allen-Bradley | 32992 - 0x80E0 |
| Allen-Bradley | 32993 - 0x80E1 |
| Allen-Bradley | 32994 - 0x80E2 |
| Allen-Bradley | 32995 - 0x80E3 |
| Datability | 32996 - 0x80E4 |
| Datability | 32997 - 0x80E5 |
| Datability | 32998 - 0x80E6 |
| Datability | 32999 - 0x80E7 |
| Datability | 33000 - 0x80E8 |
| Datability | 33001 - 0x80E9 |
| Datability | 33002 - 0x80EA |
| Datability | 33003 - 0x80EB |
| Datability | 33004 - 0x80EC |
| Datability | 33005 - 0x80ED |
| Datability | 33006 - 0x80EE |
| Datability | 33007 - 0x80EF |
| Datability | 33008 - 0x80F0 |
| Retix | 33010 - 0x80F2 |
| AppleTalk AARP (Kinetics) | 33011 - 0x80F3 |
| Kinetics | 33012 - 0x80F4 |
| Kinetics | 33013 - 0x80F5 |
| Apollo Computer | 33015 - 0x80F7 |
| Wellfleet Communications | 33023 - 0x80FF |
| IEEE 802.1Q VLAN-tagged | 33024 - 0x8100 |
| Wellfleet Communications | 33025 - 0x8101 |
| Wellfleet - BOFL (Breath Of Life) | 33026 - 0x8102 |
| Wellfleet Communications | 33027 - 0x8103 |
| Symbolics Private | 33031 - 0x8107 |
| Symbolics Private | 33032 - 0x8108 |
| Symbolics Private | 33033 - 0x8109 |
| Talaris | 33067 - 0x812B |
| Hayes Microcomputers | 33072 - 0x8130 |
| VG Laboratory Systems | 33073 - 0x8131 |
| Bridge Communications | 33074 - 0x8132 |
| Juniper NetScreen Redundancy Protocol (NSRP v2) | 33075 - 0x8133 |
| Bridge Communications | 33076 - 0x8134 |
| Bridge Communications | 33077 - 0x8135 |
| Bridge Communications | 33078 - 0x8136 |
| IPX - NetWare | 33079 - 0x8137 |
| IPX - Novell | 33080 - 0x8138 |
| KTI | 33081 - 0x8139 |
| KTI | 33082 - 0x813A |
| KTI | 33083 - 0x813B |
| KTI | 33084 - 0x813C |
| KTI | 33085 - 0x813D |
| M/MUMPS Data Sharing | 33087 - 0x813F |
| Amoeba 4 RPC - Vrije Universiteit (NL) | 33093 - 0x8145 |
| Fast Local Internet Protocol (FLIP) | 33094 - 0x8146 |
| Vrije Universiteit (NL) | 33095 - 0x8147 |
| Logicraft | 33096 - 0x8148 |
| Network Computing Devices | 33097 - 0x8149 |
| Alpha Micro | 33098 - 0x814A |
| SNMP over Eth. | 33100 - 0x814C |
| BIIN | 33101 - 0x814D |
| BIIN 814F Technically Elite Concepts | 33102 - 0x814E |
| Technically Elite Concepts | 33103 - 0x814F |
| Rational Corp | 33104 - 0x8150 |
| Qualcomm | 33105 - 0x8151 |
| Qualcomm | 33106 - 0x8152 |
| Qualcomm | 33107 - 0x8153 |
| Computer Protocol Pty Ltd | 33116 - 0x815C |
| Computer Protocol Pty Ltd | 33117 - 0x815D |
| Computer Protocol Pty Ltd | 33118 - 0x815E |
| Charles River Data System | 33124 - 0x8164 |
| Charles River Data System | 33125 - 0x8165 |
| Charles River Data System | 33126 - 0x8166 |
| XTP | 33149 - 0x817D |
| SGI/Time Warner Proprietary | 33150 - 0x817E |
| High-Performance Parallel Interface-Framing (HIPPI-FP) | 33152 - 0x8180 |
| High-Performance Parallel Interface-Scheduled Transfer (HIPPI-STP) | 33153 - 0x8181 |
| Reserved for HIPPI-6400 | 33154 - 0x8182 |
| Reserved for HIPPI-6400 | 33155 - 0x8183 |
| Silicon Graphics Proprietary | 33156 - 0x8184 |
| Silicon Graphics Proprietary | 33157 - 0x8185 |
| Silicon Graphics Proprietary | 33158 - 0x8186 |
| Silicon Graphics Proprietary | 33159 - 0x8187 |
| Silicon Graphics Proprietary | 33160 - 0x8188 |
| Silicon Graphics Proprietary | 33161 - 0x8189 |
| Silicon Graphics Proprietary | 33162 - 0x818A |
| Silicon Graphics Proprietary | 33163 - 0x818B |
| Silicon Graphics Proprietary | 33164 - 0x818C |
| Motorola Computer | 33165 - 0x818D |
| PowerLAN / NetBIOS/NetBEUI (PC) | 33169 - 0x8191 |
| Qualcomm | 33178 - 0x819A |
| Qualcomm | 33179 - 0x819B |
| Qualcomm | 33180 - 0x819C |
| Qualcomm | 33181 - 0x819D |
| Qualcomm | 33182 - 0x819E |
| Qualcomm | 33183 - 0x819F |
| Qualcomm | 33184 - 0x81A0 |
| Qualcomm | 33185 - 0x81A1 |
| Qualcomm | 33186 - 0x81A2 |
| Qualcomm | 33187 - 0x81A3 |
| ARAI Bunkichi | 33188 - 0x81A4 |
| RAD Network Devices | 33189 - 0x81A5 |
| RAD Network Devices | 33198 - 0x81AE |
| Xyplex | 33207 - 0x81B7 |
| Xyplex | 33208 - 0x81B8 |
| Xyplex | 33209 - 0x81B9 |
| Apricot Computers | 33228 - 0x81CC |
| Apricot Computers | 33229 - 0x81CD |
| Apricot Computers | 33230 - 0x81CE |
| Apricot Computers | 33231 - 0x81CF |
| Apricot Computers | 33232 - 0x81D0 |
| Apricot Computers | 33233 - 0x81D1 |
| Apricot Computers | 33234 - 0x81D2 |
| Apricot Computers | 33235 - 0x81D3 |
| Apricot Computers | 33236 - 0x81D4 |
| Apricot Computers | 33237 - 0x81D5 |
| Artisoft Lantastic | 33238 - 0x81D6 |
| Artisoft Lantastic | 33239 - 0x81D7 |
| Artisoft Lantastic | 33240 - 0x81D8 |
| Artisoft Lantastic | 33241 - 0x81D9 |
| Artisoft Lantastic | 33242 - 0x81DA |
| Artisoft Lantastic | 33243 - 0x81DB |
| Artisoft Lantastic | 33244 - 0x81DC |
| Artisoft Lantastic | 33245 - 0x81DD |
| Polygon | 33254 - 0x81E6 |
| Polygon | 33255 - 0x81E7 |
| Polygon | 33256 - 0x81E8 |
| Polygon | 33257 - 0x81E9 |
| Polygon | 33258 - 0x81EA |
| Polygon | 33259 - 0x81EB |
| Polygon | 33260 - 0x81EC |
| Polygon | 33261 - 0x81ED |
| Polygon | 33262 - 0x81EE |
| Polygon | 33263 - 0x81EF |
| Comsat Labs | 33264 - 0x81F0 |
| Comsat Labs | 33265 - 0x81F1 |
| Comsat Labs | 33266 - 0x81F2 |
| SAIC | 33267 - 0x81F3 |
| SAIC | 33268 - 0x81F4 |
| SAIC | 33269 - 0x81F5 |
| VG Analytical | 33270 - 0x81F6 |
| VG Analytical | 33271 - 0x81F7 |
| VG Analytical | 33272 - 0x81F8 |
| Cabletron InterSwitch Message Protocol | 33277 - 0x81FD |
| Cabletron InterSwitch Message Protocol | 33279 - 0x81FF |
| QNX QNet Software Systems Ltd. | 33283 - 0x8203 |
| QNX QNet Software Systems Ltd. | 33284 - 0x8204 |
| QNX QNet Software Systems Ltd. | 33285 - 0x8205 |
| Ascom Banking Systems | 33313 - 0x8221 |
| Ascom Banking Systems | 33314 - 0x8222 |
| Advanced Encryption System | 33342 - 0x823E |
| Advanced Encryption System | 33343 - 0x823F |
| Advanced Encryption System | 33344 - 0x8240 |
| Charles River Data System | 33379 - 0x8263 |
| Charles River Data System | 33380 - 0x8264 |
| Charles River Data System | 33381 - 0x8265 |
| Charles River Data System | 33382 - 0x8266 |
| Charles River Data System | 33383 - 0x8267 |
| Charles River Data System | 33384 - 0x8268 |
| Charles River Data System | 33385 - 0x8269 |
| Charles River Data System | 33386 - 0x826A |
| Athena Programming | 33407 - 0x827F |
| Athena Programming | 33408 - 0x8280 |
| Athena Programming | 33409 - 0x8281 |
| Athena Programming | 33410 - 0x8282 |
| Institute for Industrial Information Tech. Ltd | 33434 - 0x829A |
| Institute for Industrial Information Tech. Ltd | 33435 - 0x829B |
| Taurus Controls | 33436 - 0x829C |
| Taurus Controls | 33437 - 0x829D |
| Taurus Controls | 33438 - 0x829E |
| Taurus Controls | 33439 - 0x829F |
| Taurus Controls | 33440 - 0x82A0 |
| Taurus Controls | 33441 - 0x82A1 |
| Taurus Controls | 33442 - 0x82A2 |
| Taurus Controls | 33443 - 0x82A3 |
| Taurus Controls | 33444 - 0x82A4 |
| Taurus Controls | 33445 - 0x82A5 |
| Taurus Controls | 33446 - 0x82A6 |
| Taurus Controls | 33447 - 0x82A7 |
| Taurus Controls | 33448 - 0x82A8 |
| Taurus Controls | 33449 - 0x82A9 |
| Taurus Controls | 33450 - 0x82AA |
| Taurus Controls | 33451 - 0x82AB |
| Accton Technologies | 33680 - 0x8390 |
| Talaris Multicast | 34091 - 0x852B |
| Kalpana | 34178 - 0x8582 |
| Idea Courier | 34452 - 0x8694 |
| Idea Courier | 34453 - 0x8695 |
| Idea Courier | 34454 - 0x8696 |
| Idea Courier | 34455 - 0x8697 |
| Idea Courier | 34456 - 0x8698 |
| Idea Courier | 34457 - 0x8699 |
| Idea Courier | 34458 - 0x869A |
| Idea Courier | 34459 - 0x869B |
| Idea Courier | 34460 - 0x869C |
| Idea Courier | 34461 - 0x869D |
| Computer Network Tech | 34462 - 0x869E |
| Computer Network Tech | 34463 - 0x869F |
| Computer Network Tech | 34464 - 0x86A0 |
| Computer Network Tech | 34465 - 0x86A1 |
| Gateway Communications | 34467 - 0x86A3 |
| Gateway Communications | 34468 - 0x86A4 |
| Gateway Communications | 34469 - 0x86A5 |
| Gateway Communications | 34470 - 0x86A6 |
| Gateway Communications | 34471 - 0x86A7 |
| Gateway Communications | 34472 - 0x86A8 |
| Gateway Communications | 34473 - 0x86A9 |
| Gateway Communications | 34474 - 0x86AA |
| Gateway Communications | 34475 - 0x86AB |
| Gateway Communications | 34476 - 0x86AC |
| SECTRA | 34523 - 0x86DB |
| IPv6 | 34525 - 0x86DD |
| Delta Controls | 34526 - 0x86DE |
| ATOMIC | 34527 - 0x86DF |
| Landis & Gyr Powers | 34528 - 0x86E0 |
| Landis & Gyr Powers | 34543 - 0x86EF |
| Motorola | 34560 - 0x8700 |
| Motorola | 34576 - 0x8710 |
| Cisco Wireless Lan Context Control Protocol (WLCCP) | 34605 - 0x872D |
| Control Technology Inc. - RDP Without IP | 34617 - 0x8739 |
| Control Technology Inc. - Multicast | 34618 - 0x873A |
| Control Technology Inc. - Proprietary | 34619 - 0x873B |
| Control Technology Inc. - Proprietary | 34620 - 0x873C |
| TCP/IP Compression | 34667 - 0x876B |
| IP Autonomous Systems | 34668 - 0x876C |
| Secure Data | 34669 - 0x876D |
| Symbol Technologies | 34688 - 0x8780 |
| Motorola Protocol, Roaming Updates between Access Points | 34689 - 0x8781 |
| Motorola Protocol, Access Point Adoption, extended VLANs and Clustering | 34691 - 0x8783 |
| Ethernet Flow Control / Ethernet Passive Optical Network (EPON) | 34824 - 0x8808 |
| Ethernet OAM Protocol IEEE 802.3ah (a.k.a.: Slow Protocols) | 34825 - 0x8809 |
| Point-to-Point Protocol (PPP) | 34827 - 0x880B |
| General Switch Management Protocol (GSMP) | 34828 - 0x880C |
| Cirrus CobraNet | 34841 - 0x8819 |
| Hitachi Cable (Optoelectronic Systems Laboratory) | 34848 - 0x8820 |
| Web-cache Coordination Protocol | 34878 - 0x883E |
| Multi-Protocol Label Switching (MPLS) Unicast | 34887 - 0x8847 |
| Multi-Protocol Label Switching (MPLS) Multicast | 34888 - 0x8848 |
| Axis Communications AB - Proprietary | 34902 - 0x8856 |
| Foundry Proprietary Protocol | 34906 - 0x885A |
| Multicast Channel Allocation Protocol (MCAP) | 34913 - 0x8861 |
| PPP Over Ethernet (PPPoE) Discovery Stage | 34915 - 0x8863 |
| PPP Over Ethernet (PPPoE) Session Stage | 34916 - 0x8864 |
| Intel ANS (NIC Teaming) | 34925 - 0x886D |
| Microsoft Network Load Balancing Hearbeat | 34927 - 0x886F |
| Jumbo Frames | 34928 - 0x8870 |
| HomePlug 1.0 MME | 34939 - 0x887B |
| Byte Stream Protocol for IP based micro-mobility bearer interfaces (A10) | 34945 - 0x8881 |
| Frame-based ATM Transport over Ethernet | 34948 - 0x8884 |
| HP LanProbe Test | 34952 - 0x8888 |
| EAP over LAN - Authentication (IEEE 802.1X) | 34958 - 0x888E |
| PROFIBUS PROFINET Protocol | 34962 - 0x8892 |
| Realtek Remote Control Protocol (RRCP) | 34969 - 0x8899 |
| HyperSCSI (SCSI over Ethernet) | 34970 - 0x889A |
| CSM_ENCAPS Protocol - Mindspeed Technologies | 34971 - 0x889B |
| Telkonet Powerline Ethernet | 34977 - 0x88A1 |
| ATA over Ethernet (AoE) | 34978 - 0x88A2 |
| EtherCAT Protocol | 34980 - 0x88A4 |
| Huawei Technologies / Cluster | 34983 - 0x88A7 |
| Provider Bridging (IEEE 802.1ad) & Shortest Path Bridging IEEE 802.1aq | 34984 - 0x88A8 |
| Ethernet Powerlink, Communication Profile for Real-Time Ethernet (RTE) | 34987 - 0x88AB |
| XiMeta Technology Americas Inc. Proprietary | 34989 - 0x88AD |
| Boardwalk | 34990 - 0x88AE |
| WLAN Authentication Infrastructure (WAI) Authentication Protocol | 34996 - 0x88B4 |
| IEEE 802a OUI Extended Ethertype | 34999 - 0x88B7 |
| Generic substation Events - International Electrotechnical Commission - Electrical Substation Automation (IEC-61850) | 35000 - 0x88B8 |
| Sampled Value Services - International Electrotechnical Commission | 35002 - 0x88BA |
| Light Weight Access Point Protocol (LWAPP) | 35003 - 0x88BB |
| Robust Security Network (RSN) Pre-Authentication - 802.11i | 35015 - 0x88C7 |
| Transparent Inter Process Communication Protocol (TIPC) | 35018 - 0x88CA |
| Link Layer Discovery Protocol (LLDP) | 35020 - 0x88CC |
| SERCOS III Real-time Protocol for Motion Control | 35021 - 0x88CD |
| 3rd Generation Partnership Project 2 (3GPP2) for CDMA2000 Access Network Interfaces | 35026 - 0x88D2 |
| Circuit Emulation Services over Ethernet (MEF 8) | 35032 - 0x88D8 |
| Link Layer Topology Discovery (LLTD) | 35033 - 0x88D9 |
| Wireless Access in a Vehicle Environment - WAVE Short Message Protocol (WSMP) | 35036 - 0x88DC |
| VMware LabManager | 35038 - 0x88DE |
| HomePlug AV | 35041 - 0x88E1 |
| Media Redundancy Protocol (IEC62439-2) | 35043 - 0x88E3 |
| MAC security (IEEE 802.1AE) | 35045 - 0x88E5 |
| Provider Backbone Bridge Mac-in-Mac - IEEE 802.1ah | 35047 - 0x88E7 |
| Ethernet Local Management Interface (E-LMI) | 35054 - 0x88EE |
| Multiple VLAN Registration Protocol (MVRP) - IEEE 802.1ak | 35061 - 0x88F5 |
| Multiple MAC Registration Protocol (MMRP) - IEEE 802.1ak | 35062 - 0x88F6 |
| Precision Time Protocol over Eth. (PTP v2) - IEEE-1588 | 35063 - 0x88F7 |
| Network Controller Sideband Interface (NCSI) | 35064 - 0x88F8 |
| Parallel Redundancy Protocol (IEC62439 Part 3) | 35067 - 0x88FB |
| Nokia Siemens Networks Flow Layer Internal Protocol (FLIP) | 35073 - 0x8901 |
| IEEE 802.1ag Connectivity Fault Management (CFM) Protocol / ITU-T Recommendation Y.1731 (OAM) | 35074 - 0x8902 |
| Cisco FabricPath Switching - Frame Encapsulation - DCE | 35075 - 0x8903 |
| Fiber Channel over Ethernet (FCoE) | 35078 - 0x8906 |
| Wireless LAN - Data Encapsulation (IEEE-802.11) | 35085 - 0x890D |
| ENEA LINX (Inter Process Communication) IPC Protocol over Ethernet | 35089 - 0x8911 |
| Fiber Channel over Ethernet (FCoE)- Initialization Protocol | 35092 - 0x8914 |
| Infiniband Remote Direct Memory Access (RDMA) over Converged Ethernet (RoCE) | 35093 - 0x8915 |
| Media Independent Handover Protocol | 35095 - 0x8917 |
| TTEthernet Protocol Control Frame | 35101 - 0x891D |
| High-availability Seamless Redundancy (IEC-62439) | 35119 - 0x892F |
| Invisible Software | 35478 - 0x8A96 |
| Invisible Software | 35479 - 0x8A97 |
| Loopback (Configuration Layer 2 Test Protocol) | 36864 - 0x9000 |
| 3Com (Formerly Bridge Communications), XNS Systems Management | 36865 - 0x9001 |
| 3Com (Formerly Bridge Communications), TCP/IP Systems Management | 36866 - 0x9002 |
| 3Com (Formerly Bridge Communications), Loopback Detection | 36867 - 0x9003 |
| RTnet: Real-Time Media Access Control (RTMAC) | 36897 - 0x9021 |
| RTnet: Real-Time Configuration Protocol (RTCFG) | 36898 - 0x9022 |
| Q-in-Q / VLAN-tagged frame | 37120 - 0x9100 |
| Q-in-Q / VLAN-tagged frame | 37376 - 0x9200 |
| DECNET - Used by VAX 6220 DEBNI | 43690 - 0xAAAA |
| Veritas Low Latency Transport (LLT) | 51966 - 0xCAFE |
| Digium Time Division Multiplexing (TDM) over Ethernet (TDMoE) | 53261 - 0xD00D |
| Ethertype Distributed Switch Architecture (DSA) | 56026 - 0xDADA |
| Sonix Arpeggio | 64245 - 0xFAF5 |
| Cisco Multilayer Director Switches (MDS) | 64764 - 0xFCFC |
| BBN VITAL-LanBridge cache wakeups | 65280 - 0xFF00 |
| ISC Bunker Ramo | 65281 - 0xFF01 |
| ISC Bunker Ramo | 65282 - 0xFF02 |
| ISC Bunker Ramo | 65283 - 0xFF03 |
| ISC Bunker Ramo | 65284 - 0xFF04 |
| ISC Bunker Ramo | 65285 - 0xFF05 |
| ISC Bunker Ramo | 65286 - 0xFF06 |
| ISC Bunker Ramo | 65287 - 0xFF07 |
| ISC Bunker Ramo | 65288 - 0xFF08 |
| ISC Bunker Ramo | 65289 - 0xFF09 |
| ISC Bunker Ramo | 65290 - 0xFF0A |
| ISC Bunker Ramo | 65291 - 0xFF0B |
| ISC Bunker Ramo | 65292 - 0xFF0C |
| ISC Bunker Ramo | 65293 - 0xFF0D |
| ISC Bunker Ramo | 65294 - 0xFF0E |
| Reserved | 65535 - 0xFFFF |
### ftp_command | Name | Value | Description | | — | —-| —-| | ABOR | 0 - 0x0 | Abort an active file transfer.| | ACCT | 1 - 0x1 | Account information.| | ALLO | 2 - 0x2 | Allocate sufficient disk space to receive a file.| | APPE | 3 - 0x3 | Append (with create)| | AUTH | 4 - 0x4 | Authentication/Security Mechanism| | CDUP | 5 - 0x5 | Change to Parent Directory.| | CWD | 6 - 0x6 | Change working directory| | DELE | 7 - 0x7 | Delete file.| | EPSV | 8 - 0x8 | Enter extended passive mode.| | FEAT | 9 - 0x9 | Get the feature list implemented by the server.| | HELP | 10 - 0xA | Returns usage documentation on a command if specified, else a general help document is returned.| | LIST | 11 - 0xB | Returns information of a file or directory if specified, else information of the current working directory is returned.| | MDTM | 12 - 0xC | Return the last-modified time of a specified file.| | MKD | 13 - 0xD | Make directory.| | MODE | 14 - 0xE | Sets the transfer mode (Stream, Block, or Compressed).| | NLST | 15 - 0xF | Returns a list of file names in a specified directory.| | NOOP | 16 - 0x10 | No operation (dummy packet; used mostly on keepalives).| | OPTS | 17 - 0x11 | Select options for a feature (for example OPTS UTF8 ON).| | PASS | 18 - 0x12 | Authentication password.| | PASV | 19 - 0x13 | Enter passive mode.| | PORT | 20 - 0x14 | Specifies an address and port to which the server should connect.| | PWD | 21 - 0x15 | Print working directory. Returns the current directory of the host.| | QUIT | 22 - 0x16 | Disconnect.| | REIN | 23 - 0x17 | Re initializes the connection.| | REST | 24 - 0x18 | Restart transfer from the specified point.| | RETR | 25 - 0x19 | Retrieve a copy of the file| | RMD | 26 - 0x1A | Remove a directory.| | RNFR | 27 - 0x1B | Rename from.| | RNTO | 28 - 0x1C | Rename to.| | SITE | 29 - 0x1D | Sends site specific commands to remote server (like SITE IDLE 60 or SITE UMASK 002). Inspect SITE HELP output for complete list of supported commands.| | SIZE | 30 - 0x1E | Return the size of a file.| | SMNT | 31 - 0x1F | Mount file structure.| | STAT | 32 - 0x20 | Returns information on the server status, including the status of the current connection| | STOR | 33 - 0x21 | Accept the data and to store the data as a file at the server site| | STOU | 34 - 0x22 | Store file uniquely.| | STRU | 35 - 0x23 | Set file transfer structure.| | SYST | 36 - 0x24 | Return system type.| | TYPE | 37 - 0x25 | Sets the transfer mode (ASCII/Binary).| | USER | 38 - 0x26 | Authentication username.| | XCUP | 39 - 0x27 | Change to the parent of the current working directory| | XMKD | 40 - 0x28 | Make a directory| | XPWD | 41 - 0x29 | Print the current working directory| | XRCP | 42 - 0x2A | | | XRMD | 43 - 0x2B | Remove the directory| | XRSQ | 44 - 0x2C | | | XSEM | 45 - 0x2D | Send, mail if cannot| | XSEN | 46 - 0x2E | Send to terminal|
### ftp_reply_code This field does not allow any custom items.
| Name | Value | ||||
|---|---|---|---|---|---|
| The requested action is being initiated, expect another reply before proceeding with a new command. | 100 - 0x64 | ||||
| Restart marker replay . In this case, the text is exact and not left to the particular implementation; it must read: MARK yyyy = mmmm where yyyy is User-process data stream marker, and mmmm server's equivalent marker (note the spaces between markers and "="). | 110 - 0x6E | ||||
| Service ready in nnn minutes. | 120 - 0x78 | ||||
| Data connection already open; transfer starting. | 125 - 0x7D | ||||
| File status okay; about to open data connection. | 150 - 0x96 | ||||
| The requested action has been successfully completed. | 200 - 0xC8 | ||||
| Command not implemented, superfluous at this site. | 202 - 0xCA | ||||
| System status, or system help reply. | 211 - 0xD3 | ||||
| Directory status. | 212 - 0xD4 | ||||
| File status. | 213 - 0xD5 | ||||
| Help message. Explains how to use the server or the meaning of a particular non-standard command. This reply is useful only to the human user. | 214 - 0xD6 | ||||
| NAME system type. Where NAME is an official system name from the registry kept by IANA. | 215 - 0xD7 | ||||
| Service ready for new user. | 220 - 0xDC | ||||
| Service closing control connection. | 221 - 0xDD | ||||
| Data connection open; no transfer in progress. | 225 - 0xE1 | ||||
| Closing data connection. Requested file action successful (for example, file transfer or file abort). | 226 - 0xE2 | ||||
| Entering Passive Mode (h1,h2,h3,h4,p1,p2). | 227 - 0xE3 | ||||
| Entering Long Passive Mode (long address, port). | 228 - 0xE4 | ||||
| Entering Extended Passive Mode ( | port | ). | 229 - 0xE5 | ||
| User logged in, proceed. Logged out if appropriate. | 230 - 0xE6 | ||||
| User logged out; service terminated. | 231 - 0xE7 | ||||
| Logout command noted, will complete when transfer done. | 232 - 0xE8 | ||||
| Specifies that the server accepts the authentication mechanism specified by the client, and the exchange of security data is complete. A higher level nonstandard code created by Microsoft. | 234 - 0xEA | ||||
| Requested file action okay, completed. | 250 - 0xFA | ||||
| "PATHNAME" created. | 257 - 0x101 | ||||
| The command has been accepted, but the requested action is on hold, pending receipt of further information. | 300 - 0x12C | ||||
| User name okay, need password. | 331 - 0x14B | ||||
| Need account for login. | 332 - 0x14C | ||||
| Requested file action pending further information | 350 - 0x15E | ||||
| The command was not accepted and the requested action did not take place, but the error condition is temporary and the action may be requested again. | 400 - 0x190 | ||||
| Service not available, closing control connection. This may be a reply to any command if the service knows it must shut down. | 421 - 0x1A5 | ||||
| Can't open data connection. | 425 - 0x1A9 | ||||
| Connection closed; transfer aborted. | 426 - 0x1AA | ||||
| Invalid username or password | 430 - 0x1AE | ||||
| Requested host unavailable. | 434 - 0x1B2 | ||||
| Requested file action not taken. | 450 - 0x1C2 | ||||
| Requested action aborted. Local error in processing. | 451 - 0x1C3 | ||||
| Requested action not taken. Insufficient storage space in system. File unavailable (e.g., file busy). | 452 - 0x1C4 | ||||
| Syntax error, command unrecognized and the requested action did not take place. This may include errors such as command line too long. | 500 - 0x1F4 | ||||
| Syntax error in parameters or arguments. | 501 - 0x1F5 | ||||
| Command not implemented. | 502 - 0x1F6 | ||||
| Bad sequence of commands. | 503 - 0x1F7 | ||||
| Command not implemented for that parameter. | 504 - 0x1F8 | ||||
| Not logged in. | 530 - 0x212 | ||||
| Need account for storing files. | 532 - 0x214 | ||||
| Could Not Connect to Server - Policy Requires SSL | 534 - 0x216 | ||||
| Requested action not taken. File unavailable (e.g., file not found, no access). | 550 - 0x226 | ||||
| Requested action aborted. Page type unknown. | 551 - 0x227 | ||||
| Requested file action aborted. Exceeded storage allocation (for current directory or dataset). | 552 - 0x228 | ||||
| Requested action not taken. File name not allowed. | 553 - 0x229 | ||||
| Replies regarding confidentiality and integrity | 600 - 0x258 | ||||
| Integrity protected reply. | 631 - 0x277 | ||||
| Confidentiality and integrity protected reply. | 632 - 0x278 | ||||
| Confidentiality protected reply. | 633 - 0x279 |
### http_version | Name | Value | | — | —-| | 0.9 | 9 - 0x9 | | 1.0 | 16 - 0x10 | | 1.1 | 17 - 0x11 | | 1.2 | 18 - 0x12 | | 1.3 | 19 - 0x13 | | 2.0 | 32 - 0x20 |
### httpquerymethod | Name | Value | | — | —-| | GET | 0 - 0x0 | | HEAD | 1 - 0x1 | | POST | 2 - 0x2 | | CONNECT | 3 - 0x3 | | PUT | 4 - 0x4 | | OPTIONS | 5 - 0x5 | | TRACE | 6 - 0x6 | | DELETE | 7 - 0x7 |
### httpstatus This field does not allow any custom items.
| Name | Value |
|---|---|
| No response | None |
| Continue | 100 - 0x64 |
| Switching Protocols | 101 - 0x65 |
| Processing | 102 - 0x66 |
| Early Hints | 103 - 0x67 |
| OK | 200 - 0xC8 |
| Created | 201 - 0xC9 |
| Accepted | 202 - 0xCA |
| Non-Authoritative Information | 203 - 0xCB |
| No Content | 204 - 0xCC |
| Reset Content | 205 - 0xCD |
| Partial Content | 206 - 0xCE |
| Multi-Status | 207 - 0xCF |
| Already Reported | 208 - 0xD0 |
| IM Used | 226 - 0xE2 |
| Multiple Choices | 300 - 0x12C |
| Moved Permanently | 301 - 0x12D |
| Found | 302 - 0x12E |
| See Other | 303 - 0x12F |
| Not Modified | 304 - 0x130 |
| Use Proxy | 305 - 0x131 |
| Switch Proxy | 306 - 0x132 |
| Temporary Redirect | 307 - 0x133 |
| Permanent Redirect | 308 - 0x134 |
| Bad Request | 400 - 0x190 |
| Unauthorized | 401 - 0x191 |
| Payment Required | 402 - 0x192 |
| Forbidden | 403 - 0x193 |
| Not Found | 404 - 0x194 |
| Method Not Allowed | 405 - 0x195 |
| Not Acceptable | 406 - 0x196 |
| Proxy Authentication Required | 407 - 0x197 |
| Request Timeout | 408 - 0x198 |
| Conflict | 409 - 0x199 |
| Gone | 410 - 0x19A |
| Length Required | 411 - 0x19B |
| Precondition Failed | 412 - 0x19C |
| Request Entity Too Large | 413 - 0x19D |
| Request-URI Too Long | 414 - 0x19E |
| Unsupported Media Type | 415 - 0x19F |
| Requested Range Not Satisfiable | 416 - 0x1A0 |
| Expectation Failed | 417 - 0x1A1 |
| I'm a teapot | 418 - 0x1A2 |
| Misdirected Request | 421 - 0x1A5 |
| Unprocessable Entity | 422 - 0x1A6 |
| Locked | 423 - 0x1A7 |
| Failed Dependency | 424 - 0x1A8 |
| Upgrade Required | 426 - 0x1AA |
| Precondition Required | 428 - 0x1AC |
| Too Many Requests | 429 - 0x1AD |
| Request Header Fields Too Large | 431 - 0x1AF |
| Unavailable For Legal Reasons | 451 - 0x1C3 |
| Internal Server Error | 500 - 0x1F4 |
| Not Implemented | 501 - 0x1F5 |
| Bad Gateway | 502 - 0x1F6 |
| Service Unavailable | 503 - 0x1F7 |
| Gateway Timeout | 504 - 0x1F8 |
| HTTP Version Not Supported | 505 - 0x1F9 |
| Variant Also Negotiates | 506 - 0x1FA |
| Insufficient Storage | 507 - 0x1FB |
| Loop Detected | 508 - 0x1FC |
| Not Extended | 510 - 0x1FE |
| Network Authentication Required | 511 - 0x1FF |
### httpstatuscategory This field does not allow any custom items.
| Name | Value |
|---|---|
| No response | None |
| Informational (1xx) | 1 - 0x1 |
| OK (2xx) | 2 - 0x2 |
| Multiple Choices (3xx) | 3 - 0x3 |
| Bad Request (4xx) | 4 - 0x4 |
| Internal Server Error (5xx) | 5 - 0x5 |
### icmpmessage This field does not allow any custom items.
| Name | Value |
|---|---|
| Echo Reply | 0:0 |
| Network Unreachable | 3:0 |
| Host Unreachable | 3:1 |
| Protocol Unreachable | 3:2 |
| Port Unreachable | 3:3 |
| Fragmentation Needed and Don't Fragment was Set | 3:4 |
| Source Route Failed | 3:5 |
| Destination Network Unknown | 3:6 |
| Destination Host Unknown | 3:7 |
| Source Host Isolated | 3:8 |
| Communication with Destination Network is Administratively Prohibited | 3:9 |
| Communication with Destination Host is Administratively Prohibited | 3:10 |
| Destination Network Unreachable for Type of Service | 3:11 |
| Destination Host Unreachable for Type of Service | 3:12 |
| Communication Administratively Prohibited | 3:13 |
| Host Precedence Violation | 3:14 |
| Precedence cutoff in effect | 3:15 |
| Source Quench | 4:0 |
| Redirect Datagram for the Network (or subnet) | 5:0 |
| Redirect Datagram for the Host | 5:1 |
| Redirect Datagram for the Type of Service and Network | 5:2 |
| Redirect Datagram for the Type of Service and Host | 5:3 |
| Alternate Address for Host | 6:0 |
| Echo | 8:0 |
| Normal router advertisement | 9:0 |
| Does not route common traffic | 9:16 |
| Router Selection | 10:0 |
| Time to Live exceeded in Transit | 11:0 |
| Fragment Reassembly Time Exceeded | 11:1 |
| Pointer indicates the error | 12:0 |
| Missing a Required Option | 12:1 |
| Bad Length | 12:2 |
| Timestamp | 13:0 |
| Timestamp Reply | 14:0 |
| Information Request | 15:0 |
| Information Reply | 16:0 |
| Address Mask Request | 17:0 |
| Address Mask Reply | 18:0 |
| Reserved (for Security) | 19:0 |
| Reserved (for Robustness Experiment) | 20:0 |
| Reserved (for Robustness Experiment) | 21:0 |
| Reserved (for Robustness Experiment) | 22:0 |
| Reserved (for Robustness Experiment) | 23:0 |
| Reserved (for Robustness Experiment) | 24:0 |
| Reserved (for Robustness Experiment) | 25:0 |
| Reserved (for Robustness Experiment) | 26:0 |
| Reserved (for Robustness Experiment) | 27:0 |
| Reserved (for Robustness Experiment) | 28:0 |
| Reserved (for Robustness Experiment) | 29:0 |
| Traceroute | 30:0 |
| Datagram Conversion Error | 31:0 |
| Mobile Host Redirect | 32:0 |
| IPv6 Where-Are-You | 33:0 |
| IPv6 I-Am-Here | 34:0 |
| Mobile Registration Request | 35:0 |
| Mobile Registration Reply | 36:0 |
| SKIP | 39:0 |
| Bad SPI | 40:0 |
| Authentication Failed | 40:1 |
| Decompression Failed | 40:2 |
| Decryption Failed | 40:3 |
| Need Authentication | 40:4 |
| Need Authorization | 40:5 |
| IPv6 Echo Request | 128:0 |
| IPv6 Echo Reply | 129:0 |
| IPv6 Multicast Listener Query | 130:0 |
| IPv6 Multicast Listener Report | 131:0 |
| IPv6 Multicast Listener Done | 132:0 |
| IPv6 Router Solicitation | 133:0 |
| IPv6 Router Advertisement | 134:0 |
| IPv6 Neighbor Solicitation | 135:0 |
| IPv6 Neighbor Advertisement | 136:0 |
| IPv6 Redirect Message | 137:0 |
| Command | 138:0 |
| Result | 138:1 |
| Reset | 138:255 |
| Subject | 139:0 |
| Subject or Empty | 139:1 |
| Ipv4 Subject | 139:2 |
| Successful | 140:0 |
| Refused | 140:1 |
| Unknown | 140:2 |
| IPv6 Inverse Neighbor Discovery Solicitation Message | 141:0 |
| IPv6 Inverse Neighbor Discovery Advertisement Message | 142:0 |
| IPv6 Home Agent Address Discovery Request Message | 144:0 |
| IPv6 Home Agent Address Discovery Reply Message | 145:0 |
| IPv6 Mobile Prefix Solicitation | 146:0 |
| IPv6 Mobile Prefix Advertisement | 147:0 |
| IPv6 Certification Path Solicitation Message | 148:0 |
| IPv6 Certification Path Advertisement Message | 149:0 |
| IPv6 Multicast Router Advertisement | 151:0 |
| IPv6 Multicast Router Solicitation | 152:0 |
| IPv6 Multicast Router Termination | 153:0 |
| FMIPv6 Messages | 154:0 |
| RFC3692-style Experiment 1 | 253:0 |
| RFC3692-style Experiment 2 | 254:0 |
### icmptype This field does not allow any custom items.
| Name | Category | Value |
|---|---|---|
| Echo Reply | Message | 0 - 0x0 |
| Destination Unreachable | Error | 3 - 0x3 |
| Source Quench | Error | 4 - 0x4 |
| Redirect | Message | 5 - 0x5 |
| Alternate Host Address | Message | 6 - 0x6 |
| Echo | Message | 8 - 0x8 |
| Router Advertisement | Error | 9 - 0x9 |
| Router Selection | Error | 10 - 0xA |
| Time Exceeded | Error | 11 - 0xB |
| Parameter Problem | Error | 12 - 0xC |
| Timestamp | Message | 13 - 0xD |
| Timestamp Reply | Message | 14 - 0xE |
| Information Request | Message | 15 - 0xF |
| Information Reply | Message | 16 - 0x10 |
| Address Mask Request | Message | 17 - 0x11 |
| Address Mask Reply | Message | 18 - 0x12 |
| Reserved (for Security) | Error | 19 - 0x13 |
| Reserved (for Robustness Experiment) | Error | 20 - 0x14 |
| Reserved (for Robustness Experiment) | Error | 21 - 0x15 |
| Reserved (for Robustness Experiment) | Error | 22 - 0x16 |
| Reserved (for Robustness Experiment) | Error | 23 - 0x17 |
| Reserved (for Robustness Experiment) | Error | 24 - 0x18 |
| Reserved (for Robustness Experiment) | Error | 25 - 0x19 |
| Reserved (for Robustness Experiment) | Error | 26 - 0x1A |
| Reserved (for Robustness Experiment) | Error | 27 - 0x1B |
| Reserved (for Robustness Experiment) | Error | 28 - 0x1C |
| Reserved (for Robustness Experiment) | Error | 29 - 0x1D |
| Traceroute | Error | 30 - 0x1E |
| Datagram Conversion Error | Error | 31 - 0x1F |
| Mobile Host Redirect | Error | 32 - 0x20 |
| IPv6 Where-Are-You | Error | 33 - 0x21 |
| IPv6 I-Am-Here | Error | 34 - 0x22 |
| Mobile Registration Request | Message | 35 - 0x23 |
| Mobile Registration Reply | Message | 36 - 0x24 |
| Skip | Error | 39 - 0x27 |
| Photuris | Error | 40 - 0x28 |
| IPv6 Echo Request | Message | 128 - 0x80 |
| IPv6 Echo Reply | Message | 129 - 0x81 |
| IPv6 Multicast Listener Query | Message | 130 - 0x82 |
| IPv6 Multicast Listener Report | Message | 131 - 0x83 |
| IPv6 Multicast Listener Done | Message | 132 - 0x84 |
| IPv6 Router Solicitation | Message | 133 - 0x85 |
| IPv6 Router Advertisement | Message | 134 - 0x86 |
| IPv6 Neighbor Solicitation | Message | 135 - 0x87 |
| IPv6 Neighbor Advertisement | Message | 136 - 0x88 |
| IPv6 Redirect Message | Message | 137 - 0x89 |
| IPv6 Router Renumbering | Message | 138 - 0x8A |
| ICMPv6 Node Information Query | Message | 139 - 0x8B |
| ICMPv6 Node Information Response | Message | 140 - 0x8C |
| IPv6 Inverse Neighbor Discovery Solicitation Message | Message | 141 - 0x8D |
| IPv6 Inverse Neighbor Discovery Advertisement Message | Message | 142 - 0x8E |
| IPv6 Home Agent Address Discovery Request Message | Message | 144 - 0x90 |
| IPv6 Home Agent Address Discovery Reply Message | Message | 145 - 0x91 |
| IPv6 Mobile Prefix Solicitation | Message | 146 - 0x92 |
| IPv6 Mobile Prefix Advertisement | Message | 147 - 0x93 |
| IPv6 Certification Path Solicitation Message | Message | 148 - 0x94 |
| IPv6 Certification Path Advertisement Message | Message | 149 - 0x95 |
| IPv6 Multicast Router Advertisement | Message | 151 - 0x97 |
| IPv6 Multicast Router Solicitation | Message | 152 - 0x98 |
| IPv6 Multicast Router Termination | Message | 153 - 0x99 |
| FMIPv6 Messages | Message | 154 - 0x9A |
| RFC3692-style Experiment 1 | Error | 253 - 0xFD |
| RFC3692-style Experiment 2 | Error | 254 - 0xFE |
### ipfamily | Name | Value | | — | —-| | No IP Address | None | | IPv4 | 4 - 0x4 | | IPv6 | 6 - 0x6 |
### ipprotocol This field does not allow any custom items.
| Name | Value | Description |
|---|---|---|
| icmp | 1 - 0x1 | Internet control message protocol |
| igmp | 2 - 0x2 | Internet group management |
| ggp | 3 - 0x3 | Gateway-gateway protocol |
| ipencap | 4 - 0x4 | Ip encapsulated in ip |
| st | 5 - 0x5 | St datagram mode |
| tcp | 6 - 0x6 | Transmission control protocol |
| cbt | 7 - 0x7 | Cbt |
| egp | 8 - 0x8 | Exterior gateway protocol |
| igp | 9 - 0x9 | Any private interior gateway (used by cisco for igrp) |
| bbn-rcc-mon | 10 - 0xA | Bbn rcc monitoring |
| nvp-ii | 11 - 0xB | Network voice protocol |
| pup | 12 - 0xC | Parc universal packet protocol |
| argus | 13 - 0xD | Argus |
| emcom | 14 - 0xE | Emcon |
| xnet | 15 - 0xF | Cross net debugger |
| chaos | 16 - 0x10 | Chaos |
| udp | 17 - 0x11 | User datagram protocol |
| mux | 18 - 0x12 | Multiplexing |
| dcn-meas | 19 - 0x13 | Dcn measurement subsystems |
| hmp | 20 - 0x14 | Host monitoring protocol |
| prm | 21 - 0x15 | Packet radio measurement |
| xns-idp | 22 - 0x16 | Xerox ns idp |
| trunk-1 | 23 - 0x17 | Trunk-1 |
| trunk-2 | 24 - 0x18 | Trunk-2 |
| leaf-1 | 25 - 0x19 | Leaf-1 |
| leaf-2 | 26 - 0x1A | Leaf-2 |
| rdp | 27 - 0x1B | Reliable data protocol |
| irtp | 28 - 0x1C | Internet reliable transaction |
| iso-tp4 | 29 - 0x1D | Iso transport protocol class 4 |
| netblt | 30 - 0x1E | Bulk data transfer protocol |
| mfe-nsp | 31 - 0x1F | Mfe network services protocol |
| merit-inp | 32 - 0x20 | Merit internodal protocol |
| dccp | 33 - 0x21 | Datagram congestion control protocol |
| 3pc | 34 - 0x22 | Third party connect protocol |
| idpr | 35 - 0x23 | Inter-domain policy routing protocol |
| xtp | 36 - 0x24 | Xpress transfer protocol |
| ddp | 37 - 0x25 | Datagram delivery protocol |
| idpr-cmtp | 38 - 0x26 | Idpr control message transport |
| tp++ | 39 - 0x27 | Tp++ transport protocol |
| il | 40 - 0x28 | Il transport protocol |
| ipv6 | 41 - 0x29 | Ipv6 |
| sdrp | 42 - 0x2A | Source demand routing protocol |
| ipv6-route | 43 - 0x2B | Routing header for ipv6 |
| ipv6-frag | 44 - 0x2C | Fragment header for ipv6 |
| idrp | 45 - 0x2D | Inter-domain routing protocol |
| rsvp | 46 - 0x2E | Reservation protocol |
| gre | 47 - 0x2F | General routing encapsulation |
| dsr | 48 - 0x30 | Dynamic source routing protocol |
| bna | 49 - 0x31 | Bna |
| esp | 50 - 0x32 | Encap security payload |
| ah | 51 - 0x33 | Authentication header |
| i-nlsp | 52 - 0x34 | Integrated net layer security tuba |
| swipe | 53 - 0x35 | Ip with encryption |
| narp | 54 - 0x36 | Nbma address resolution protocol |
| mobile | 55 - 0x37 | Ip mobility |
| tlsp | 56 - 0x38 | Transport layer security protocol using kryptonet key management |
| skip | 57 - 0x39 | Skip |
| ipv6-icmp | 58 - 0x3A | Icmp for ipv6 |
| ipv6-nonxt | 59 - 0x3B | No next header for ipv6 |
| ipv6-opts | 60 - 0x3C | Destination options for ipv6 |
| anyhost | 61 - 0x3D | Any host internal protocol |
| cftp | 62 - 0x3E | Cftp |
| anylan | 63 - 0x3F | Any local network |
| sat-expak | 64 - 0x40 | Satnet and backroom expak |
| kryptolan | 65 - 0x41 | Kryptolan |
| rvd | 66 - 0x42 | Mit remote virtual disk protocol |
| ippc internet | 67 - 0x43 | Internet pluribus packet core |
| anydfs | 68 - 0x44 | Any distributed file system |
| sat-mon | 69 - 0x45 | Satnet monitoring |
| visa | 70 - 0x46 | Visa protocol |
| ipcv | 71 - 0x47 | Internet packet core utility |
| cpnx | 72 - 0x48 | Computer protocol network executive |
| rspf | 73 - 0x49 | Radio shortest path first (officially cphb, computer protocol heart beat |
| br-sat-mon | 76 - 0x4C | Backroom satnet monitoring |
| sun-nd | 77 - 0x4D | Sun nd protocol-temporary |
| wb-mon | 78 - 0x4E | Wideband monitoring |
| wb-expak | 79 - 0x4F | Wideband expak |
| iso-ip | 80 - 0x50 | Iso internet protocol |
| vmtp | 81 - 0x51 | Versatile message transport |
| secure-vmtp | 82 - 0x52 | Versatile message transport |
| vines | 83 - 0x53 | Vines |
| ttp | 84 - 0x54 | Ttp |
| msfnet-igp | 85 - 0x55 | Msfnet-igp |
| dgp | 86 - 0x56 | Dissimilar gateway protocol |
| tcf | 87 - 0x57 | Tcf |
| eigrp | 88 - 0x58 | Enhanced interior routing protocol (cisco) |
| ospf | 89 - 0x59 | Open shortest path first igp |
| sprite-rpc | 90 - 0x5A | Sprite rpc protocol |
| larp | 91 - 0x5B | Locus address resolution protocol |
| mtp | 92 - 0x5C | Multicast transport protocol |
| ax.25 | 93 - 0x5D | Ax.25 frames |
| ipip | 94 - 0x5E | Ip-within-ip encapsulation protocol |
| micp | 95 - 0x5F | Mobile internetworking control pro. |
| scc-sp | 96 - 0x60 | Semaphore communications sec. pro. |
| etherip | 97 - 0x61 | Ethernet-within-ip encapsulation |
| anyprivenc | 98 - 0x62 | Any private encryption scheme |
| gmtp | 100 - 0x64 | Gmtp |
| ifmp | 101 - 0x65 | Ipsilon flow management protocol |
| pnni | 102 - 0x66 | Pnni over ip |
| pim | 103 - 0x67 | Protocol independent multicast |
| aris | 104 - 0x68 | Aris |
| scps | 105 - 0x69 | Scps |
| qnx | 106 - 0x6A | Qnx |
| a/n | 107 - 0x6B | Active networks |
| ipcomp | 108 - 0x6C | Ip payload compression protocol |
| snp | 109 - 0x6D | Sitara networks protocol |
| compaq-peer | 110 - 0x6E | Compaq peer protocol |
| ipx-in-ip | 111 - 0x6F | Ipx in ip |
| vrrp | 112 - 0x70 | Virtual router redundancy protocol |
| pgm | 113 - 0x71 | Pgm reliable transport protocol |
| any0hop | 114 - 0x72 | Any 0-hop protocol |
| l2tp | 115 - 0x73 | Layer two tunneling protocol |
| ddx | 116 - 0x74 | D-ii data exchange (ddx) |
| iatp | 117 - 0x75 | Interactive agent transfer protocol |
| stp | 118 - 0x76 | Schedule transfer protocol |
| srp | 119 - 0x77 | Spectralink radio protocol |
| uti | 120 - 0x78 | Uti |
| smp | 121 - 0x79 | Simple message protocol |
| sm | 122 - 0x7A | Sm |
| ptp | 123 - 0x7B | Performance transparency protocol |
| isis | 124 - 0x7C | Isis over ipv4 |
| fire | 125 - 0x7D | Fire |
| crtp | 126 - 0x7E | Combat radio transport protocol |
| crudp | 127 - 0x7F | Combat radio user datagram |
| sscopmce | 128 - 0x80 | Sscopmce |
| iplt | 129 - 0x81 | Iplt |
| sps | 130 - 0x82 | Secure packet shield |
| pipe | 131 - 0x83 | Private ip encapsulation within ip |
| sctp | 132 - 0x84 | Stream control transmission protocol |
| fc | 133 - 0x85 | Fibre channel |
| rsvp-e2e-ignore | 134 - 0x86 | Rsvp-e2e-ignore |
| mobilityheader | 135 - 0x87 | Mobility header |
| udplite | 136 - 0x88 | Udp-lite |
| mpls-in-ip | 137 - 0x89 | Mpls-in-ip |
| manet | 138 - 0x8A | Manet protocols |
| hip | 139 - 0x8B | Host identity protocol |
| shim6 | 140 - 0x8C | Shim6 protocol |
| testing1 | 253 - 0xFD | Use for experimentation and testing |
| testing2 | 254 - 0xFE | Use for experimentation and testing |
### ipsec_protocol_version | Name | Value | | — | —-| | IPsec Version 1 | 16 - 0x10 | | IPsec Version 2 | 32 - 0x20 |
### keberos_encryption_type | Name | Value | | — | —-| | | 0 - 0x0 | | des-cbc-crc | 1 - 0x1 | | des-cbc-md4 | 2 - 0x2 | | des-cbc-md5 | 3 - 0x3 | | des3-cbc-md5 | 5 - 0x5 | | des3-cbc-sha1 | 7 - 0x7 | | dsaWithSHA1-CmsOID | 9 - 0x9 | | md5WithRSAEncryption-CmsOID | 10 - 0xA | | sha1WithRSAEncryption-CmsOID | 11 - 0xB | | rc2CBC-EnvOID | 12 - 0xC | | rsaEncryption-EnvOID | 13 - 0xD | | rsaES-OAEP-ENV-OID | 14 - 0xE | | des-ede3-cbc-Env-OID | 15 - 0xF | | des3-cbc-sha1-kd | 16 - 0x10 | | aes128-cts-hmac-sha1-96 | 17 - 0x11 | | aes256-cts-hmac-sha1-96 | 18 - 0x12 | | aes128-cts-hmac-sha256-128 | 19 - 0x13 | | aes256-cts-hmac-sha384-192 | 20 - 0x14 | | rc4-hmac | 23 - 0x17 | | rc4-hmac-exp | 24 - 0x18 | | camellia128-cts-cmac | 25 - 0x19 | | camellia256-cts-cmac | 26 - 0x1A | | subkey-keymaterial | 65 - 0x41 |
### kerberos_type | Name | Value | | — | —-| | KRB_Ticket | 1 - 0x1 | | KRB_Authenticator | 2 - 0x2 | | KRB_EncTicketPart | 3 - 0x3 | | AS_REQ | 10 - 0xA | | AS_REP | 11 - 0xB | | TGS_REQ | 12 - 0xC | | TGS_REP | 13 - 0xD | | AP_REQ | 14 - 0xE | | AP_REP | 15 - 0xF | | KRB_SAFE | 20 - 0x14 | | KRB_PRIV | 21 - 0x15 | | KRB_CRED | 22 - 0x16 | | KRB_EncASRepPart | 25 - 0x19 | | KRB_EncTGSRepPart | 26 - 0x1A | | KRB_EncKrbPrivPart | 28 - 0x1C | | KRB_EncKrbCredPart | 29 - 0x1D | | KRB_ERROR | 30 - 0x1E |
### keytype | Name | Value | | — | —-| | RSA | 0 - 0x0 | | EC | 1 - 0x1 |
### layer | Name | Value | | — | —-| | BOOTP/DHCP | bootp | | Citrix | citrix | | Citrix Channels | citrix_channels | | DNS | dns | | Email | email | | HTTP | http | | ICMP | icmp | | Non IP | non_ip | | Other IP | other_ip | | CIFS | smb | | Databases | databases | | TCP | tcp | | UDP | udp | | VoIP | voip | | TLS | tls | | LDAP | ldap | | FTP | ftp | | VNC | vnc | | DCE/RPC | dce_rpc | | Kerberos | kerberos | | Socks5 | socks5 | | ARP | arp | | IPSec | ipsec | | SSH | ssh | | NTLM | ntlm | | RDP | rdp |
### os | Name | Category | Value | | — | —-| —-| | Unknown | Unknown| 0 - 0x0 | | Linux:3.x | linux| 1 - 0x1 | | Linux:2.6.x | linux| 2 - 0x2 | | Linux:2.4.x | linux| 3 - 0x3 | | Linux:2.2.x | linux| 4 - 0x4 | | Linux:2.0 | linux| 5 - 0x5 | | Linux:3.x (loopback) | linux| 6 - 0x6 | | Linux:2.6.x (loopback) | linux| 7 - 0x7 | | Linux:2.4.x (loopback) | linux| 8 - 0x8 | | Linux:2.2.x (loopback) | linux| 9 - 0x9 | | Linux:2.6.x (google crawler) | linux| 10 - 0xA | | Linux:Android | mobile| 11 - 0xB | | Linux:3.x (generic) | linux| 12 - 0xC | | Linux:2.4.x-2.6.x (generic) | linux| 13 - 0xD | | Linux:2.2.x-3.x (generic) | linux| 14 - 0xE | | Linux:2.2.x-3.x (generic, no ts) | linux| 15 - 0xF | | Linux:2.2.x-3.x (generic, barebone) | linux| 16 - 0x10 | | Windows:XP | windows| 17 - 0x11 | | Windows:7 or 8 | windows| 18 - 0x12 | | Windows:7 (Websense crawler) | windows| 19 - 0x13 | | Windows:NT kernel 5.x (generic) | windows| 20 - 0x14 | | Windows:NT kernel 6.x (generic) | windows| 21 - 0x15 | | Windows:NT kernel (generic) | windows| 22 - 0x16 | | Mac OS X:10.x | macos| 23 - 0x17 | | iOS:iPhone or iPad | mobile| 24 - 0x18 | | Mac OS X (generic) | macos| 25 - 0x19 | | FreeBSD:9.x | bsd| 26 - 0x1A | | FreeBSD:8.x | bsd| 27 - 0x1B | | FreeBSD (generic) | bsd| 28 - 0x1C | | OpenBSD:3.x | bsd| 29 - 0x1D | | OpenBSD:4.x-5.x | bsd| 30 - 0x1E | | Solaris:8 | solaris| 31 - 0x1F | | Solaris:10 | solaris| 32 - 0x20 | | OpenVMS:8.x | other| 33 - 0x21 | | OpenVMS:7.x | other| 34 - 0x22 | | NeXTSTEP | other| 35 - 0x23 | | Tru64:4.x | other| 36 - 0x24 | | NMap:SYN scan | Unknown| 37 - 0x25 | | NMap:OS detection | Unknown| 38 - 0x26 | | p0f:sendsyn utility | Unknown| 39 - 0x27 | | Blackberry | mobile| 40 - 0x28 | | Nintendo:3DS | other| 41 - 0x29 | | Nintendo:Wii | other| 42 - 0x2A | | BaiduSpider | other| 43 - 0x2B | | Linux:3.x (syn+ack) | linux| 44 - 0x2C | | Linux:2.4-2.6 (syn+ack) | linux| 45 - 0x2D | | Linux:2.4.x (syn+ack) | linux| 46 - 0x2E | | Linux:2.6.x (syn+ack) | linux| 47 - 0x2F | | Windows:XP (syn+ack) | windows| 48 - 0x30 | | Windows:7 or 8 (syn+ack) | windows| 49 - 0x31 | | FreeBSD:9.x (syn+ack) | bsd| 50 - 0x32 | | FreeBSD:8.x (syn+ack) | bsd| 51 - 0x33 | | FreeBSD:8.x-9.x (syn+ack) | bsd| 52 - 0x34 | | OpenBSD:5.x (syn+ack) | bsd| 53 - 0x35 | | Mac OS X:10.x (syn+ack) | macos| 54 - 0x36 | | Solaris:6 (syn+ack) | solaris| 55 - 0x37 | | Solaris:8 (syn+ack) | solaris| 56 - 0x38 | | Solaris:10 (syn+ack) | solaris| 57 - 0x39 | | HP-UX:11.x (syn+ack) | other| 58 - 0x3A | | OpenVMS:7.x (syn+ack) | other| 59 - 0x3B | | Tru64:4.x (syn+ack) | other| 60 - 0x3C |
### pktsourcekind | Name | Value | | — | —-| | Missing | 0 - 0x0 | | Network Interface | 1 - 0x1 | | RPCAPD Remote Capture | 2 - 0x2 | | PCAP File | 3 - 0x3 | | NetFlow | 4 - 0x4 |
### smb_create_options | Name | Value | Description | | — | —-| —-| | FILE_DIRECTORY_FILE | 1 - 0x1 | The file being created or opened is a directory file. With this flag, the CreateDisposition field MUST be set to FILE_CREATE, FILE_OPEN_IF, or FILE_OPEN. With this flag, only the following CreateOptions values are valid: FILE_WRITE_THROUGH, FILE_OPEN_FOR_BACKUP_INTENT, FILE_DELETE_ON_CLOSE, and FILE_OPEN_REPARSE_POINT. If the file being created or opened already exists and is not a directory file and FILE_CREATE is specified in the CreateDisposition field, then the server MUST fail the request with STATUS_OBJECT_NAME_COLLISION. If the file being created or opened already exists and is not a directory file and FILE_CREATE is not specified in the CreateDisposition field, then the server MUST fail the request with STATUS_NOT_A_DIRECTORY. The server MUST fail an invalid CreateDisposition field or an invalid combination of CreateOptions flags with STATUS_INVALID_PARAMETER.| | FILE_WRITE_THROUGH | 2 - 0x2 | The server performs file write-through; file data is written to the underlying storage before completing the write operation on this open.| | FILE_SEQUENTIAL_ONLY | 4 - 0x4 | This indicates that the application intends to read or write at sequential offsets using this handle, so the server SHOULD optimize for sequential access. However, the server MUST accept any access pattern. This flag value is incompatible with the FILE_RANDOM_ACCESS value.| | FILE_NO_INTERMEDIATE_BUFFERING | 8 - 0x8 | File buffering is not performed on this open; file data is not retained in memory upon writing it to, or reading it from, the underlying storage.| | FILE_SYNCHRONOUS_IO_ALERT | 16 - 0x10 | This bit SHOULD be set to 0 and MUST be ignored by the server.| | FILE_SYNCHRONOUS_IO_NONALERT | 32 - 0x20 | This bit SHOULD be set to 0 and MUST be ignored by the server.| | FILE_NON_DIRECTORY_FILE | 64 - 0x40 | If the name of the file being created or opened matches with an existing directory file, the server MUST fail the request with STATUS_FILE_IS_A_DIRECTORY. This flag MUST NOT be used with FILE_DIRECTORY_FILE or the server MUST fail the request with STATUS_INVALID_PARAMETER.| | FILE_COMPLETE_IF_OPLOCKED | 256 - 0x100 | This bit SHOULD be set to 0 and MUST be ignored by the server.| | FILE_NO_EA_KNOWLEDGE | 512 - 0x200 | The caller does not understand how to handle extended attributes. If the request includes an SMB2_CREATE_EA_BUFFER create context, then the server MUST fail this request with STATUS_ACCESS_DENIED. If extended attributes with the FILE_NEED_EA flag (see [MS-FSCC] section 2.4.15) set are associated with the file being opened, then the server MUST fail this request with STATUS_ACCESS_DENIED.| | FILE_RANDOM_ACCESS | 2048 - 0x800 | This indicates that the application intends to read or write at random offsets using this handle, so the server SHOULD optimize for random access. However, the server MUST accept any access pattern. This flag value is incompatible with the FILE_SEQUENTIAL_ONLY value. If both FILE_RANDOM_ACCESS and FILE_SEQUENTIAL_ONLY are set, then FILE_SEQUENTIAL_ONLY is ignored.| | FILE_DELETE_ON_CLOSE | 4096 - 0x1000 | The file MUST be automatically deleted when the last open request on this file is closed. When this option is set, the DesiredAccess field MUST include the DELETE flag. This option is often used for temporary files.| | FILE_OPEN_BY_FILE_ID | 8192 - 0x2000 | This bit SHOULD be set to 0 and the server MUST fail the request with a STATUS_NOT_SUPPORTED error if this bit is set.| | FILE_OPEN_FOR_BACKUP_INTENT | 16384 - 0x4000 | The file is being opened for backup intent. That is, it is being opened or created for the purposes of either a backup or a restore operation. The server can check to ensure that the caller is capable of overriding whatever security checks have been placed on the file to allow a backup or restore operation to occur. The server can check for access rights to the file before checking the DesiredAccess field.| | FILE_NO_COMPRESSION | 32768 - 0x8000 | The file cannot be compressed. This bit is ignored when FILE_DIRECTORY_FILE is set in CreateOptions.| | FILE_OPEN_REMOTE_INSTANCE | 1024 - 0x400 | This bit SHOULD be set to 0 and MUST be ignored by the server.| | FILE_OPEN_REQUIRING_OPLOCK | 65536 - 0x10000 | This bit SHOULD be set to 0 and MUST be ignored by the server.| | FILE_DISALLOW_EXCLUSIVE | 131072 - 0x20000 | This bit SHOULD be set to 0 and MUST be ignored by the server.| | FILE_RESERVE_OPFILTER | 1048576 - 0x100000 | This bit SHOULD be set to 0 and the server MUST fail the request with a STATUS_NOT_SUPPORTED error if this bit is set.| | FILE_OPEN_REPARSE_POINT | 2097152 - 0x200000 | If the file or directory being opened is a reparse point, open the reparse point itself rather than the target that the reparse point references.| | FILE_OPEN_NO_RECALL | 4194304 - 0x400000 | In an HSM (Hierarchical Storage Management) environment, this flag means the file SHOULD NOT be recalled from tertiary storage such as tape. The recall can take several minutes. The caller can specify this flag to avoid those delays.| | FILE_OPEN_FOR_FREE_SPACE_QUERY | 8388608 - 0x800000 | Open file to query for free space. The client SHOULD set this to 0 and the server MUST ignore it.|
### smb_desired_access | Name | Value | Description | | — | —-| —-| | FILE_READ_DATA | 1 - 0x1 | Indicates the right to read data from the file.| | FILE_WRITE_DATA | 2 - 0x2 | Indicates the right to write data into the file beyond the end of the file.| | FILE_APPEND_DATA | 4 - 0x4 | Indicates the right to append data to the file beyond the end of the file only.| | FILE_READ_EA | 8 - 0x8 | Indicates the right to read the extended attributes (EAs) of the file.| | FILE_WRITE_EA | 16 - 0x10 | Indicates the right to write or change the extended attributes (EAs) of the file.| | FILE_EXECUTE | 32 - 0x20 | Indicates the right to execute the file.| | FILE_READ_ATTRIBUTES | 128 - 0x80 | Indicates the right to read the attributes of the file.| | FILE_WRITE_ATTRIBUTES | 256 - 0x100 | Indicates the right to change the attributes of the file.| | DELETE | 65536 - 0x10000 | Indicates the right to delete or to rename the file.| | READ_CONTROL | 131072 - 0x20000 | Indicates the right to read the security descriptor of the file.| | WRITE_DAC | 262144 - 0x40000 | Indicates the right to change the discretionary access control list (DACL) in the security descriptor of the file.| | WRITE_OWNER | 524288 - 0x80000 | Indicates the right to change the owner in the security descriptor of the file.| | SYNCHRONIZE | 1048576 - 0x100000 | SHOULD NOT be used by the sender and MUST be ignored by the receiver.| | ACCESS_SYSTEM_SECURITY | 16777216 - 0x1000000 | Indicates the right to read or change the system access control list (SACL) in the security descriptor for the file. If the SE_SECURITY_NAME privilege is not set in the access token, the server MUST fail the open request and return STATUS_PRIVILEGE_NOT_HELD.| | MAXIMUM_ALLOWED | 33554432 - 0x2000000 | Indicates that the client requests an open to the file with the highest level of access that the client has on this file. If no access is granted for the client on this file, the server MUST fail the open and return a STATUS_ACCESS_DENIED.| | GENERIC_ALL | 268435456 - 0x10000000 | Indicates a request for all of the access flags that are previously listed except MAXIMUM_ALLOWED and ACCESS_SYSTEM_SECURITY.| | GENERIC_EXECUTE | 536870912 - 0x20000000 | Indicates a request for the following combination of access flags listed previously in this table: FILE_READ_ATTRIBUTES, FILE_EXECUTE, SYNCHRONIZE, and READ_CONTROL.| | GENERIC_WRITE | 1073741824 - 0x40000000 | Indicates a request for the following combination of access flags listed previously in this table: FILE_WRITE_DATA, FILE_APPEND_DATA, SYNCHRONIZE, FILE_WRITE_ATTRIBUTES, and FILE_WRITE_EA.| | GENERIC_READ | 2147483648 - 0x80000000 | Indicates a request for the following combination of access flags listed previously in this table: FILE_READ_DATA, FILE_READ_ATTRIBUTES, FILE_READ_EA, and SYNCHRONIZE.|
### smb_file_attributes | Name | Value | Description | | — | —-| —-| | ATTR_READONLY | 1 - 0x1 | File is read-only. Applications cannot write or delete the file.| | ATTR_HIDDEN | 2 - 0x2 | File is hidden. It is not to be included in an ordinary directory enumeration.| | ATTR_SYSTEM | 4 - 0x4 | File is part of or is used exclusively by the operating system.| | ATTR_DIRECTORY | 16 - 0x10 | File is a directory.| | ATTR_ARCHIVE | 32 - 0x20 | File has not been archived since it was last modified.| | ATTR_NORMAL | 128 - 0x80 | File has no other attributes set. This value is valid only when used alone.| | ATTR_TEMPORARY | 256 - 0x100 | File is temporary.| | ATTR_SPARSE | 512 - 0x200 | File is a sparse file.| | ATTR_REPARSE_POINT | 1024 - 0x400 | File or directory has an associated reparse point.| | ATTR_COMPRESSED | 2048 - 0x800 | File is compressed on the disk. This does not affect how it is transferred over the network.| | ATTR_OFFLINE | 4096 - 0x1000 | File data is not available. The attribute indicates that the file has been moved to offline storage.| | ATTR_NOT_CONTENT_INDEXED | 8192 - 0x2000 | File or directory SHOULD NOT be indexed by a content indexing service.| | ATTR_ENCRYPTED | 16384 - 0x4000 | File or directory is encrypted. For a file, this means that all data in the file is encrypted. For a directory, this means that encryption is the default for newly created files and subdirectories.| | Reserved | 4294934600 - 0xFFFF8048 | SHOULD be set to zero when sending and MUST be ignored upon receipt of the message.|
### smb_file_info_class | Name | Value | | — | —-| | FILE_ACCESS_INFORMATION | 1:8 | | FILE_ALIGNMENT_INFORMATION | 1:17 | | FILE_ALL_INFORMATION | 1:18 | | FILE_ALLOCATION_INFORMATION | 1:19 | | FILE_ALTERNATE_NAME_INFORMATION | 1:21 | | FILE_ATTRIBUTE_TAG_INFORMATION | 1:35 | | FILE_BASIC_INFORMATION | 1:4 | | FILE_BOTH_DIRECTORY_INFORMATION | 1:3 | | FILE_COMPRESSION_INFORMATION | 1:28 | | FILE_DIRECTORY_INFORMATION | 1:1 | | FILE_DISPOSITION_INFORMATION | 1:13 | | FILE_EA_INFORMATION | 1:7 | | FILE_END_OF_FILE_INFORMATION | 1:20 | | FILE_FULL_DIRECTORY_INFORMATION | 1:2 | | FILE_FULL_EA_INFORMATION | 1:15 | | FILE_HARD_LINK_INFORMATION | 1:46 | | FILE_ID_BOTH_DIRECTORY_INFORMATION | 1:37 | | FILE_ID_FULL_DIRECTORY_INFORMATION | 1:38 | | FILE_ID_GLOBAL_TX_DIRECTORY_INFORMATION | 1:50 | | FILE_ID_INFORMATION | 1:59 | | FILE_INTERNAL_INFORMATION | 1:6 | | FILE_LINK_INFORMATION | 1:11 | | FILE_MAILSLOT_QUERY_INFORMATION | 1:26 | | FILE_MAILSLOT_SET_INFORMATION | 1:27 | | FILE_MODE_INFORMATION | 1:16 | | FILE_MOVE_CLUSTER_INFORMATION | 1:31 | | FILE_NAME_INFORMATION | 1:9 | | FILE_NAMES_INFORMATION | 1:12 | | FILE_NETWORK_OPEN_INFORMATION | 1:34 | | FILE_NORMALIZED_NAME_INFORMATION | 1:48 | | FILE_OBJECT_ID_INFORMATION | 1:29 | | FILE_PIPE_INFORMATION | 1:23 | | FILE_PIPE_LOCAL_INFORMATION | 1:24 | | FILE_PIPE_REMOTE_INFORMATION | 1:25 | | FILE_POSITION_INFORMATION | 1:14 | | FILE_QUOTA_INFORMATION | 1:32 | | FILE_RENAME_INFORMATION | 1:10 | | FILE_REPARSE_POINT_INFORMATION | 1:33 | | FILE_SFIO_RESERVE_INFORMATION | 1:44 | | FILE_SFIO_VOLUME_INFORMATION | 1:45 | | FILE_SHORT_NAME_INFORMATION | 1:40 | | FILE_STANDARD_INFORMATION | 1:5 | | FILE_STANDARD_LINK_INFORMATION | 1:54 | | FILE_STREAM_INFORMATION | 1:22 | | FILE_TRACKING_INFORMATION | 1:36 | | FILE_VALID_DATA_LENGTH_INFORMATION | 1:39 | | FILE_FS_VOLUME_INFORMATION | 2:1 | | FILE_FS_LABEL_INFORMATION | 2:2 | | FILE_FS_SIZE_INFORMATION | 2:3 | | FILE_FS_DEVICE_INFORMATION | 2:4 | | FILE_FS_ATTRIBUTE_INFORMATION | 2:5 | | FILE_FS_CONTROL_INFORMATION | 2:6 | | FILE_FS_FULL_SIZE_INFORMATION | 2:7 | | FILE_FS_OBJECT_ID_INFORMATION | 2:8 | | FILE_FS_DRIVER_PATH_INFORMATION | 2:9 | | FILE_FS_VOLUME_FLAGS_INFORMATION | 2:10 | | FILE_FS_SECTOR_SIZE_INFORMATION | 2:11 | | NONE | 3:0 | | NONE | 4:0 |
### smb_info_type | Name | Value | Description | | — | —-| —-| | SMB2_0_INFO_FILE | 1 - 0x1 | The file information is requested.| | SMB2_0_INFO_FILESYSTEM | 2 - 0x2 | The underlying object store information is requested.| | SMB2_0_INFO_SECURITY | 3 - 0x3 | The security information is requested.| | SMB2_0_INFO_QUOTA | 4 - 0x4 | The underlying object store quota information is requested.|
### smbcommand This field does not allow any custom items.
| Name | Value | Description |
|---|---|---|
| SMB_com_create_directory | 1:0 | Create a new directory on the server, relative to a connected share. |
| SMB_com_delete_directory | 1:1 | Delete an empty directory. |
| SMB_com_open | 1:2 | Open an existing regular file. |
| SMB_com_create | 1:3 | Create and open a new file or open and truncate an existing file to zero length. |
| SMB_com_close | 1:4 | Close an instance of an object associated with a valid FID. |
| SMB_com_flush | 1:5 | Request that the server flush data and allocation information for a specified file or for all open files under the session. |
| SMB_com_delete | 1:6 | Delete one or more regular files. |
| SMB_com_rename | 1:7 | Change the name of one or more files or directories |
| SMB_com_query_information | 1:8 | Obtain attribute information about a file. |
| SMB_com_set_information | 1:9 | Change the attribute information of a regular file or directory. |
| SMB_com_read | 1:10 | Read bytes from a regular file. |
| SMB_com_write | 1:11 | Write bytes to a regular file. |
| SMB_com_lock_byte_range | 1:12 | Explicitly lock a contiguous range of bytes in an open regular file. |
| SMB_com_unlock_byte_range | 1:13 | Explicitly unlock a contiguous range of bytes in an open regular file. |
| SMB_com_create_temporary | 1:14 | Create a file for temporary use by the client. |
| SMB_com_create_new | 1:15 | Create a new file. |
| SMB_com_check_directory | 1:16 | Verify that a specified path resolves to a valid directory on the server. |
| SMB_com_process_exit | 1:17 | Sent by the client to indicate the catastrophic failure of a client process. |
| SMB_com_seek | 1:18 | Position a file pointer within a regular file. |
| SMB_com_lock_and_read | 1:19 | Explicitly lock and read bytes from a regular file. |
| SMB_com_write_and_unlock | 1:20 | Write to a range of bytes and then unlock them. |
| SMB_com_read_raw | 1:26 | Request raw data from the file or named pipe. |
| SMB_com_read_mpx | 1:27 | This is a specialized read command intended to maximize the performance of reading large blocks of data from a regular file while allowing for other operations to take place between the client and the server. |
| SMB_com_read_mpx_secondary | 1:28 | This command is no longer used in conjunction with the SMB_COM_READ_MPX command. |
| SMB_com_write_raw | 1:29 | This is a specialized write command intended to maximize performance when writing large blocks of data to an open regular file, a named pipe, a device, or spooled output. |
| SMB_com_write_mpx | 1:30 | SMB_COM_WRITE_MPX is used to maximize performance when writing a large block of data from the client to the server. |
| SMB_com_write_mpx_secondary | 1:31 | This command is no longer used in conjunction with the SMB_COM_WRITE_MPX command. |
| SMB_com_write_complete | 1:32 | This command is sent by the server as the final response of an SMB_COM_WRITE_RAW command sequence. |
| SMB_com_query_server | 1:33 | This command was introduced in the NT LAN Manager dialect, and was reserved but not implemented. |
| SMB_com_set_information2 | 1:34 | Set attribute information about an open file. This command allows the client to set more attribute information for the file than the SMB_COM_SET_INFORMATION command. |
| SMB_com_query_information2 | 1:35 | Obtain attribute information about an open file. This command provides more information about the file than the SMB_COM_QUERY_INFORMATION command. |
| SMB_com_locking_andx | 1:36 | Explicitly lock and/or unlock a contiguous range of bytes in a regular file. |
| SMB_com_transaction | 1:37 | This command serves as the transport for the Transaction Subprotocol Commands. These commands operate on mailslots and named pipes, which are interprocess communication endpoints within the CIFS file system. |
| SMB_com_transaction_secondary | 1:38 | The SMB_COM_TRANSACTION_SECONDARY command is used to complete a data transfer initiated by an SMB_COM_TRANSACTION Request. |
| SMB_com_ioctl | 1:39 | This command delivers a device- or file-specific IOCTL request to a server, and a device- or file-specific IOCTL response to the requester. |
| SMB_com_ioctl_secondary | 1:40 | This command is a companion to SMB_COM_IOCTL. |
| SMB_com_copy | 1:41 | Perform server-side file copies |
| SMB_com_move | 1:42 | Move files on the server |
| SMB_com_echo | 1:43 | Sent by the client to test the transport layer connection with the server. |
| SMB_com_write_and_close | 1:44 | Write to a range of bytes and then close the file. |
| SMB_com_open_andx | 1:45 | Open a new file or open an existing regular file and chain additional messages along with the request. |
| SMB_com_read_andx | 1:46 | Read bytes from a regular file, a named pipe, or a directly accessible device such as a serial port (COM) or printer port (LPT). |
| SMB_com_write_andx | 1:47 | Write bytes to a regular file, a named pipe, or a directly accessible I/O device such as a serial port (COM) or printer port (LPT). |
| SMB_com_new_file_size | 1:48 | This command was reserved but not implemented. |
| SMB_com_close_and_tree_disc | 1:49 | This command was reserved but not implemented. |
| SMB_com_transaction2 | 1:50 | Provide support for a richer set of server-side file system semantics. The "Trans2 subcommands", as they are called, allow clients to set and retrieve Extended Attribute key/value pairs, make use of long file names, and perform directory searches, among other tasks. |
| SMB_com_transaction2_secondary | 1:51 | The SMB_COM_TRANSACTION2_SECONDARY command is used to complete a data transfer initiated by an SMB_COM_TRANSACTION2 request. |
| SMB_com_find_close2 | 1:52 | Close a search handle that was created by a TRANS2_FIND_FIRST2 subcommand. |
| SMB_com_find_notify_close | 1:53 | Close a directory search handle that was created by a TRANS2_FIND_NOTIFY_FIRST subcommand request to the server. |
| SMB_com_tree_connect | 1:112 | Establish a client connection to a server share. |
| SMB_com_tree_disconnect | 1:113 | Disconnect client access to a server resource. |
| SMB_com_negociate | 1:114 | Initiate an SMB connection between the client and the server. |
| SMB_com_session_setup_andx | 1:115 | Configure an SMB session. |
| SMB_com_logoff_andx | 1:116 | Log off the user connection. |
| SMB_com_tree_connect_andx | 1:117 | Establish a client connection to a server share. |
| SMB_com_security_package_andx | 1:126 | Negotiate security packages and related information. |
| SMB_com_query_information_disk | 1:128 | Obtain the capacity and remaining free space on the volume hosting the subtree indicated by the tree_id. |
| SMB_com_search | 1:129 | Search a directory for files or other objects that have names matching a given wildcard template. |
| SMB_com_find | 1:130 | This command is identical in structure and purpose to SMB_COM_SEARCH. The only difference is that SMB_COM_FIND is paired with the SMB_COM_FIND_CLOSE command, which allows the client to explicitly close a search operation. |
| SMB_com_find_unique | 1:131 | The use of this command, as opposed to SMB_COM_SEARCH or SMB_COM_FIND, indicates to the server that it need not maintain a search context or any other state. The SMB_COM_FIND_UNIQUE command is single-use. No follow-up commands are permitted. |
| SMB_com_find_close | 1:132 | This command is used to close a directory search opened by SMB_COM_FIND. |
| SMB_com_nt_transact | 1:160 | SMB_COM_NT_TRANSACT subcommands extend the file system feature access offered by SMB_COM_TRANSACTION2, and also allow for the transfer of very large parameter and data blocks. |
| SMB_com_nt_transact_secondary | 1:161 | The SMB_COM_NT_TRANSACT_SECONDARY command is used to complete a data transfer initiated by an SMB_COM_NT_TRANSACT request. |
| SMB_com_nt_create_andx | 1:162 | This command is used to create and open a new file, or to open an existing file, or to open and truncate an existing file to zero length, or to create a directory, or to create a connection to a named pipe. |
| SMB_com_nt_cancel | 1:164 | Request that a currently pending request be canceled. |
| SMB_com_nt_rename | 1:165 | Create hard links on the remote server, to perform an in-place file rename, and to move a file within its existing path hierarchy. |
| SMB_com_open_print_file | 1:192 | Create a print queue spool file. The file will be queued to the printer when closed. |
| SMB_com_write_print_file | 1:193 | Write data to an open print queue spool file. |
| SMB_com_close_print_file | 1:194 | Closes the specified print queue spool file, causing the server to queue the file for printing. |
| SMB_com_get_print_file | 1:195 | Generate a list of items currently in a print queue associated with the specified tree_id. |
| SMB_com_read_bulk | 1:216 | This command was reserved but not implemented. |
| SMB_com_write_bulk | 1:217 | This command was reserved but not implemented. |
| SMB_com_write_bulk_data | 1:218 | This command was reserved but not implemented. |
| SMB_com_invalid | 1:254 | Reserved value that specifically indicates an invalid command. |
| SMB_com_no_andx_command | 1:255 | In the earliest SMB Protocol specifications (see [IBM-SMB]), this command code was reserved for proprietary protocol extensions. |
| SMB2_com_negotiate | 2:0 | Notify the server what dialects of the SMB 2 Protocol the client understands. |
| SMB2_com_session_setup | 2:1 | Request a new authenticated session within a new or existing SMB 2 Protocol transport connection to the server. |
| SMB2_com_logoff | 2:2 | Request termination of a particular session. |
| SMB2_com_tree_connect | 2:3 | Request access to a particular share on the server. |
| SMB2_com_tree_disconnect | 2:4 | Request that the tree connect that is specified be disconnected. |
| SMB2_com_create | 2:5 | Request either creation of or access to a file. |
| SMB2_com_close | 2:6 | Close an instance of a file that was opened previously with a successful SMB2 CREATE Request. |
| SMB2_com_flush | 2:7 | Request that a server flush all cached file information for a specified open of a file to the persistent store that backs the file. |
| SMB2_com_read | 2:8 | Request a read operation on the file that is specified by the FileId. |
| SMB2_com_write | 2:9 | Write data to the file or named pipe on the server. |
| SMB2_com_lock | 2:10 | Either lock or unlock portions of a file. |
| SMB2_com_ioctl | 2:11 | Issue an implementation-specific file system control or device control (FSCTL/IOCTL) command across the network. |
| SMB2_com_cancel | 2:12 | Cancel a previously sent message on the same SMB2 transport connection. |
| SMB2_com_echo | 2:13 | Determine whether a server is processing requests. |
| SMB2_com_query_directory | 2:14 | Obtain a directory enumeration on a directory open. |
| SMB2_com_change_notify | 2:15 | request change notifications on a directory. |
| SMB2_com_query_info | 2:16 | Request information on a file, named pipe, or underlying volume. |
| SMB2_com_set_info | 2:17 | Set information on a file or underlying object store. |
| SMB2_com_oplock_break | 2:18 | Sent by the server when the underlying object store indicates that an opportunistic lock (oplock) is being broken, representing a change in the oplock level. |
### smbstatus This field does not allow any custom items.
| Name | Category | Value | Description |
|---|---|---|---|
| SMB_status_ok | Success | 0 - 0x0 | The operation completed successfully. |
| NT_status_abandoned | Success | 128 - 0x80 | The caller attempted to wait for a mutex that has been abandoned. |
| NT_status_user_apc | Success | 192 - 0xC0 | A user-mode APC was delivered before the given Interval expired. |
| NT_status_kernel_apc | Success | 256 - 0x100 | |
| NT_status_alerted | Success | 257 - 0x101 | The delay completed because the thread was alerted. |
| NT_status_timeout | Success | 258 - 0x102 | The given Timeout interval expired. |
| NT_status_pending | Success | 259 - 0x103 | The operation that was requested is pending completion. |
| NT_status_reparse | Success | 260 - 0x104 | A reparse should be performed by the Object Manager because the name of the file resulted in a symbolic link. |
| NT_status_more_entries | Success | 261 - 0x105 | Returned by enumeration APIs to indicate more information is available to successive calls. |
| NT_status_not_all_assigned | Success | 262 - 0x106 | Indicates not all privileges or groups that are referenced are assigned to the caller. This allows, for example, all privileges to be disabled without having to know exactly which privileges are assigned. |
| NT_status_some_not_mapped | Success | 263 - 0x107 | Some of the information to be translated has not been translated. |
| NT_status_oplock_break_in_progress | Success | 264 - 0x108 | An open/create operation completed while an opportunistic lock (oplock) break is underway. |
| NT_status_volume_mounted | Success | 265 - 0x109 | A new volume has been mounted by a file system. |
| NT_status_rxact_committed | Success | 266 - 0x10A | This success level status indicates that the transaction state already exists for the registry subtree but that a transaction commit was previously aborted. The commit has now been completed. |
| NT_status_notify_cleanup | Success | 267 - 0x10B | Indicates that a notify change request has been completed due to closing the handle that made the notify change request. |
| SMB_status_notify_enum_dir | Warning | 268 - 0x10C | Indicates that a notify change request is being completed and that the information is not being returned in the caller's buffer. The caller now needs to enumerate the files to find the changes. |
| NT_status_no_quotas_for_account | Success | 269 - 0x10D | {No Quotas} No system quota limits are specifically set for this account. |
| NT_status_primary_transport_connect_failed | Success | 270 - 0x10E | {Connect Failure on Primary Transport} An attempt was made to connect to the remote server on the primary transport, but the connection failed. The computer WAS able to connect on a secondary transport. |
| NT_status_page_fault_transition | Success | 272 - 0x110 | The page fault was a transition fault. |
| NT_status_page_fault_demand_zero | Success | 273 - 0x111 | The page fault was a demand zero fault. |
| NT_status_page_fault_copy_on_write | Success | 274 - 0x112 | The page fault was a demand zero fault. |
| NT_status_page_fault_guard_page | Success | 275 - 0x113 | The page fault was a demand zero fault. |
| NT_status_page_fault_paging_file | Success | 276 - 0x114 | The page fault was satisfied by reading from a secondary storage device. |
| NT_status_cache_page_locked | Success | 277 - 0x115 | The cached page was locked during operation. |
| NT_status_crash_dump | Success | 278 - 0x116 | The crash dump exists in a paging file. |
| NT_status_buffer_all_zeros | Success | 279 - 0x117 | The specified buffer contains all zeros. |
| NT_status_reparse_object | Success | 280 - 0x118 | A reparse should be performed by the Object Manager because the name of the file resulted in a symbolic link. |
| NT_status_resource_requirements_changed | Success | 281 - 0x119 | The device has succeeded a query-stop and its resource requirements have changed. |
| NT_status_translation_complete | Success | 288 - 0x120 | The translator has translated these resources into the global space and no additional translations should be performed. |
| NT_status_ds_membership_evaluated_locally | Success | 289 - 0x121 | The directory service evaluated group memberships locally, because it was unable to contact a global catalog server. |
| NT_status_nothing_to_terminate | Success | 290 - 0x122 | A process being terminated has no threads to terminate. |
| NT_status_process_not_in_job | Success | 291 - 0x123 | The specified process is not part of a job. |
| NT_status_process_in_job | Success | 292 - 0x124 | The specified process is part of a job. |
| NT_status_wait_for_oplock | Success | 871 - 0x367 | An operation is blocked and waiting for an oplock. |
| SMB_status_invalid_smb | Error | 65538 - 0x10002 | The debugger continued. |
| SMB_status_smb_bad_tid | Error | 327682 - 0x50002 | The TID is no longer valid. |
| SMB_status_smb_bad_fid | Warning | 393217 - 0x60001 | Invalid FID. |
| SMB_status_os2_invalid_access | Warning | 786433 - 0xC0001 | Invalid open mode. |
| SMB_status_smb_bad_command | Error | 1441794 - 0x160002 | An unknown SMB command code was received by the server. |
| SMB_status_smb_bad_uid | Error | 5963778 - 0x5B0002 | The UID specified is not known as a valid ID on this server session. |
| SMB_status_os2_no_more_sids | Warning | 7405569 - 0x710001 | Maximum number of searches has been exhausted. |
| SMB_status_os2_invalid_level | Warning | 8126465 - 0x7C0001 | The InformationLevel supplied is invalid. |
| SMB_status_os2_negative_seek | Warning | 8585217 - 0x830001 | An attempt was made to seek to a negative absolute offset within a file. |
| SMB_status_os2_cancel_violation | Warning | 11337729 - 0xAD0001 | No lock request was outstanding for the supplied cancel region. |
| SMB_status_os2_atomic_locks_not_supported | Warning | 11403265 - 0xAE0001 | The file system does not support atomic changes to the lock type. |
| SMB_status_smb_use_mpx | Error | 16384002 - 0xFA0002 | Temporarily unable to support RAW mode transfers. Use MPX mode. |
| SMB_status_smb_use_standard | Error | 16449538 - 0xFB0002 | Temporarily unable to support RAW or MPX mode transfers. Use standard read/write. |
| SMB_status_smb_continue_mpx | Error | 16515074 - 0xFC0002 | Continue in MPX mode. This error code is reserved for future use. |
| SMB_status_os2_cannot_copy | Warning | 17432577 - 0x10A0001 | The copy functions cannot be used. |
| SMB_status_os2_eas_didnt_fit | Warning | 18022401 - 0x1130001 | Either there are no extended attributes, or the available extended attributes did not fit into the response. |
| SMB_status_os2_ea_access_denied | Warning | 65142785 - 0x3E20001 | Access to the extended attribute was denied. |
| NT_status_object_name_exists | Success | 1073741824 - 0x40000000 | {Object Exists} An attempt was made to create an object but the object name already exists. |
| NT_status_thread_was_suspended | Success | 1073741825 - 0x40000001 | {Thread Suspended} A thread termination occurred while the thread was suspended. The thread resumed, and termination proceeded. |
| NT_status_working_set_limit_range | Success | 1073741826 - 0x40000002 | {Working Set Range Error} An attempt was made to set the working set minimum or maximum to values that are outside the allowable range. |
| NT_status_image_not_at_base | Success | 1073741827 - 0x40000003 | {Image Relocated} An image file could not be mapped at the address that is specified in the image file. Local fixes must be performed on this image. |
| NT_status_rxact_state_created | Success | 1073741828 - 0x40000004 | This informational level status indicates that a specified registry subtree transaction state did not yet exist and had to be created. |
| NT_status_segment_notification | Success | 1073741829 - 0x40000005 | {Segment Load} A virtual DOS machine (VDM) is loading, unloading, or moving an MS-DOS or Win16 program segment image. An exception is raised so that a debugger can load, unload, or track symbols and breakpoints within these 16-bit segments. |
| NT_status_local_user_session_key | Success | 1073741830 - 0x40000006 | {Local Session Key} A user session key was requested for a local remote procedure call (RPC) connection. The session key that is returned is a constant value and not unique to this connection. |
| NT_status_bad_current_directory | Success | 1073741831 - 0x40000007 | {Invalid Current Directory} The process cannot switch to the startup current directory. Select OK to set the current directory, or select CANCEL to exit. |
| NT_status_serial_more_writes | Success | 1073741832 - 0x40000008 | {Serial IOCTL Complete} A serial I/O operation was completed by another write to a serial port. (The IOCTL_SERIAL_XOFF_COUNTER reached zero.) |
| NT_status_registry_recovered | Success | 1073741833 - 0x40000009 | {Registry Recovery} One of the files that contains the system registry data had to be recovered by using a log or alternate copy. The recovery was successful. |
| NT_status_ft_read_recovery_from_backup | Success | 1073741834 - 0x4000000A | {Redundant Read} To satisfy a read request, the Windows NT fault-tolerant file system successfully read the requested data from a redundant copy. This was done because the file system encountered a failure on a member of the fault-tolerant volume but was unable to reassign the failing area of the device. |
| NT_status_ft_write_recovery | Success | 1073741835 - 0x4000000B | {Redundant Write} To satisfy a write request, the Windows NT fault-tolerant file system successfully wrote a redundant copy of the information. This was done because the file system encountered a failure on a member of the fault-tolerant volume but was unable to reassign the failing area of the device. |
| NT_status_serial_counter_timeout | Success | 1073741836 - 0x4000000C | {Serial IOCTL Timeout} A serial I/O operation completed because the time-out period expired. (The IOCTL_SERIAL_XOFF_COUNTER had not reached zero.) |
| NT_status_null_lm_password | Success | 1073741837 - 0x4000000D | {Password Too Complex} The Windows password is too complex to be converted to a LAN Manager password. The LAN Manager password that returned is a NULL string. |
| NT_status_image_machine_type_mismatch | Success | 1073741838 - 0x4000000E | {Machine Type Mismatch} The image file is valid but is for a machine type other than the current machine. Select OK to continue, or CANCEL to fail the DLL load. |
| NT_status_receive_partial | Success | 1073741839 - 0x4000000F | {Partial Data Received} The network transport returned partial data to its client. The remaining data will be sent later. |
| NT_status_receive_expedited | Success | 1073741840 - 0x40000010 | {Expedited Data Received} The network transport returned data to its client that was marked as expedited by the remote system. |
| NT_status_receive_partial_expedited | Success | 1073741841 - 0x40000011 | {Partial Expedited Data Received} The network transport returned partial data to its client and this data was marked as expedited by the remote system. The remaining data will be sent later. |
| NT_status_event_done | Success | 1073741842 - 0x40000012 | {TDI Event Done} The TDI indication has completed successfully. |
| NT_status_event_pending | Success | 1073741843 - 0x40000013 | {TDI Event Pending} The TDI indication has entered the pending state. |
| NT_status_checking_file_system | Success | 1073741844 - 0x40000014 | Checking file system. |
| NT_status_fatal_app_exit | Success | 1073741845 - 0x40000015 | {Fatal Application Exit} |
| NT_status_predefined_handle | Success | 1073741846 - 0x40000016 | The specified registry key is referenced by a predefined handle. |
| NT_status_was_unlocked | Success | 1073741847 - 0x40000017 | {Page Unlocked} The page protection of a locked page was changed to 'No Access' and the page was unlocked from memory and from the process. |
| NT_status_service_notification | Success | 1073741848 - 0x40000018 | |
| NT_status_was_locked | Success | 1073741849 - 0x40000019 | {Page Locked} One of the pages to lock was already locked. |
| NT_status_log_hard_error | Success | 1073741850 - 0x4000001A | Application popup |
| NT_status_already_win32 | Success | 1073741851 - 0x4000001B | A Win32 process already exists. |
| NT_status_wx86_unsimulate | Success | 1073741852 - 0x4000001C | An exception status code that is used by the Win32 x86 emulation subsystem. |
| NT_status_wx86_continue | Success | 1073741853 - 0x4000001D | An exception status code that is used by the Win32 x86 emulation subsystem. |
| NT_status_wx86_single_step | Success | 1073741854 - 0x4000001E | An exception status code that is used by the Win32 x86 emulation subsystem. |
| NT_status_wx86_breakpoint | Success | 1073741855 - 0x4000001F | An exception status code that is used by the Win32 x86 emulation subsystem. |
| NT_status_wx86_exception_continue | Success | 1073741856 - 0x40000020 | An exception status code that is used by the Win32 x86 emulation subsystem. |
| NT_status_wx86_exception_lastchance | Success | 1073741857 - 0x40000021 | An exception status code that is used by the Win32 x86 emulation subsystem. |
| NT_status_wx86_exception_chain | Success | 1073741858 - 0x40000022 | An exception status code that is used by the Win32 x86 emulation subsystem. |
| NT_status_image_machine_type_mismatch_exe | Success | 1073741859 - 0x40000023 | {Machine Type Mismatch} The image file is valid but is for a machine type other than the current machine. |
| NT_status_no_yield_performed | Success | 1073741860 - 0x40000024 | A yield execution was performed and no thread was available to run. |
| NT_status_timer_resume_ignored | Success | 1073741861 - 0x40000025 | The resume flag to a timer API was ignored. |
| NT_status_arbitration_unhandled | Success | 1073741862 - 0x40000026 | The arbiter has deferred arbitration of these resources to its parent. |
| NT_status_cardbus_not_supported | Success | 1073741863 - 0x40000027 | The device has detected a CardBus card in its slot. |
| NT_status_wx86_createwx86tib | Success | 1073741864 - 0x40000028 | An exception status code that is used by the Win32 x86 emulation subsystem. |
| NT_status_mp_processor_mismatch | Success | 1073741865 - 0x40000029 | The CPUs in this multiprocessor system are not all the same revision level. To use all processors, the operating system restricts itself to the features of the least capable processor in the system. If problems occur with this system, contact the CPU manufacturer to see if this mix of processors is supported. |
| NT_status_hibernated | Success | 1073741866 - 0x4000002A | The system was put into hibernation. |
| NT_status_resume_hibernation | Success | 1073741867 - 0x4000002B | The system was resumed from hibernation. |
| NT_status_wake_system | Success | 1073742484 - 0x40000294 | The system has awoken. |
| NT_status_ds_shutting_down | Success | 1073742704 - 0x40000370 | The directory service is shutting down. |
| RPC_NT_uuid_local_only | Success | 1073872982 - 0x40020056 | A UUID that is valid only on this computer has been allocated. |
| RPC_NT_send_incomplete | Success | 1073873071 - 0x400200AF | Some data remains to be sent in the request buffer. |
| NT_status_guard_page_violation | Warning | 2147483649 - 0x80000001 | {EXCEPTION} Guard Page Exception A page of memory that marks the end of a data structure, such as a stack or an array, has been accessed. |
| NT_status_datatype_misalignment | Warning | 2147483650 - 0x80000002 | {EXCEPTION} Alignment Fault A data type misalignment was detected in a load or store instruction. |
| NT_status_breakpoint | Warning | 2147483651 - 0x80000003 | {EXCEPTION} Breakpoint A breakpoint has been reached. |
| NT_status_single_step | Warning | 2147483652 - 0x80000004 | {EXCEPTION} Single Step A single step or trace operation has just been completed. |
| SMB_status_buffer_overflow | Warning | 2147483653 - 0x80000005 | {Buffer Overflow} The data was too large to fit into the specified buffer. |
| SMB_status_no_more_files | Success | 2147483654 - 0x80000006 | {No More Files} No more files were found which match the file specification. This is a warning status in specification but since it is used to end a query directory request, we consider it as an ok status. |
| NT_status_wake_system_debugger | Warning | 2147483655 - 0x80000007 | {Kernel Debugger Awakened} The system debugger was awakened by an interrupt. |
| NT_status_handles_closed | Warning | 2147483658 - 0x8000000A | {Handles Closed} Handles to objects have been automatically closed because of the requested operation. |
| NT_status_no_inheritance | Warning | 2147483659 - 0x8000000B | {Non-Inheritable ACL} An access control list (ACL) contains no components that can be inherited. |
| NT_status_guid_substitution_made | Warning | 2147483660 - 0x8000000C | {GUID Substitution} During the translation of a globally unique identifier (GUID) to a Windows security ID (SID), no administratively defined GUID prefix was found. A substitute prefix was used, which will not compromise system security. However, this may provide a more restrictive access than intended. |
| NT_status_partial_copy | Warning | 2147483661 - 0x8000000D | Because of protection conflicts, not all the requested bytes could be copied. |
| SMB_status_device_paper_empty | Error | 2147483662 - 0x8000000E | {Out of Paper} The printer is out of paper. |
| NT_status_device_powered_off | Warning | 2147483663 - 0x8000000F | {Device Power Is Off} The printer power has been turned off. |
| NT_status_device_off_line | Warning | 2147483664 - 0x80000010 | {Device Offline} The printer has been taken offline. |
| NT_status_device_busy | Warning | 2147483665 - 0x80000011 | {Device Busy} The device is currently busy. |
| NT_status_no_more_eas | Warning | 2147483666 - 0x80000012 | {No More EAs} No more extended attributes (EAs) were found for the file. |
| NT_status_invalid_ea_name | Warning | 2147483667 - 0x80000013 | {Illegal EA} The specified extended attribute (EA) name contains at least one illegal character. |
| NT_status_ea_list_inconsistent | Warning | 2147483668 - 0x80000014 | {Inconsistent EA List} The extended attribute (EA) list is inconsistent. |
| NT_status_invalid_ea_flag | Warning | 2147483669 - 0x80000015 | {Invalid EA Flag} An invalid extended attribute (EA) flag was set. |
| NT_status_verify_required | Warning | 2147483670 - 0x80000016 | {Verifying Disk} The media has changed and a verify operation is in progress; therefore, no reads or writes may be performed to the device, except those that are used in the verify operation. |
| NT_status_extraneous_information | Warning | 2147483671 - 0x80000017 | {Too Much Information} The specified access control list (ACL) contained more information than was expected. |
| NT_status_rxact_commit_necessary | Warning | 2147483672 - 0x80000018 | This warning level status indicates that the transaction state already exists for the registry subtree, but that a transaction commit was previously aborted. The commit has NOT been completed but has not been rolled back either; therefore, it may still be committed, if needed. |
| NT_status_no_more_entries | Warning | 2147483674 - 0x8000001A | {No More Entries} No more entries are available from an enumeration operation. |
| NT_status_filemark_detected | Warning | 2147483675 - 0x8000001B | {Filemark Found} A filemark was detected. |
| NT_status_media_changed | Warning | 2147483676 - 0x8000001C | {Media Changed} The media may have changed. |
| NT_status_bus_reset | Warning | 2147483677 - 0x8000001D | {I/O Bus Reset} An I/O bus reset was detected. |
| NT_status_end_of_media | Warning | 2147483678 - 0x8000001E | {End of Media} The end of the media was encountered. |
| NT_status_beginning_of_media | Warning | 2147483679 - 0x8000001F | The beginning of a tape or partition has been detected. |
| NT_status_media_check | Warning | 2147483680 - 0x80000020 | {Media Changed} The media may have changed. |
| NT_status_setmark_detected | Warning | 2147483681 - 0x80000021 | A tape access reached a set mark. |
| NT_status_no_data_detected | Warning | 2147483682 - 0x80000022 | During a tape access, the end of the data written is reached. |
| NT_status_redirector_has_open_handles | Warning | 2147483683 - 0x80000023 | The redirector is in use and cannot be unloaded. |
| NT_status_server_has_open_handles | Warning | 2147483684 - 0x80000024 | The server is in use and cannot be unloaded. |
| NT_status_already_disconnected | Warning | 2147483685 - 0x80000025 | The specified connection has already been disconnected. |
| NT_status_longjump | Warning | 2147483686 - 0x80000026 | A long jump has been executed. |
| NT_status_cleaner_cartridge_installed | Warning | 2147483687 - 0x80000027 | A cleaner cartridge is present in the tape library. |
| NT_status_plugplay_query_vetoed | Warning | 2147483688 - 0x80000028 | The Plug and Play query operation was not successful. |
| NT_status_unwind_consolidate | Warning | 2147483689 - 0x80000029 | A frame consolidation has been executed. |
| NT_status_device_requires_cleaning | Warning | 2147484296 - 0x80000288 | The device has indicated that cleaning is necessary. |
| NT_status_device_door_open | Warning | 2147484297 - 0x80000289 | The device has indicated that its door is open. Further operations require it closed and secured. |
| SMB_status_unsuccessful | Warning | 3221225473 - 0xC0000001 | {Operation Failed} The requested operation was unsuccessful. |
| SMB_status_not_implemented | Error | 3221225474 - 0xC0000002 | {Not Implemented} The requested operation is not implemented. |
| SMB_status_invalid_info_class | Warning | 3221225475 - 0xC0000003 | {Invalid Parameter} The specified information class is not a valid information class for the specified object. |
| NT_status_info_length_mismatch | Error | 3221225476 - 0xC0000004 | The specified information record length does not match the length that is required for the specified information class. |
| NT_status_access_violation | Error | 3221225477 - 0xC0000005 | The instruction caused a memory access violation. |
| NT_status_in_page_error | Error | 3221225478 - 0xC0000006 | The required data was not placed into memory because of an I/O error. |
| NT_status_pagefile_quota | Error | 3221225479 - 0xC0000007 | The page file quota for the process has been exhausted. |
| SMB_status_invalid_handle | Warning | 3221225480 - 0xC0000008 | An invalid HANDLE was specified. |
| NT_status_bad_initial_stack | Error | 3221225481 - 0xC0000009 | An invalid initial stack was specified in a call to NtCreateThread. |
| NT_status_bad_initial_pc | Error | 3221225482 - 0xC000000A | An invalid initial start address was specified in a call to NtCreateThread. |
| NT_status_invalid_cid | Error | 3221225483 - 0xC000000B | An invalid client ID was specified. |
| NT_status_timer_not_canceled | Error | 3221225484 - 0xC000000C | An attempt was made to cancel or set a timer that has an associated APC and the specified thread is not the thread that originally set the timer with an associated APC routine. |
| SMB_status_invalid_parameter | Warning | 3221225485 - 0xC000000D | An invalid parameter was passed to a service or function. |
| SMB_status_no_such_device | Warning | 3221225486 - 0xC000000E | A device that does not exist was specified. |
| SMB_status_no_such_file | Warning | 3221225487 - 0xC000000F | {File Not Found} The file does not exist. |
| SMB_status_invalid_device_request | Warning | 3221225488 - 0xC0000010 | The specified request is not a valid operation for the target device. |
| SMB_status_end_of_file | Warning | 3221225489 - 0xC0000011 | The end-of-file marker has been reached. There is no valid data in the file beyond this marker. |
| SMB_status_wrong_volume | Error | 3221225490 - 0xC0000012 | {Wrong Volume} The wrong volume is in the drive. Insert volume into drive. |
| SMB_status_no_media_in_device | Error | 3221225491 - 0xC0000013 | {No Disk} There is no disk in the drive. Insert a disk into drive. |
| NT_status_unrecognized_media | Error | 3221225492 - 0xC0000014 | {Unknown Disk Format} The disk in drive is not formatted properly. Check the disk, and reformat it, if needed. |
| SMB_status_nonexistent_sector | Error | 3221225493 - 0xC0000015 | {Sector Not Found} The specified sector does not exist. |
| SMB_status_more_processing_required | Warning | 3221225494 - 0xC0000016 | {Still Busy} The specified I/O request packet (IRP) cannot be disposed of because the I/O operation is not complete. |
| NT_status_no_memory | Error | 3221225495 - 0xC0000017 | {Not Enough Quota} Not enough virtual memory or paging file quota is available to complete the specified operation. |
| NT_status_conflicting_addresses | Error | 3221225496 - 0xC0000018 | {Conflicting Address Range} The specified address range conflicts with the address space. |
| NT_status_not_mapped_view | Error | 3221225497 - 0xC0000019 | The address range to unmap is not a mapped view. |
| NT_status_unable_to_free_vm | Error | 3221225498 - 0xC000001A | The virtual memory cannot be freed. |
| NT_status_unable_to_delete_section | Error | 3221225499 - 0xC000001B | The specified section cannot be deleted. |
| NT_status_invalid_system_service | Error | 3221225500 - 0xC000001C | An invalid system service was specified in a system service call. |
| NT_status_illegal_instruction | Error | 3221225501 - 0xC000001D | {EXCEPTION} Illegal Instruction An attempt was made to execute an illegal instruction. |
| SMB_status_invalid_lock_sequence | Warning | 3221225502 - 0xC000001E | {Invalid Lock Sequence} An attempt was made to execute an invalid lock sequence. |
| SMB_status_invalid_view_size | Warning | 3221225503 - 0xC000001F | {Invalid Mapping} An attempt was made to create a view for a section that is bigger than the section. |
| NT_status_invalid_file_for_section | Error | 3221225504 - 0xC0000020 | {Bad File} The attributes of the specified mapping file for a section of memory cannot be read. |
| SMB_status_already_committed | Warning | 3221225505 - 0xC0000021 | {Already Committed} The specified address range is already committed. |
| SMB_status_access_denied | Warning | 3221225506 - 0xC0000022 | {Access Denied} A process has requested access to an object but has not been granted those access rights. |
| NT_status_buffer_too_small | Error | 3221225507 - 0xC0000023 | {Buffer Too Small} The buffer is too small to contain the entry. No information has been written to the buffer. |
| SMB_status_object_type_mismatch | Warning | 3221225508 - 0xC0000024 | {Wrong Type} There is a mismatch between the type of object that is required by the requested operation and the type of object that is specified in the request. |
| NT_status_noncontinuable_exception | Error | 3221225509 - 0xC0000025 | {EXCEPTION} Cannot Continue Windows cannot continue from this exception. |
| NT_status_invalid_disposition | Error | 3221225510 - 0xC0000026 | An invalid exception disposition was returned by an exception handler. |
| NT_status_unwind | Error | 3221225511 - 0xC0000027 | Unwind exception code. |
| NT_status_bad_stack | Error | 3221225512 - 0xC0000028 | An invalid or unaligned stack was encountered during an unwind operation. |
| NT_status_invalid_unwind_target | Error | 3221225513 - 0xC0000029 | An invalid unwind target was encountered during an unwind operation. |
| NT_status_not_locked | Error | 3221225514 - 0xC000002A | An attempt was made to unlock a page of memory that was not locked. |
| NT_status_parity_error | Error | 3221225515 - 0xC000002B | A device parity error on an I/O operation. |
| NT_status_unable_to_decommit_vm | Error | 3221225516 - 0xC000002C | An attempt was made to decommit uncommitted virtual memory. |
| NT_status_not_committed | Error | 3221225517 - 0xC000002D | An attempt was made to change the attributes on memory that has not been committed. |
| NT_status_invalid_port_attributes | Error | 3221225518 - 0xC000002E | Invalid object attributes specified to NtCreatePort or invalid port attributes specified to NtConnectPort. |
| NT_status_port_message_too_long | Error | 3221225519 - 0xC000002F | The length of the message that was passed to NtRequestPort or NtRequestWaitReplyPort is longer than the maximum message that is allowed by the port. |
| NT_status_invalid_parameter_mix | Error | 3221225520 - 0xC0000030 | An invalid combination of parameters was specified. |
| NT_status_invalid_quota_lower | Error | 3221225521 - 0xC0000031 | An attempt was made to lower a quota limit below the current usage. |
| SMB_status_disk_corrupt_error | Error | 3221225522 - 0xC0000032 | {Corrupt Disk} The file system structure on the disk is corrupt and unusable. Run the Chkdsk utility on the volume. |
| NT_status_object_name_invalid | Error | 3221225523 - 0xC0000033 | The object name is invalid. |
| SMB_status_object_name_not_found | Warning | 3221225524 - 0xC0000034 | The object name is not found. |
| SMB_status_object_name_collision | Warning | 3221225525 - 0xC0000035 | The object name already exists. |
| SMB_status_port_disconnected | Warning | 3221225527 - 0xC0000037 | An attempt was made to send a message to a disconnected communication port. |
| NT_status_device_already_attached | Error | 3221225528 - 0xC0000038 | An attempt was made to attach to a device that was already attached to another device. |
| SMB_status_object_path_invalid | Warning | 3221225529 - 0xC0000039 | The object path component was not a directory object. |
| SMB_status_object_path_not_found | Warning | 3221225530 - 0xC000003A | {Path Not Found} The path does not exist. |
| SMB_status_object_path_syntax_bad | Warning | 3221225531 - 0xC000003B | The object path component was not a directory object. |
| NT_status_data_overrun | Error | 3221225532 - 0xC000003C | {Data Overrun} A data overrun error occurred. |
| NT_status_data_late_error | Error | 3221225533 - 0xC000003D | {Data Late} A data late error occurred. |
| SMB_status_data_error | Error | 3221225534 - 0xC000003E | {Data Error} An error occurred in reading or writing data. |
| SMB_status_crc_error | Error | 3221225535 - 0xC000003F | {Bad CRC} A cyclic redundancy check (CRC) checksum error occurred. |
| SMB_status_section_too_big | Warning | 3221225536 - 0xC0000040 | {Section Too Large} The specified section is too big to map the file. |
| SMB_status_port_connection_refused | Warning | 3221225537 - 0xC0000041 | The NtConnectPort request is refused. |
| SMB_status_invalid_port_handle | Warning | 3221225538 - 0xC0000042 | The type of port handle is invalid for the operation that is requested. |
| SMB_status_sharing_violation | Error | 3221225539 - 0xC0000043 | A file cannot be opened because the share access flags are incompatible. |
| NT_status_quota_exceeded | Error | 3221225540 - 0xC0000044 | Insufficient quota exists to complete the operation. |
| NT_status_invalid_page_protection | Error | 3221225541 - 0xC0000045 | The specified page protection was not valid. |
| NT_status_mutant_not_owned | Error | 3221225542 - 0xC0000046 | An attempt to release a mutant object was made by a thread that was not the owner of the mutant object. |
| NT_status_semaphore_limit_exceeded | Error | 3221225543 - 0xC0000047 | An attempt was made to release a semaphore such that its maximum count would have been exceeded. |
| NT_status_port_already_set | Error | 3221225544 - 0xC0000048 | An attempt was made to set the DebugPort or ExceptionPort of a process, but a port already exists in the process, or an attempt was made to set the CompletionPort of a file but a port was already set in the file, or an attempt was made to set the associated completion port of an ALPC port but it is already set. |
| NT_status_section_not_image | Error | 3221225545 - 0xC0000049 | An attempt was made to query image information on a section that does not map an image. |
| NT_status_suspend_count_exceeded | Error | 3221225546 - 0xC000004A | An attempt was made to suspend a thread whose suspend count was at its maximum. |
| SMB_status_thread_is_terminating | Warning | 3221225547 - 0xC000004B | An attempt was made to suspend a thread that has begun termination. |
| NT_status_bad_working_set_limit | Error | 3221225548 - 0xC000004C | An attempt was made to set the working set limit to an invalid value (for example, the minimum greater than maximum). |
| NT_status_incompatible_file_map | Error | 3221225549 - 0xC000004D | A section was created to map a file that is not compatible with an already existing section that maps the same file. |
| NT_status_section_protection | Error | 3221225550 - 0xC000004E | A view to a section specifies a protection that is incompatible with the protection of the initial view. |
| SMB_status_eas_not_supported | Warning | 3221225551 - 0xC000004F | An operation involving EAs failed because the file system does not support EAs. |
| SMB_status_ea_too_large | Warning | 3221225552 - 0xC0000050 | An EA operation failed because the EA set is too large. |
| NT_status_nonexistent_ea_entry | Error | 3221225553 - 0xC0000051 | An EA operation failed because the name or EA index is invalid. |
| NT_status_no_eas_on_file | Error | 3221225554 - 0xC0000052 | The file for which EAs were requested has no EAs. |
| NT_status_ea_corrupt_error | Error | 3221225555 - 0xC0000053 | The EA is corrupt and cannot be read. |
| SMB_status_file_lock_conflict | Error | 3221225556 - 0xC0000054 | A requested read/write cannot be granted due to a conflicting file lock. |
| SMB_status_lock_not_granted | Warning | 3221225557 - 0xC0000055 | A requested file lock cannot be granted due to other existing locks. |
| SMB_status_delete_pending | Warning | 3221225558 - 0xC0000056 | A non-close operation has been requested of a file object that has a delete pending. |
| NT_status_ctl_file_not_supported | Error | 3221225559 - 0xC0000057 | An attempt was made to set the control attribute on a file. This attribute is not supported in the destination file system. |
| NT_status_unknown_revision | Error | 3221225560 - 0xC0000058 | Indicates a revision number that was encountered or specified is not one that is known by the service. It may be a more recent revision than the service is aware of. |
| NT_status_revision_mismatch | Error | 3221225561 - 0xC0000059 | Indicates that two revision levels are incompatible. |
| NT_status_invalid_owner | Error | 3221225562 - 0xC000005A | Indicates a particular security ID may not be assigned as the owner of an object. |
| NT_status_invalid_primary_group | Error | 3221225563 - 0xC000005B | Indicates a particular security ID may not be assigned as the primary group of an object. |
| NT_status_no_impersonation_token | Error | 3221225564 - 0xC000005C | An attempt has been made to operate on an impersonation token by a thread that is not currently impersonating a client. |
| NT_status_cant_disable_mandatory | Error | 3221225565 - 0xC000005D | A mandatory group may not be disabled. |
| NT_status_no_logon_servers | Error | 3221225566 - 0xC000005E | No logon servers are currently available to service the logon request. |
| NT_status_no_such_logon_session | Error | 3221225567 - 0xC000005F | A specified logon session does not exist. It may already have been terminated. |
| NT_status_no_such_privilege | Error | 3221225568 - 0xC0000060 | A specified privilege does not exist. |
| SMB_status_privilege_not_held | Warning | 3221225569 - 0xC0000061 | A required privilege is not held by the client. |
| NT_status_invalid_account_name | Error | 3221225570 - 0xC0000062 | The name provided is not a properly formed account name. |
| NT_status_user_exists | Error | 3221225571 - 0xC0000063 | The specified account already exists. |
| NT_status_no_such_user | Error | 3221225572 - 0xC0000064 | The specified account does not exist. |
| NT_status_group_exists | Error | 3221225573 - 0xC0000065 | The specified group already exists. |
| NT_status_no_such_group | Error | 3221225574 - 0xC0000066 | The specified group does not exist. |
| NT_status_member_in_group | Error | 3221225575 - 0xC0000067 | The specified user account is already in the specified group account. Also used to indicate a group cannot be deleted because it contains a member. |
| NT_status_member_not_in_group | Error | 3221225576 - 0xC0000068 | The specified user account is not a member of the specified group account. |
| NT_status_last_admin | Error | 3221225577 - 0xC0000069 | Indicates the requested operation would disable or delete the last remaining administration account. This is not allowed to prevent creating a situation in which the system cannot be administrated. |
| SMB_status_wrong_password | Error | 3221225578 - 0xC000006A | When trying to update a password, this return status indicates that the value provided as the current password is not correct. |
| NT_status_ill_formed_password | Error | 3221225579 - 0xC000006B | When trying to update a password, this return status indicates that the value provided for the new password contains values that are not allowed in passwords. |
| NT_status_password_restriction | Error | 3221225580 - 0xC000006C | When trying to update a password, this status indicates that some password update rule has been violated. For example, the password may not meet length criteria. |
| SMB_status_logon_failure | Warning | 3221225581 - 0xC000006D | The attempted logon is invalid. This is either due to a bad username or authentication information. |
| NT_status_account_restriction | Error | 3221225582 - 0xC000006E | Indicates a referenced user name and authentication information are valid, but some user account restriction has prevented successful authentication (such as time-of-day restrictions). |
| SMB_status_invalid_logon_hours | Error | 3221225583 - 0xC000006F | The user account has time restrictions and may not be logged onto at this time. |
| SMB_status_invalid_workstation | Error | 3221225584 - 0xC0000070 | The user account is restricted so that it may not be used to log on from the source workstation. |
| SMB_status_password_expired | Error | 3221225585 - 0xC0000071 | The user account password has expired. |
| SMB_status_account_disabled | Error | 3221225586 - 0xC0000072 | The referenced account is currently disabled and may not be logged on to. |
| NT_status_too_many_luids_requested | Error | 3221225588 - 0xC0000074 | The number of LUIDs requested may not be allocated with a single allocation. |
| NT_status_luids_exhausted | Error | 3221225589 - 0xC0000075 | Indicates there are no more LUIDs to allocate. |
| NT_status_invalid_sub_authority | Error | 3221225590 - 0xC0000076 | Indicates the sub-authority value is invalid for the particular use. |
| NT_status_invalid_acl | Error | 3221225591 - 0xC0000077 | Indicates the ACL structure is not valid. |
| NT_status_invalid_sid | Error | 3221225592 - 0xC0000078 | Indicates the SID structure is not valid. |
| NT_status_invalid_security_descr | Error | 3221225593 - 0xC0000079 | Indicates the SECURITY_DESCRIPTOR structure is not valid. |
| NT_status_procedure_not_found | Error | 3221225594 - 0xC000007A | Indicates the specified procedure address cannot be found in the DLL. |
| NT_status_invalid_image_format | Error | 3221225595 - 0xC000007B | {Bad Image} The image is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. |
| NT_status_no_token | Error | 3221225596 - 0xC000007C | An attempt was made to reference a token that does not exist. This is typically done by referencing the token that is associated with a thread when the thread is not impersonating a client. |
| NT_status_bad_inheritance_acl | Error | 3221225597 - 0xC000007D | Indicates that an attempt to build either an inherited ACL or ACE was not successful. This can be caused by a number of things. One of the more probable causes is the replacement of a CreatorId with a SID that did not fit into the ACE or ACL. |
| SMB_status_range_not_locked | Warning | 3221225598 - 0xC000007E | The range specified in NtUnlockFile was not locked. |
| SMB_status_disk_full | Error | 3221225599 - 0xC000007F | An operation failed because the disk was full. |
| NT_status_server_disabled | Error | 3221225600 - 0xC0000080 | The GUID allocation server is disabled at the moment. |
| NT_status_server_not_disabled | Error | 3221225601 - 0xC0000081 | The GUID allocation server is enabled at the moment. |
| NT_status_too_many_guids_requested | Error | 3221225602 - 0xC0000082 | Too many GUIDs were requested from the allocation server at once. |
| NT_status_guids_exhausted | Error | 3221225603 - 0xC0000083 | The GUIDs could not be allocated because the Authority Agent was exhausted. |
| NT_status_invalid_id_authority | Error | 3221225604 - 0xC0000084 | The value provided was an invalid value for an identifier authority. |
| NT_status_agents_exhausted | Error | 3221225605 - 0xC0000085 | No more authority agent values are available for the particular identifier authority value. |
| NT_status_invalid_volume_label | Error | 3221225606 - 0xC0000086 | An invalid volume label has been specified. |
| NT_status_section_not_extended | Error | 3221225607 - 0xC0000087 | A mapped section could not be extended. |
| NT_status_not_mapped_data | Error | 3221225608 - 0xC0000088 | Specified section to flush does not map a data file. |
| NT_status_resource_data_not_found | Error | 3221225609 - 0xC0000089 | Indicates the specified image file did not contain a resource section. |
| NT_status_resource_type_not_found | Error | 3221225610 - 0xC000008A | Indicates the specified resource type cannot be found in the image file. |
| NT_status_resource_name_not_found | Error | 3221225611 - 0xC000008B | Indicates the specified resource name cannot be found in the image file. |
| NT_status_array_bounds_exceeded | Error | 3221225612 - 0xC000008C | {EXCEPTION} Array bounds exceeded. |
| NT_status_float_denormal_operand | Error | 3221225613 - 0xC000008D | {EXCEPTION} Floating-point denormal operand. |
| NT_status_float_divide_by_zero | Error | 3221225614 - 0xC000008E | {EXCEPTION} Floating-point division by zero. |
| NT_status_float_inexact_result | Error | 3221225615 - 0xC000008F | {EXCEPTION} Floating-point inexact result. |
| NT_status_float_invalid_operation | Error | 3221225616 - 0xC0000090 | {EXCEPTION} Floating-point invalid operation. |
| NT_status_float_overflow | Error | 3221225617 - 0xC0000091 | {EXCEPTION} Floating-point overflow. |
| NT_status_float_stack_check | Error | 3221225618 - 0xC0000092 | {EXCEPTION} Floating-point stack check. |
| NT_status_float_underflow | Error | 3221225619 - 0xC0000093 | {EXCEPTION} Floating-point underflow. |
| NT_status_integer_divide_by_zero | Error | 3221225620 - 0xC0000094 | {EXCEPTION} Integer division by zero. |
| NT_status_integer_overflow | Error | 3221225621 - 0xC0000095 | {EXCEPTION} Integer overflow. |
| NT_status_privileged_instruction | Error | 3221225622 - 0xC0000096 | {EXCEPTION} Privileged instruction. |
| SMB_status_too_many_paging_files | Warning | 3221225623 - 0xC0000097 | An attempt was made to install more paging files than the system supports. |
| NT_status_file_invalid | Error | 3221225624 - 0xC0000098 | The volume for a file has been externally altered such that the opened file is no longer valid. |
| NT_status_allotted_space_exceeded | Error | 3221225625 - 0xC0000099 | When a block of memory is allotted for future updates, such as the memory allocated to hold discretionary access control and primary group information, successive updates may exceed the amount of memory originally allotted. Because a quota may already have been charged to several processes that have handles to the object, it is not reasonable to alter the size of the allocated memory. Instead, a request that requires more memory than has been allotted must fail and the STATUS_ALLOTTED_SPACE_EXCEEDED error returned. |
| NT_status_insufficient_resources | Error | 3221225626 - 0xC000009A | Insufficient system resources exist to complete the API. |
| SMB_status_dfs_exit_path_found | Warning | 3221225627 - 0xC000009B | An attempt has been made to open a DFS exit path control file. |
| SMB_status_data_error_unused | Warning | 3221225628 - 0xC000009C | There are bad blocks (sectors) on the hard disk. |
| NT_status_device_not_connected | Error | 3221225629 - 0xC000009D | There is bad cabling, non-termination, or the controller is not able to obtain access to the hard disk. |
| NT_status_device_power_failure | Error | 3221225630 - 0xC000009E | |
| NT_status_free_vm_not_at_base | Error | 3221225631 - 0xC000009F | Virtual memory cannot be freed because the base address is not the base of the region and a region size of zero was specified. |
| NT_status_memory_not_allocated | Error | 3221225632 - 0xC00000A0 | An attempt was made to free virtual memory that is not allocated. |
| NT_status_working_set_quota | Error | 3221225633 - 0xC00000A1 | The working set is not big enough to allow the requested pages to be locked. |
| SMB_status_media_write_protected | Error | 3221225634 - 0xC00000A2 | {Write Protect Error} The disk cannot be written to because it is write-protected. Remove the write protection from the volume in drive. |
| NT_status_device_not_ready | Error | 3221225635 - 0xC00000A3 | {Drive Not Ready} The drive is not ready for use; its door may be open. Check drive and make sure that a disk is inserted and that the drive door is closed. |
| NT_status_invalid_group_attributes | Error | 3221225636 - 0xC00000A4 | The specified attributes are invalid or are incompatible with the attributes for the group as a whole. |
| NT_status_bad_impersonation_level | Error | 3221225637 - 0xC00000A5 | A specified impersonation level is invalid. Also used to indicate that a required impersonation level was not provided. |
| NT_status_cant_open_anonymous | Error | 3221225638 - 0xC00000A6 | An attempt was made to open an anonymous-level token. Anonymous tokens may not be opened. |
| NT_status_bad_validation_class | Error | 3221225639 - 0xC00000A7 | The validation information class requested was invalid. |
| NT_status_bad_token_type | Error | 3221225640 - 0xC00000A8 | The type of a token object is inappropriate for its attempted use. |
| NT_status_bad_master_boot_record | Error | 3221225641 - 0xC00000A9 | The type of a token object is inappropriate for its attempted use. |
| NT_status_instruction_misalignment | Error | 3221225642 - 0xC00000AA | An attempt was made to execute an instruction at an unaligned address and the host system does not support unaligned instruction references. |
| SMB_status_instance_not_available | Warning | 3221225643 - 0xC00000AB | The maximum named pipe instance count has been reached. |
| SMB_status_pipe_not_available | Warning | 3221225644 - 0xC00000AC | An instance of a named pipe cannot be found in the listening state. |
| SMB_status_invalid_pipe_state | Warning | 3221225645 - 0xC00000AD | The named pipe is not in the connected or closing state. |
| SMB_status_pipe_busy | Warning | 3221225646 - 0xC00000AE | The specified pipe is set to complete operations and there are current I/O operations queued so that it cannot be changed to queue operations. |
| SMB_status_illegal_function | Warning | 3221225647 - 0xC00000AF | The specified handle is not open to the server end of the named pipe. |
| SMB_status_pipe_disconnected | Error | 3221225648 - 0xC00000B0 | The specified named pipe is in the disconnected state. |
| SMB_status_pipe_closing | Warning | 3221225649 - 0xC00000B1 | The specified named pipe is in the closing state. |
| NT_status_pipe_connected | Error | 3221225650 - 0xC00000B2 | The specified named pipe is in the connected state. |
| NT_status_pipe_listening | Error | 3221225651 - 0xC00000B3 | The specified named pipe is in the listening state. |
| SMB_status_invalid_read_mode | Warning | 3221225652 - 0xC00000B4 | The specified named pipe is not in message mode. |
| SMB_status_io_timeout | Error | 3221225653 - 0xC00000B5 | {Device Timeout} The specified I/O operation was not completed before the time-out period expired. |
| NT_status_file_forced_closed | Error | 3221225654 - 0xC00000B6 | The specified file has been closed by another process. |
| NT_status_profiling_not_started | Error | 3221225655 - 0xC00000B7 | Profiling is not started. |
| NT_status_profiling_not_stopped | Error | 3221225656 - 0xC00000B8 | Profiling is not stopped. |
| NT_status_could_not_interpret | Error | 3221225657 - 0xC00000B9 | The passed ACL did not contain the minimum required information. |
| SMB_status_file_is_a_directory | Warning | 3221225658 - 0xC00000BA | The file that was specified as a target is a directory, and the caller specified that it could be anything but a directory. |
| NT_status_remote_not_listening | Error | 3221225660 - 0xC00000BC | This remote computer is not listening. |
| NT_status_duplicate_name | Error | 3221225661 - 0xC00000BD | A duplicate name exists on the network. |
| NT_status_bad_network_path | Error | 3221225662 - 0xC00000BE | The network path cannot be located. |
| NT_status_network_busy | Error | 3221225663 - 0xC00000BF | The network is busy. |
| NT_status_device_does_not_exist | Error | 3221225664 - 0xC00000C0 | This device does not exist. |
| NT_status_too_many_commands | Error | 3221225665 - 0xC00000C1 | The network BIOS command limit has been reached. |
| NT_status_adapter_hardware_error | Error | 3221225666 - 0xC00000C2 | An I/O adapter hardware error has occurred. |
| NT_status_invalid_network_response | Error | 3221225667 - 0xC00000C3 | The network responded incorrectly. |
| SMB_status_unexpected_network_error | Error | 3221225668 - 0xC00000C4 | An unexpected network error occurred. |
| NT_status_bad_remote_adapter | Error | 3221225669 - 0xC00000C5 | The remote adapter is not compatible. |
| SMB_status_print_queue_full | Error | 3221225670 - 0xC00000C6 | The print queue is full. |
| SMB_status_no_spool_space | Error | 3221225671 - 0xC00000C7 | Space to store the file that is waiting to be printed is not available on the server. |
| SMB_status_print_cancelled | Error | 3221225672 - 0xC00000C8 | The requested print file has been canceled. |
| SMB_status_network_name_deleted | Error | 3221225673 - 0xC00000C9 | The network name was deleted. |
| SMB_status_network_access_denied | Error | 3221225674 - 0xC00000CA | Network access is denied. |
| SMB_status_bad_device_type | Error | 3221225675 - 0xC00000CB | {Incorrect Network Resource Type} The specified device type (LPT, for example) conflicts with the actual device type on the remote resource. |
| SMB_status_bad_network_name | Error | 3221225676 - 0xC00000CC | {Network Name Not Found} The specified share name cannot be found on the remote server. |
| NT_status_too_many_names | Error | 3221225677 - 0xC00000CD | The name limit for the network adapter card of the local computer was exceeded. |
| SMB_status_too_many_sessions | Error | 3221225678 - 0xC00000CE | The network BIOS session limit was exceeded. |
| NT_status_sharing_paused | Error | 3221225679 - 0xC00000CF | File sharing has been temporarily paused. |
| SMB_status_request_not_accepted | Error | 3221225680 - 0xC00000D0 | No more connections can be made to this remote computer at this time because the computer has already accepted the maximum number of connections. |
| NT_status_redirector_paused | Error | 3221225681 - 0xC00000D1 | Print or disk redirection is temporarily paused. |
| NT_status_net_write_fault | Error | 3221225682 - 0xC00000D2 | A network data fault occurred. |
| NT_status_profiling_at_limit | Error | 3221225683 - 0xC00000D3 | The number of active profiling objects is at the maximum and no more may be started. |
| SMB_status_not_same_device | Warning | 3221225684 - 0xC00000D4 | {Incorrect Volume} The destination file of a rename request is located on a different device than the source of the rename request. |
| SMB_status_file_renamed | Warning | 3221225685 - 0xC00000D5 | The specified file has been renamed and thus cannot be modified. |
| NT_status_virtual_circuit_closed | Error | 3221225686 - 0xC00000D6 | {Network Request Timeout} The session with a remote server has been disconnected because the time-out interval for a request has expired. |
| NT_status_no_security_on_object | Error | 3221225687 - 0xC00000D7 | Indicates an attempt was made to operate on the security of an object that does not have security associated with it. |
| NT_status_cant_wait | Error | 3221225688 - 0xC00000D8 | Used to indicate that an operation cannot continue without blocking for I/O. |
| SMB_status_pipe_empty | Warning | 3221225689 - 0xC00000D9 | Used to indicate that a read operation was done on an empty pipe. |
| NT_status_cant_access_domain_info | Error | 3221225690 - 0xC00000DA | Configuration information could not be read from the domain controller, either because the machine is unavailable or access has been denied. |
| NT_status_cant_terminate_self | Error | 3221225691 - 0xC00000DB | Indicates that a thread attempted to terminate itself by default (called NtTerminateThread with NULL) and it was the last thread in the current process. |
| NT_status_invalid_server_state | Error | 3221225692 - 0xC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. |
| NT_status_invalid_domain_state | Error | 3221225693 - 0xC00000DD | Indicates the domain was in the wrong state to perform the desired operation. |
| NT_status_invalid_domain_role | Error | 3221225694 - 0xC00000DE | This operation is only allowed for the primary domain controller of the domain. |
| NT_status_no_such_domain | Error | 3221225695 - 0xC00000DF | The specified domain did not exist. |
| NT_status_domain_exists | Error | 3221225696 - 0xC00000E0 | The specified domain already exists. |
| NT_status_domain_limit_exceeded | Error | 3221225697 - 0xC00000E1 | An attempt was made to exceed the limit on the number of domains per server for this release. |
| NT_status_oplock_not_granted | Error | 3221225698 - 0xC00000E2 | An error status returned when the opportunistic lock (oplock) request is denied. |
| NT_status_invalid_oplock_protocol | Error | 3221225699 - 0xC00000E3 | An error status returned when an invalid opportunistic lock (oplock) acknowledgment is received by a file system. |
| NT_status_internal_db_corruption | Error | 3221225700 - 0xC00000E4 | This error indicates that the requested operation cannot be completed due to a catastrophic media failure or an on-disk data structure corruption. |
| NT_status_internal_error | Error | 3221225701 - 0xC00000E5 | An internal error occurred. |
| NT_status_generic_not_mapped | Error | 3221225702 - 0xC00000E6 | Indicates generic access types were contained in an access mask which should already be mapped to non-generic access types. |
| NT_status_bad_descriptor_format | Error | 3221225703 - 0xC00000E7 | Indicates a security descriptor is not in the necessary format (absolute or self-relative). |
| NT_status_invalid_user_buffer | Error | 3221225704 - 0xC00000E8 | An access to a user buffer failed at an expected point in time. This code is defined because the caller does not want to accept STATUS_ACCESS_VIOLATION in its filter. |
| NT_status_unexpected_io_error | Error | 3221225705 - 0xC00000E9 | If an I/O error that is not defined in the standard FsRtl filter is returned, it is converted to the following error, which is guaranteed to be in the filter. In this case, information is lost; however, the filter correctly handles the exception. |
| NT_status_unexpected_mm_create_err | Error | 3221225706 - 0xC00000EA | If an MM error that is not defined in the standard FsRtl filter is returned, it is converted to one of the following errors, which are guaranteed to be in the filter. In this case, information is lost; however, the filter correctly handles the exception. |
| NT_status_unexpected_mm_map_error | Error | 3221225707 - 0xC00000EB | If an MM error that is not defined in the standard FsRtl filter is returned, it is converted to one of the following errors, which are guaranteed to be in the filter. In this case, information is lost; however, the filter correctly handles the exception. |
| NT_status_unexpected_mm_extend_err | Error | 3221225708 - 0xC00000EC | If an MM error that is not defined in the standard FsRtl filter is returned, it is converted to one of the following errors, which are guaranteed to be in the filter. In this case, information is lost; however, the filter correctly handles the exception. |
| NT_status_not_logon_process | Error | 3221225709 - 0xC00000ED | The requested action is restricted for use by logon processes only. The calling process has not registered as a logon process. |
| NT_status_logon_session_exists | Error | 3221225710 - 0xC00000EE | An attempt has been made to start a new session manager or LSA logon session by using an ID that is already in use. |
| NT_status_invalid_parameter_1 | Error | 3221225711 - 0xC00000EF | An invalid parameter was passed to a service or function as the first argument. |
| NT_status_invalid_parameter_2 | Error | 3221225712 - 0xC00000F0 | An invalid parameter was passed to a service or function as the second argument. |
| NT_status_invalid_parameter_3 | Error | 3221225713 - 0xC00000F1 | An invalid parameter was passed to a service or function as the third argument. |
| NT_status_invalid_parameter_4 | Error | 3221225714 - 0xC00000F2 | An invalid parameter was passed to a service or function as the fourth argument. |
| NT_status_invalid_parameter_5 | Error | 3221225715 - 0xC00000F3 | An invalid parameter was passed to a service or function as the fifth argument. |
| NT_status_invalid_parameter_6 | Error | 3221225716 - 0xC00000F4 | An invalid parameter was passed to a service or function as the sixth argument. |
| NT_status_invalid_parameter_7 | Error | 3221225717 - 0xC00000F5 | An invalid parameter was passed to a service or function as the seventh argument. |
| NT_status_invalid_parameter_8 | Error | 3221225718 - 0xC00000F6 | An invalid parameter was passed to a service or function as the eighth argument. |
| NT_status_invalid_parameter_9 | Error | 3221225719 - 0xC00000F7 | An invalid parameter was passed to a service or function as the ninth argument. |
| NT_status_invalid_parameter_10 | Error | 3221225720 - 0xC00000F8 | An invalid parameter was passed to a service or function as the tenth argument. |
| NT_status_invalid_parameter_11 | Error | 3221225721 - 0xC00000F9 | An invalid parameter was passed to a service or function as the eleventh argument. |
| NT_status_invalid_parameter_12 | Error | 3221225722 - 0xC00000FA | An invalid parameter was passed to a service or function as the twelfth argument. |
| SMB_status_redirector_not_started | Warning | 3221225723 - 0xC00000FB | An attempt was made to access a network file, but the network software was not yet started. |
| NT_status_redirector_started | Error | 3221225724 - 0xC00000FC | An attempt was made to start the redirector, but the redirector has already been started. |
| NT_status_stack_overflow | Error | 3221225725 - 0xC00000FD | A new guard page for the stack cannot be created. |
| NT_status_no_such_package | Error | 3221225726 - 0xC00000FE | A specified authentication package is unknown. |
| NT_status_bad_function_table | Error | 3221225727 - 0xC00000FF | A malformed function table was encountered during an unwind operation. |
| NT_status_variable_not_found | Error | 3221225728 - 0xC0000100 | Indicates the specified environment variable name was not found in the specified environment block. |
| SMB_status_directory_not_empty | Warning | 3221225729 - 0xC0000101 | Indicates that the directory trying to be deleted is not empty. |
| NT_status_file_corrupt_error | Error | 3221225730 - 0xC0000102 | {Corrupt File} The file or directory is corrupt and unreadable. Run the Chkdsk utility. |
| NT_status_not_a_directory | Error | 3221225731 - 0xC0000103 | A requested opened file is not a directory. |
| NT_status_bad_logon_session_state | Error | 3221225732 - 0xC0000104 | The logon session is not in a state that is consistent with the requested operation. |
| NT_status_logon_session_collision | Error | 3221225733 - 0xC0000105 | An internal LSA error has occurred. An authentication package has requested the creation of a logon session but the ID of an already existing logon session has been specified. |
| NT_status_name_too_long | Error | 3221225734 - 0xC0000106 | A specified name string is too long for its intended use. |
| NT_status_files_open | Error | 3221225735 - 0xC0000107 | The user attempted to force close the files on a redirected drive, but there were opened files on the drive, and the user did not specify a sufficient level of force. |
| NT_status_connection_in_use | Error | 3221225736 - 0xC0000108 | The user attempted to force close the files on a redirected drive, but there were opened directories on the drive, and the user did not specify a sufficient level of force. |
| NT_status_message_not_found | Error | 3221225737 - 0xC0000109 | RtlFindMessage could not locate the requested message ID in the message table resource. |
| SMB_status_process_is_terminating | Warning | 3221225738 - 0xC000010A | An attempt was made to duplicate an object handle into or out of an exiting process. |
| NT_status_invalid_logon_type | Error | 3221225739 - 0xC000010B | Indicates an invalid value has been provided for the LogonType requested. |
| NT_status_no_guid_translation | Error | 3221225740 - 0xC000010C | Indicates that an attempt was made to assign protection to a file system file or directory and one of the SIDs in the security descriptor could not be translated into a GUID that could be stored by the file system. This causes the protection attempt to fail, which may cause a file creation attempt to fail. |
| NT_status_cannot_impersonate | Error | 3221225741 - 0xC000010D | Indicates that an attempt has been made to impersonate via a named pipe that has not yet been read from. |
| NT_status_image_already_loaded | Error | 3221225742 - 0xC000010E | Indicates that the specified image is already loaded. |
| NT_status_abios_not_present | Error | 3221225743 - 0xC000010F | |
| NT_status_abios_lid_not_exist | Error | 3221225744 - 0xC0000110 | |
| NT_status_abios_lid_already_owned | Error | 3221225745 - 0xC0000111 | |
| NT_status_abios_not_lid_owner | Error | 3221225746 - 0xC0000112 | |
| NT_status_abios_invalid_command | Error | 3221225747 - 0xC0000113 | |
| NT_status_abios_invalid_lid | Error | 3221225748 - 0xC0000114 | |
| NT_status_abios_selector_not_available | Error | 3221225749 - 0xC0000115 | |
| NT_status_abios_invalid_selector | Error | 3221225750 - 0xC0000116 | |
| NT_status_no_ldt | Error | 3221225751 - 0xC0000117 | Indicates that an attempt was made to change the size of the LDT for a process that has no LDT. |
| NT_status_invalid_ldt_size | Error | 3221225752 - 0xC0000118 | Indicates that an attempt was made to grow an LDT by setting its size, or that the size was not an even number of selectors. |
| NT_status_invalid_ldt_offset | Error | 3221225753 - 0xC0000119 | Indicates that the starting value for the LDT information was not an integral multiple of the selector size. |
| NT_status_invalid_ldt_descriptor | Error | 3221225754 - 0xC000011A | Indicates that the user supplied an invalid descriptor when trying to set up LDT descriptors. |
| NT_status_invalid_image_ne_format | Error | 3221225755 - 0xC000011B | The specified image file did not have the correct format. It appears to be NE format. |
| NT_status_rxact_invalid_state | Error | 3221225756 - 0xC000011C | Indicates that the transaction state of a registry subtree is incompatible with the requested operation. For example, a request has been made to start a new transaction with one already in progress, or a request has been made to apply a transaction when one is not currently in progress. |
| NT_status_rxact_commit_failure | Error | 3221225757 - 0xC000011D | Indicates an error has occurred during a registry transaction commit. The database has been left in an unknown, but probably inconsistent, state. The state of the registry transaction is left as COMMITTING. |
| NT_status_mapped_file_size_zero | Error | 3221225758 - 0xC000011E | An attempt was made to map a file of size zero with the maximum size specified as zero. |
| SMB_status_too_many_opened_files | Warning | 3221225759 - 0xC000011F | Too many files are opened on a remote server. This error should only be returned by the Windows redirector on a remote drive. |
| NT_status_cancelled | Error | 3221225760 - 0xC0000120 | The I/O request was canceled. |
| SMB_status_cannot_delete | Warning | 3221225761 - 0xC0000121 | An attempt has been made to remove a file or directory that cannot be deleted. |
| NT_status_invalid_computer_name | Error | 3221225762 - 0xC0000122 | Indicates a name that was specified as a remote computer name is syntactically invalid. |
| SMB_status_file_deleted | Warning | 3221225763 - 0xC0000123 | An I/O request other than close was performed on a file after it was deleted, which can only happen to a request that did not complete before the last handle was closed via NtClose. |
| NT_status_special_account | Error | 3221225764 - 0xC0000124 | Indicates an operation that is incompatible with built-in accounts has been attempted on a built-in (special) SAM account. For example, built-in accounts cannot be deleted. |
| NT_status_special_group | Error | 3221225765 - 0xC0000125 | The operation requested may not be performed on the specified group because it is a built-in special group. |
| NT_status_special_user | Error | 3221225766 - 0xC0000126 | The operation requested may not be performed on the specified user because it is a built-in special user. |
| NT_status_members_primary_group | Error | 3221225767 - 0xC0000127 | Indicates a member cannot be removed from a group because the group is currently the member's primary group. |
| SMB_status_file_closed | Warning | 3221225768 - 0xC0000128 | An I/O request other than close and several other special case operations was attempted using a file object that had already been closed. |
| NT_status_too_many_threads | Error | 3221225769 - 0xC0000129 | Indicates a process has too many threads to perform the requested action. For example, assignment of a primary token may only be performed when a process has zero or one threads. |
| NT_status_thread_not_in_process | Error | 3221225770 - 0xC000012A | An attempt was made to operate on a thread within a specific process, but the specified thread is not in the specified process. |
| NT_status_token_already_in_use | Error | 3221225771 - 0xC000012B | An attempt was made to establish a token for use as a primary token but the token is already in use. A token can only be the primary token of one process at a time. |
| NT_status_pagefile_quota_exceeded | Error | 3221225772 - 0xC000012C | The page file quota was exceeded. |
| NT_status_commitment_limit | Error | 3221225773 - 0xC000012D | {Out of Virtual Memory} Your system is low on virtual memory. To ensure that Windows runs correctly, increase the size of your virtual memory paging file. For more information, see Help. |
| NT_status_invalid_image_le_format | Error | 3221225774 - 0xC000012E | The specified image file did not have the correct format: it appears to be LE format. |
| NT_status_invalid_image_not_mz | Error | 3221225775 - 0xC000012F | The specified image file did not have the correct format: it did not have an initial MZ. |
| NT_status_invalid_image_protect | Error | 3221225776 - 0xC0000130 | The specified image file did not have the correct format: it did not have a proper e_lfarlc in the MZ header. |
| NT_status_invalid_image_win_16 | Error | 3221225777 - 0xC0000131 | The specified image file did not have the correct format: it appears to be a 16-bit Windows image. |
| NT_status_logon_server_conflict | Error | 3221225778 - 0xC0000132 | The Netlogon service cannot start because another Netlogon service running in the domain conflicts with the specified role. |
| NT_status_time_difference_at_dc | Error | 3221225779 - 0xC0000133 | The time at the primary domain controller is different from the time at the backup domain controller or member server by too large an amount. |
| NT_status_synchronization_required | Error | 3221225780 - 0xC0000134 | The SAM database on a Windows Server is significantly out of synchronization with the copy on the domain controller. A complete synchronization is required. |
| NT_status_dll_not_found | Error | 3221225781 - 0xC0000135 | {Unable To Locate Component} This application has failed to start because the component was not found. Reinstalling the application may fix this problem. |
| NT_status_open_failed | Error | 3221225782 - 0xC0000136 | The NtCreateFile API failed. This error should never be returned to an application; it is a place holder for the Windows LAN Manager Redirector to use in its internal error-mapping routines. |
| NT_status_io_privilege_failed | Error | 3221225783 - 0xC0000137 | {Privilege Failed} The I/O permissions for the process could not be changed. |
| NT_status_ordinal_not_found | Error | 3221225784 - 0xC0000138 | {Ordinal Not Found} The ordinal could not be located in the dynamic link library. |
| NT_status_entrypoint_not_found | Error | 3221225785 - 0xC0000139 | {Entry Point Not Found} The procedure entry point could not be located in the dynamic link library. |
| NT_status_control_c_exit | Error | 3221225786 - 0xC000013A | {Application Exit by CTRL+C} The application terminated as a result of a CTRL+C. |
| NT_status_local_disconnect | Error | 3221225787 - 0xC000013B | {Virtual Circuit Closed} The network transport on your computer has closed a network connection. There may or may not be I/O requests outstanding. |
| NT_status_remote_disconnect | Error | 3221225788 - 0xC000013C | {Virtual Circuit Closed} The network transport on a remote computer has closed a network connection. There may or may not be I/O requests outstanding. |
| NT_status_remote_resources | Error | 3221225789 - 0xC000013D | {Insufficient Resources on Remote Computer} The remote computer has insufficient resources to complete the network request. For example, the remote computer may not have enough available memory to carry out the request at this time. |
| NT_status_link_failed | Error | 3221225790 - 0xC000013E | {Virtual Circuit Closed} An existing connection (virtual circuit) has been broken at the remote computer. There is probably something wrong with the network software protocol or the network hardware on the remote computer. |
| NT_status_link_timeout | Error | 3221225791 - 0xC000013F | {Virtual Circuit Closed} The network transport on your computer has closed a network connection because it had to wait too long for a response from the remote computer. |
| NT_status_invalid_connection | Error | 3221225792 - 0xC0000140 | The connection handle that was given to the transport was invalid. |
| NT_status_invalid_address | Error | 3221225793 - 0xC0000141 | The address handle that was given to the transport was invalid. |
| NT_status_dll_init_failed | Error | 3221225794 - 0xC0000142 | {DLL Initialization Failed} Initialization of the dynamic link library failed. The process is terminating abnormally. |
| NT_status_missing_systemfile | Error | 3221225795 - 0xC0000143 | {Missing System File} The required system file is bad or missing. |
| NT_status_unhandled_exception | Error | 3221225796 - 0xC0000144 | {Application Error} An exception occurred in the application. |
| NT_status_app_init_failure | Error | 3221225797 - 0xC0000145 | {Application Error} The application failed to initialize properly. Click OK to terminate the application. |
| NT_status_pagefile_create_failed | Error | 3221225798 - 0xC0000146 | {Unable to Create Paging File} The creation of the paging file failed. |
| NT_status_no_pagefile | Error | 3221225799 - 0xC0000147 | {No Paging File Specified} No paging file was specified in the system configuration. |
| NT_status_invalid_level | Error | 3221225800 - 0xC0000148 | {Incorrect System Call Level} An invalid level was passed into the specified system call. |
| NT_status_wrong_password_core | Error | 3221225801 - 0xC0000149 | {Incorrect Password to LAN Manager Server} You specified an incorrect password to a LAN Manager 2.x or MS-NET server. |
| NT_status_illegal_float_context | Error | 3221225802 - 0xC000014A | {EXCEPTION} A real-mode application issued a floating-point instruction and floating-point hardware is not present. |
| NT_status_pipe_broken | Error | 3221225803 - 0xC000014B | The pipe operation has failed because the other end of the pipe has been closed. |
| NT_status_registry_corrupt | Error | 3221225804 - 0xC000014C | {The Registry Is Corrupt} The structure of one of the files that contains registry data is corrupt; the image of the file in memory is corrupt; or the file could not be recovered because the alternate copy or log was absent or corrupt. |
| NT_status_registry_io_failed | Error | 3221225805 - 0xC000014D | An I/O operation initiated by the Registry failed and cannot be recovered. The registry could not read in, write out, or flush one of the files that contain the system's image of the registry. |
| NT_status_no_event_pair | Error | 3221225806 - 0xC000014E | An event pair synchronization operation was performed using the thread-specific client/server event pair object, but no event pair object was associated with the thread. |
| NT_status_unrecognized_volume | Error | 3221225807 - 0xC000014F | The volume does not contain a recognized file system. Be sure that all required file system drivers are loaded and that the volume is not corrupt. |
| NT_status_serial_no_device_inited | Error | 3221225808 - 0xC0000150 | No serial device was successfully initialized. The serial driver will unload. |
| NT_status_no_such_alias | Error | 3221225809 - 0xC0000151 | The specified local group does not exist. |
| NT_status_member_not_in_alias | Error | 3221225810 - 0xC0000152 | The specified account name is not a member of the group. |
| NT_status_member_in_alias | Error | 3221225811 - 0xC0000153 | The specified account name is already a member of the group. |
| NT_status_alias_exists | Error | 3221225812 - 0xC0000154 | The specified local group already exists. |
| NT_status_logon_not_granted | Error | 3221225813 - 0xC0000155 | A requested type of logon (for example, interactive, network, and service) is not granted by the local security policy of the target system. Ask the system administrator to grant the necessary form of logon. |
| NT_status_too_many_secrets | Error | 3221225814 - 0xC0000156 | The maximum number of secrets that may be stored in a single system was exceeded. The length and number of secrets is limited to satisfy U.S. State Department export restrictions. |
| NT_status_secret_too_long | Error | 3221225815 - 0xC0000157 | The length of a secret exceeds the maximum allowable length. The length and number of secrets is limited to satisfy U.S. State Department export restrictions. |
| NT_status_internal_db_error | Error | 3221225816 - 0xC0000158 | The local security authority (LSA) database contains an internal inconsistency. |
| NT_status_fullscreen_mode | Error | 3221225817 - 0xC0000159 | The requested operation cannot be performed in full-screen mode. |
| NT_status_too_many_context_ids | Error | 3221225818 - 0xC000015A | During a logon attempt, the user's security context accumulated too many security IDs. This is a very unusual situation. Remove the user from some global or local groups to reduce the number of security IDs to incorporate into the security context. |
| NT_status_logon_type_not_granted | Error | 3221225819 - 0xC000015B | A user has requested a type of logon (for example, interactive or network) that has not been granted. An administrator has control over who may logon interactively and through the network. |
| NT_status_not_registry_file | Error | 3221225820 - 0xC000015C | The system has attempted to load or restore a file into the registry, and the specified file is not in the format of a registry file. |
| NT_status_nt_cross_encryption_required | Error | 3221225821 - 0xC000015D | An attempt was made to change a user password in the security account manager without providing the necessary Windows cross-encrypted password. |
| NT_status_domain_ctrlr_config_error | Error | 3221225822 - 0xC000015E | A Windows Server has an incorrect configuration. |
| NT_status_ft_missing_member | Error | 3221225823 - 0xC000015F | An attempt was made to explicitly access the secondary copy of information via a device control to the fault tolerance driver and the secondary copy is not present in the system. |
| NT_status_ill_formed_service_entry | Error | 3221225824 - 0xC0000160 | A configuration registry node that represents a driver service entry was ill-formed and did not contain the required value entries. |
| NT_status_illegal_character | Error | 3221225825 - 0xC0000161 | An illegal character was encountered. For a multibyte character set, this includes a lead byte without a succeeding trail byte. For the Unicode character set this includes the characters 0xFFFF and 0xFFFE. |
| NT_status_unmappable_character | Error | 3221225826 - 0xC0000162 | No mapping for the Unicode character exists in the target multibyte code page. |
| NT_status_undefined_character | Error | 3221225827 - 0xC0000163 | The Unicode character is not defined in the Unicode character set that is installed on the system. |
| NT_status_floppy_volume | Error | 3221225828 - 0xC0000164 | The paging file cannot be created on a floppy disk. |
| NT_status_floppy_id_mark_not_found | Error | 3221225829 - 0xC0000165 | {Floppy Disk Error} While accessing a floppy disk, an ID address mark was not found. |
| NT_status_floppy_wrong_cylinder | Error | 3221225830 - 0xC0000166 | {Floppy Disk Error} While accessing a floppy disk, the track address from the sector ID field was found to be different from the track address that is maintained by the controller. |
| NT_status_floppy_unknown_error | Error | 3221225831 - 0xC0000167 | {Floppy Disk Error} The floppy disk controller reported an error that is not recognized by the floppy disk driver. |
| NT_status_floppy_bad_registers | Error | 3221225832 - 0xC0000168 | {Floppy Disk Error} While accessing a floppy-disk, the controller returned inconsistent results via its registers. |
| NT_status_disk_recalibrate_failed | Error | 3221225833 - 0xC0000169 | {Hard Disk Error} While accessing the hard disk, a recalibrate operation failed, even after retries. |
| NT_status_disk_operation_failed | Error | 3221225834 - 0xC000016A | {Hard Disk Error} While accessing the hard disk, a disk operation failed even after retries. |
| NT_status_disk_reset_failed | Error | 3221225835 - 0xC000016B | {Hard Disk Error} While accessing the hard disk, a disk controller reset was needed, but even that failed. |
| NT_status_shared_irq_busy | Error | 3221225836 - 0xC000016C | An attempt was made to open a device that was sharing an interrupt request (IRQ) with other devices. At least one other device that uses that IRQ was already opened. Two concurrent opens of devices that share an IRQ and only work via interrupts is not supported for the particular bus type that the devices use. |
| NT_status_ft_orphaning | Error | 3221225837 - 0xC000016D | {FT Orphaning} A disk that is part of a fault-tolerant volume can no longer be accessed. |
| NT_status_bios_failed_to_connect_interrupt | Error | 3221225838 - 0xC000016E | The basic input/output system (BIOS) failed to connect a system interrupt to the device or bus for which the device is connected. |
| NT_status_partition_failure | Error | 3221225842 - 0xC0000172 | The tape could not be partitioned. |
| NT_status_invalid_block_length | Error | 3221225843 - 0xC0000173 | When accessing a new tape of a multi-volume partition, the current blocksize is incorrect. |
| NT_status_device_not_partitioned | Error | 3221225844 - 0xC0000174 | The tape partition information could not be found when loading a tape. |
| NT_status_unable_to_lock_media | Error | 3221225845 - 0xC0000175 | An attempt to lock the eject media mechanism failed. |
| NT_status_unable_to_unload_media | Error | 3221225846 - 0xC0000176 | An attempt to unload media failed. |
| NT_status_eom_overflow | Error | 3221225847 - 0xC0000177 | The physical end of tape was detected. |
| NT_status_no_media | Error | 3221225848 - 0xC0000178 | {No Media} There is no media in the drive. |
| NT_status_no_such_member | Error | 3221225850 - 0xC000017A | A member could not be added to or removed from the local group because the member does not exist. |
| NT_status_invalid_member | Error | 3221225851 - 0xC000017B | A new member could not be added to a local group because the member has the wrong account type. |
| NT_status_key_deleted | Error | 3221225852 - 0xC000017C | An illegal operation was attempted on a registry key that has been marked for deletion. |
| NT_status_no_log_space | Error | 3221225853 - 0xC000017D | The system could not allocate the required space in a registry log. |
| NT_status_too_many_sids | Error | 3221225854 - 0xC000017E | Too many SIDs have been specified. |
| NT_status_lm_cross_encryption_required | Error | 3221225855 - 0xC000017F | An attempt was made to change a user password in the security account manager without providing the necessary LM cross-encrypted password. |
| NT_status_key_has_children | Error | 3221225856 - 0xC0000180 | An attempt was made to create a symbolic link in a registry key that already has subkeys or values. |
| NT_status_child_must_be_volatile | Error | 3221225857 - 0xC0000181 | An attempt was made to create a stable subkey under a volatile parent key. |
| NT_status_device_configuration_error | Error | 3221225858 - 0xC0000182 | The I/O device is configured incorrectly or the configuration parameters to the driver are incorrect. |
| NT_status_driver_internal_error | Error | 3221225859 - 0xC0000183 | An error was detected between two drivers or within an I/O driver. |
| SMB_status_invalid_device_state | Error | 3221225860 - 0xC0000184 | The device is not in a valid state to perform this request. |
| NT_status_io_device_error | Error | 3221225861 - 0xC0000185 | The I/O device reported an I/O error. |
| NT_status_device_protocol_error | Error | 3221225862 - 0xC0000186 | A protocol error was detected between the driver and the device. |
| NT_status_backup_controller | Error | 3221225863 - 0xC0000187 | This operation is only allowed for the primary domain controller of the domain. |
| NT_status_log_file_full | Error | 3221225864 - 0xC0000188 | The log file space is insufficient to support this operation. |
| NT_status_too_late | Error | 3221225865 - 0xC0000189 | A write operation was attempted to a volume after it was dismounted. |
| NT_status_no_trust_lsa_secret | Error | 3221225866 - 0xC000018A | The workstation does not have a trust secret for the primary domain in the local LSA database. |
| NT_status_no_trust_sam_account | Error | 3221225867 - 0xC000018B | The SAM database on the Windows Server does not have a computer account for this workstation trust relationship. |
| NT_status_trusted_domain_failure | Error | 3221225868 - 0xC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. |
| NT_status_trusted_relationship_failure | Error | 3221225869 - 0xC000018D | The logon request failed because the trust relationship between this workstation and the primary domain failed. |
| NT_status_eventlog_file_corrupt | Error | 3221225870 - 0xC000018E | The Eventlog log file is corrupt. |
| NT_status_eventlog_cant_start | Error | 3221225871 - 0xC000018F | No Eventlog log file could be opened. The Eventlog service did not start. |
| NT_status_trust_failure | Error | 3221225872 - 0xC0000190 | The network logon failed. This may be because the validation authority cannot be reached. |
| NT_status_mutant_limit_exceeded | Error | 3221225873 - 0xC0000191 | An attempt was made to acquire a mutant such that its maximum count would have been exceeded. |
| NT_status_netlogon_not_started | Error | 3221225874 - 0xC0000192 | An attempt was made to logon, but the NetLogon service was not started. |
| SMB_status_account_expired | Error | 3221225875 - 0xC0000193 | The user account has expired. |
| NT_status_possible_deadlock | Error | 3221225876 - 0xC0000194 | {EXCEPTION} Possible deadlock condition. |
| NT_status_network_credential_conflict | Error | 3221225877 - 0xC0000195 | Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again. |
| NT_status_remote_session_limit | Error | 3221225878 - 0xC0000196 | An attempt was made to establish a session to a network server, but there are already too many sessions established to that server. |
| NT_status_eventlog_file_changed | Error | 3221225879 - 0xC0000197 | The log file has changed between reads. |
| NT_status_nologon_interdomain_trust_account | Error | 3221225880 - 0xC0000198 | The account used is an interdomain trust account. Use your global user account or local user account to access this server. |
| NT_status_nologon_workstation_trust_account | Error | 3221225881 - 0xC0000199 | The account used is a computer account. Use your global user account or local user account to access this server. |
| NT_status_nologon_server_trust_account | Error | 3221225882 - 0xC000019A | The account used is a server trust account. Use your global user account or local user account to access this server. |
| NT_status_domain_trust_inconsistent | Error | 3221225883 - 0xC000019B | The name or SID of the specified domain is inconsistent with the trust information for that domain. |
| NT_status_fs_driver_required | Error | 3221225884 - 0xC000019C | A volume has been accessed for which a file system driver is required that has not yet been loaded. |
| NT_status_no_user_session_key | Error | 3221225986 - 0xC0000202 | There is no user session key for the specified logon session. |
| NT_status_user_session_deleted | Error | 3221225987 - 0xC0000203 | The remote user session has been deleted. |
| NT_status_resource_lang_not_found | Error | 3221225988 - 0xC0000204 | Indicates the specified resource language ID cannot be found in the image file. |
| SMB_status_insuff_server_resources | Warning | 3221225989 - 0xC0000205 | Insufficient server resources exist to complete the request. |
| NT_status_invalid_buffer_size | Error | 3221225990 - 0xC0000206 | The size of the buffer is invalid for the specified operation. |
| NT_status_invalid_address_component | Error | 3221225991 - 0xC0000207 | The transport rejected the specified network address as invalid. |
| NT_status_invalid_address_wildcard | Error | 3221225992 - 0xC0000208 | The transport rejected the specified network address due to invalid use of a wildcard. |
| NT_status_too_many_addresses | Error | 3221225993 - 0xC0000209 | The transport address could not be opened because all the available addresses are in use. |
| NT_status_address_already_exists | Error | 3221225994 - 0xC000020A | The transport address could not be opened because it already exists. |
| NT_status_address_closed | Error | 3221225995 - 0xC000020B | The transport address is now closed. |
| NT_status_connection_disconnected | Error | 3221225996 - 0xC000020C | The transport connection is now disconnected. |
| NT_status_connection_reset | Error | 3221225997 - 0xC000020D | The transport connection has been reset. |
| NT_status_too_many_nodes | Error | 3221225998 - 0xC000020E | The transport cannot dynamically acquire any more nodes. |
| NT_status_transaction_aborted | Error | 3221225999 - 0xC000020F | The transport aborted a pending transaction. |
| NT_status_transaction_timed_out | Error | 3221226000 - 0xC0000210 | The transport timed out a request that is waiting for a response. |
| NT_status_transaction_no_release | Error | 3221226001 - 0xC0000211 | The transport did not receive a release for a pending response. |
| NT_status_transaction_no_match | Error | 3221226002 - 0xC0000212 | The transport did not find a transaction that matches the specific token. |
| NT_status_transaction_responded | Error | 3221226003 - 0xC0000213 | The transport had previously responded to a transaction request. |
| NT_status_transaction_invalid_id | Error | 3221226004 - 0xC0000214 | The transport does not recognize the specified transaction request ID. |
| NT_status_transaction_invalid_type | Error | 3221226005 - 0xC0000215 | The transport does not recognize the specified transaction request type. |
| NT_status_not_server_session | Error | 3221226006 - 0xC0000216 | The transport can only process the specified request on the server side of a session. |
| NT_status_not_client_session | Error | 3221226007 - 0xC0000217 | The transport can only process the specified request on the client side of a session. |
| NT_status_cannot_load_registry_file | Error | 3221226008 - 0xC0000218 | {Registry File Failure} The registry cannot load the hive (file). It is corrupt, absent, or not writable. |
| NT_status_debug_attach_failed | Error | 3221226009 - 0xC0000219 | {Unexpected Failure in DebugActiveProcess} An unexpected failure occurred while processing a DebugActiveProcess API request. You may choose OK to terminate the process, or Cancel to ignore the error. |
| NT_status_system_process_terminated | Error | 3221226010 - 0xC000021A | {Fatal System Error} The system process terminated unexpectedly. The system has been shut down. |
| NT_status_data_not_accepted | Error | 3221226011 - 0xC000021B | {Data Not Accepted} The TDI client could not handle the data received during an indication. |
| NT_status_no_browser_servers_found | Error | 3221226012 - 0xC000021C | {Unable to Retrieve Browser Server List} The list of servers for this workgroup is not currently available. |
| NT_status_vdm_hard_error | Error | 3221226013 - 0xC000021D | NTVDM encountered a hard error. |
| NT_status_driver_cancel_timeout | Error | 3221226014 - 0xC000021E | {Cancel Timeout} The driver failed to complete a canceled I/O request in the allotted time. |
| NT_status_reply_message_mismatch | Error | 3221226015 - 0xC000021F | {Reply Message Mismatch} An attempt was made to reply to an LPC message, but the thread specified by the client ID in the message was not waiting on that message. |
| NT_status_mapped_alignment | Error | 3221226016 - 0xC0000220 | {Mapped View Alignment Incorrect} An attempt was made to map a view of a file, but either the specified base address or the offset into the file were not aligned on the proper allocation granularity. |
| NT_status_image_checksum_mismatch | Error | 3221226017 - 0xC0000221 | {Bad Image Checksum} The image is possibly corrupt. The header checksum does not match the computed checksum. |
| NT_status_lost_writebehind_data | Error | 3221226018 - 0xC0000222 | {Delayed Write Failed} Windows was unable to save all the data for the file. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Try to save this file elsewhere. |
| NT_status_client_server_parameters_invalid | Error | 3221226019 - 0xC0000223 | The parameters passed to the server in the client/server shared memory window were invalid. Too much data may have been put in the shared memory window. |
| SMB_status_password_must_change | Error | 3221226020 - 0xC0000224 | The user password must be changed before logging on the first time. |
| NT_status_not_found | Error | 3221226021 - 0xC0000225 | The object was not found. |
| NT_status_not_tiny_stream | Error | 3221226022 - 0xC0000226 | The stream is not a tiny stream. |
| NT_status_recovery_failure | Error | 3221226023 - 0xC0000227 | A transaction recovery failed. |
| NT_status_stack_overflow_read | Error | 3221226024 - 0xC0000228 | The request must be handled by the stack overflow code. |
| NT_status_fail_check | Error | 3221226025 - 0xC0000229 | A consistency check failed. |
| NT_status_duplicate_objectid | Error | 3221226026 - 0xC000022A | The attempt to insert the ID in the index failed because the ID is already in the index. |
| NT_status_objectid_exists | Error | 3221226027 - 0xC000022B | The attempt to set the object ID failed because the object already has an ID. |
| NT_status_convert_to_large | Error | 3221226028 - 0xC000022C | Internal OFS status codes indicating how an allocation operation is handled. Either it is retried after the containing oNode is moved or the extent stream is converted to a large stream. |
| NT_status_retry | Error | 3221226029 - 0xC000022D | The request needs to be retried. |
| NT_status_found_out_of_scope | Error | 3221226030 - 0xC000022E | The attempt to find the object found an object on the volume that matches by ID; however, it is out of the scope of the handle that is used for the operation. |
| NT_status_allocate_bucket | Error | 3221226031 - 0xC000022F | The bucket array must be grown. Retry the transaction after doing so. |
| NT_status_propset_not_found | Error | 3221226032 - 0xC0000230 | The specified property set does not exist on the object. |
| NT_status_marshall_overflow | Error | 3221226033 - 0xC0000231 | The user/kernel marshaling buffer has overflowed. |
| NT_status_invalid_variant | Error | 3221226034 - 0xC0000232 | The supplied variant structure contains invalid data. |
| NT_status_domain_controller_not_found | Error | 3221226035 - 0xC0000233 | A domain controller for this domain was not found. |
| NT_status_account_locked_out | Error | 3221226036 - 0xC0000234 | The user account has been automatically locked because too many invalid logon attempts or password change attempts have been requested. |
| SMB_status_handle_not_closable | Warning | 3221226037 - 0xC0000235 | NtClose was called on a handle that was protected from close via NtSetInformationObject. |
| NT_status_connection_refused | Error | 3221226038 - 0xC0000236 | The transport-connection attempt was refused by the remote system. |
| NT_status_graceful_disconnect | Error | 3221226039 - 0xC0000237 | The transport connection was gracefully closed. |
| NT_status_address_already_associated | Error | 3221226040 - 0xC0000238 | The transport endpoint already has an address associated with it. |
| NT_status_address_not_associated | Error | 3221226041 - 0xC0000239 | An address has not yet been associated with the transport endpoint. |
| NT_status_connection_invalid | Error | 3221226042 - 0xC000023A | An operation was attempted on a nonexistent transport connection. |
| NT_status_connection_active | Error | 3221226043 - 0xC000023B | An invalid operation was attempted on an active transport connection. |
| NT_status_network_unreachable | Error | 3221226044 - 0xC000023C | The remote network is not reachable by the transport. |
| NT_status_host_unreachable | Error | 3221226045 - 0xC000023D | The remote system is not reachable by the transport. |
| NT_status_protocol_unreachable | Error | 3221226046 - 0xC000023E | The remote system does not support the transport protocol. |
| NT_status_port_unreachable | Error | 3221226047 - 0xC000023F | No service is operating at the destination port of the transport on the remote system. |
| NT_status_request_aborted | Error | 3221226048 - 0xC0000240 | The request was aborted. |
| NT_status_connection_aborted | Error | 3221226049 - 0xC0000241 | The transport connection was aborted by the local system. |
| NT_status_bad_compression_buffer | Error | 3221226050 - 0xC0000242 | The specified buffer contains ill-formed data. |
| NT_status_user_mapped_file | Error | 3221226051 - 0xC0000243 | The requested operation cannot be performed on a file with a user mapped section open. |
| NT_status_audit_failed | Error | 3221226052 - 0xC0000244 | {Audit Failed} An attempt to generate a security audit failed. |
| NT_status_timer_resolution_not_set | Error | 3221226053 - 0xC0000245 | The timer resolution was not previously set by the current process. |
| NT_status_connection_count_limit | Error | 3221226054 - 0xC0000246 | A connection to the server could not be made because the limit on the number of concurrent connections for this account has been reached. |
| NT_status_login_time_restriction | Error | 3221226055 - 0xC0000247 | Attempting to log on during an unauthorized time of day for this account. |
| NT_status_login_wksta_restriction | Error | 3221226056 - 0xC0000248 | The account is not authorized to log on from this station. |
| NT_status_image_mp_up_mismatch | Error | 3221226057 - 0xC0000249 | {UP/MP Image Mismatch} The image has been modified for use on a uniprocessor system, but you are running it on a multiprocessor machine. Reinstall the image file. |
| NT_status_insufficient_logon_info | Error | 3221226064 - 0xC0000250 | There is insufficient account information to log you on. |
| NT_status_bad_dll_entrypoint | Error | 3221226065 - 0xC0000251 | {Invalid DLL Entrypoint} The dynamic link library is not written correctly. The stack pointer has been left in an inconsistent state. The entry point should be declared as WINAPI or STDCALL. Select YES to fail the DLL load. Select NO to continue execution. Selecting NO may cause the application to operate incorrectly. |
| NT_status_bad_service_entrypoint | Error | 3221226066 - 0xC0000252 | {Invalid Service Callback Entrypoint} The service is not written correctly. The stack pointer has been left in an inconsistent state. The callback entry point should be declared as WINAPI or STDCALL. Selecting OK will cause the service to continue operation. However, the service process may operate incorrectly. |
| NT_status_lpc_reply_lost | Error | 3221226067 - 0xC0000253 | The server received the messages but did not send a reply. |
| NT_status_ip_address_conflict1 | Error | 3221226068 - 0xC0000254 | There is an IP address conflict with another system on the network. |
| NT_status_ip_address_conflict2 | Error | 3221226069 - 0xC0000255 | There is an IP address conflict with another system on the network. |
| NT_status_registry_quota_limit | Error | 3221226070 - 0xC0000256 | {Low On Registry Space} The system has reached the maximum size that is allowed for the system part of the registry. Additional storage requests will be ignored. |
| SMB_status_path_not_covered | Error | 3221226071 - 0xC0000257 | The contacted server does not support the indicated part of the DFS namespace. |
| NT_status_no_callback_active | Error | 3221226072 - 0xC0000258 | A callback return system service cannot be executed when no callback is active. |
| NT_status_license_quota_exceeded | Error | 3221226073 - 0xC0000259 | The service being accessed is licensed for a particular number of connections. No more connections can be made to the service at this time because the service has already accepted the maximum number of connections. |
| NT_status_pwd_too_short | Error | 3221226074 - 0xC000025A | The password provided is too short to meet the policy of your user account. Choose a longer password. |
| NT_status_pwd_too_recent | Error | 3221226075 - 0xC000025B | The policy of your user account does not allow you to change passwords too frequently. This is done to prevent users from changing back to a familiar, but potentially discovered, password. If you feel your password has been compromised, contact your administrator immediately to have a new one assigned. |
| NT_status_pwd_history_conflict | Error | 3221226076 - 0xC000025C | You have attempted to change your password to one that you have used in the past. The policy of your user account does not allow this. Select a password that you have not previously used. |
| NT_status_plugplay_no_device | Error | 3221226078 - 0xC000025E | You have attempted to load a legacy device driver while its device instance had been disabled. |
| NT_status_unsupported_compression | Error | 3221226079 - 0xC000025F | The specified compression format is unsupported. |
| NT_status_invalid_hw_profile | Error | 3221226080 - 0xC0000260 | The specified hardware profile configuration is invalid. |
| NT_status_invalid_plugplay_device_path | Error | 3221226081 - 0xC0000261 | The specified Plug and Play registry device path is invalid. |
| NT_status_driver_ordinal_not_found | Error | 3221226082 - 0xC0000262 | {Driver Entry Point Not Found} The device driver could not locate the ordinal in driver. |
| NT_status_driver_entrypoint_not_found | Error | 3221226083 - 0xC0000263 | {Driver Entry Point Not Found} The device driver could not locate the entry point in driver. |
| NT_status_resource_not_owned | Error | 3221226084 - 0xC0000264 | {Application Error} The application attempted to release a resource it did not own. Click OK to terminate the application. |
| NT_status_too_many_links | Error | 3221226085 - 0xC0000265 | An attempt was made to create more links on a file than the file system supports. |
| NT_status_quota_list_inconsistent | Error | 3221226086 - 0xC0000266 | The specified quota list is internally inconsistent with its descriptor. |
| NT_status_file_is_offline | Error | 3221226087 - 0xC0000267 | The specified file has been relocated to offline storage. |
| NT_status_evaluation_expiration | Error | 3221226088 - 0xC0000268 | {Windows Evaluation Notification} The evaluation period for this installation of Windows has expired. This system will shutdown in 1 hour. To restore access to this installation of Windows, upgrade this installation by using a licensed distribution of this product. |
| NT_status_illegal_dll_relocation | Error | 3221226089 - 0xC0000269 | {Illegal System DLL Relocation} The system DLL was relocated in memory. The application will not run properly. The relocation occurred because the DLL occupied an address range that is reserved for Windows system DLLs. The vendor supplying the DLL should be contacted for a new DLL. |
| NT_status_license_violation | Error | 3221226090 - 0xC000026A | {License Violation} The system has detected tampering with your registered product type. This is a violation of your software license. Tampering with the product type is not permitted. |
| NT_status_dll_init_failed_logoff | Error | 3221226091 - 0xC000026B | {DLL Initialization Failed} The application failed to initialize because the window station is shutting down. |
| NT_status_driver_unable_to_load | Error | 3221226092 - 0xC000026C | {Unable to Load Device Driver} The device driver could not be loaded. |
| NT_status_dfs_unavailable | Error | 3221226093 - 0xC000026D | DFS is unavailable on the contacted server. |
| NT_status_volume_dismounted | Error | 3221226094 - 0xC000026E | An operation was attempted to a volume after it was dismounted. |
| NT_status_wx86_internal_error | Error | 3221226095 - 0xC000026F | An internal error occurred in the Win32 x86 emulation subsystem. |
| NT_status_wx86_float_stack_check | Error | 3221226096 - 0xC0000270 | Win32 x86 emulation subsystem floating-point stack check. |
| NT_status_validate_continue | Error | 3221226097 - 0xC0000271 | The validation process needs to continue on to the next step. |
| NT_status_no_match | Error | 3221226098 - 0xC0000272 | There was no match for the specified key in the index. |
| NT_status_no_more_matches | Error | 3221226099 - 0xC0000273 | There are no more matches for the current index enumeration. |
| NT_status_not_a_reparse_point | Error | 3221226101 - 0xC0000275 | The NTFS file or directory is not a reparse point. |
| NT_status_io_reparse_tag_invalid | Error | 3221226102 - 0xC0000276 | The Windows I/O reparse tag passed for the NTFS reparse point is invalid. |
| NT_status_io_reparse_tag_mismatch | Error | 3221226103 - 0xC0000277 | The Windows I/O reparse tag does not match the one that is in the NTFS reparse point. |
| NT_status_io_reparse_data_invalid | Error | 3221226104 - 0xC0000278 | The user data passed for the NTFS reparse point is invalid. |
| NT_status_io_reparse_tag_not_handled | Error | 3221226105 - 0xC0000279 | The layered file system driver for this I/O tag did not handle it when needed. |
| NT_status_reparse_point_not_resolved | Error | 3221226112 - 0xC0000280 | The NTFS symbolic link could not be resolved even though the initial file name is valid. |
| NT_status_directory_is_a_reparse_point | Error | 3221226113 - 0xC0000281 | The NTFS directory is a reparse point. |
| NT_status_range_list_conflict | Error | 3221226114 - 0xC0000282 | The range could not be added to the range list because of a conflict. |
| NT_status_source_element_empty | Error | 3221226115 - 0xC0000283 | The specified medium changer source element contains no media. |
| NT_status_destination_element_full | Error | 3221226116 - 0xC0000284 | The specified medium changer destination element already contains media. |
| NT_status_illegal_element_address | Error | 3221226117 - 0xC0000285 | The specified medium changer element does not exist. |
| NT_status_magazine_not_present | Error | 3221226118 - 0xC0000286 | The specified element is contained in a magazine that is no longer present. |
| NT_status_reinitialization_needed | Error | 3221226119 - 0xC0000287 | The device requires re-initialization due to hardware errors. |
| NT_status_encryption_failed | Error | 3221226122 - 0xC000028A | The file encryption attempt failed. |
| NT_status_decryption_failed | Error | 3221226123 - 0xC000028B | The file decryption attempt failed. |
| NT_status_range_not_found | Error | 3221226124 - 0xC000028C | The specified range could not be found in the range list. |
| NT_status_no_recovery_policy | Error | 3221226125 - 0xC000028D | There is no encryption recovery policy configured for this system. |
| NT_status_no_efs | Error | 3221226126 - 0xC000028E | The required encryption driver is not loaded for this system. |
| NT_status_wrong_efs | Error | 3221226127 - 0xC000028F | The file was encrypted with a different encryption driver than is currently loaded. |
| NT_status_no_user_keys | Error | 3221226128 - 0xC0000290 | There are no EFS keys defined for the user. |
| NT_status_file_not_encrypted | Error | 3221226129 - 0xC0000291 | The specified file is not encrypted. |
| NT_status_not_export_format | Error | 3221226130 - 0xC0000292 | The specified file is not in the defined EFS export format. |
| NT_status_file_encrypted | Error | 3221226131 - 0xC0000293 | The specified file is encrypted and the user does not have the ability to decrypt it. |
| NT_status_wmi_guid_not_found | Error | 3221226133 - 0xC0000295 | The GUID passed was not recognized as valid by a WMI data provider. |
| NT_status_wmi_instance_not_found | Error | 3221226134 - 0xC0000296 | The instance name passed was not recognized as valid by a WMI data provider. |
| NT_status_wmi_itemid_not_found | Error | 3221226135 - 0xC0000297 | The data item ID passed was not recognized as valid by a WMI data provider. |
| NT_status_wmi_try_again | Error | 3221226136 - 0xC0000298 | The WMI request could not be completed and should be retried. |
| NT_status_shared_policy | Error | 3221226137 - 0xC0000299 | The policy object is shared and can only be modified at the root. |
| NT_status_policy_object_not_found | Error | 3221226138 - 0xC000029A | The policy object does not exist when it should. |
| NT_status_policy_only_in_ds | Error | 3221226139 - 0xC000029B | The requested policy information only lives in the Ds. |
| NT_status_volume_not_upgraded | Error | 3221226140 - 0xC000029C | The volume must be upgraded to enable this feature. |
| NT_status_remote_storage_not_active | Error | 3221226141 - 0xC000029D | The remote storage service is not operational at this time. |
| NT_status_remote_storage_media_error | Error | 3221226142 - 0xC000029E | The remote storage service encountered a media error. |
| NT_status_no_tracking_service | Error | 3221226143 - 0xC000029F | The tracking (workstation) service is not running. |
| NT_status_server_sid_mismatch | Error | 3221226144 - 0xC00002A0 | The server process is running under a SID that is different from the SID that is required by client. |
| NT_status_ds_no_attribute_or_value | Error | 3221226145 - 0xC00002A1 | The specified directory service attribute or value does not exist. |
| NT_status_ds_invalid_attribute_syntax | Error | 3221226146 - 0xC00002A2 | The attribute syntax specified to the directory service is invalid. |
| NT_status_ds_attribute_type_undefined | Error | 3221226147 - 0xC00002A3 | The attribute type specified to the directory service is not defined. |
| NT_status_ds_attribute_or_value_exists | Error | 3221226148 - 0xC00002A4 | The specified directory service attribute or value already exists. |
| NT_status_ds_busy | Error | 3221226149 - 0xC00002A5 | The directory service is busy. |
| NT_status_ds_unavailable | Error | 3221226150 - 0xC00002A6 | The directory service is unavailable. |
| NT_status_ds_no_rids_allocated | Error | 3221226151 - 0xC00002A7 | The directory service was unable to allocate a relative identifier. |
| NT_status_ds_no_more_rids | Error | 3221226152 - 0xC00002A8 | The directory service has exhausted the pool of relative identifiers. |
| NT_status_ds_incorrect_role_owner | Error | 3221226153 - 0xC00002A9 | The requested operation could not be performed because the directory service is not the master for that type of operation. |
| NT_status_ds_ridmgr_init_error | Error | 3221226154 - 0xC00002AA | The directory service was unable to initialize the subsystem that allocates relative identifiers. |
| NT_status_ds_obj_class_violation | Error | 3221226155 - 0xC00002AB | The requested operation did not satisfy one or more constraints that are associated with the class of the object. |
| NT_status_ds_cant_on_non_leaf | Error | 3221226156 - 0xC00002AC | The directory service can perform the requested operation only on a leaf object. |
| NT_status_ds_cant_on_rdn | Error | 3221226157 - 0xC00002AD | The directory service cannot perform the requested operation on the Relatively Defined Name (RDN) attribute of an object. |
| NT_status_ds_cant_mod_obj_class | Error | 3221226158 - 0xC00002AE | The directory service detected an attempt to modify the object class of an object. |
| NT_status_ds_cross_dom_move_failed | Error | 3221226159 - 0xC00002AF | An error occurred while performing a cross domain move operation. |
| NT_status_ds_gc_not_available | Error | 3221226160 - 0xC00002B0 | Unable to contact the global catalog server. |
| NT_status_directory_service_required | Error | 3221226161 - 0xC00002B1 | The requested operation requires a directory service, and none was available. |
| NT_status_reparse_attribute_conflict | Error | 3221226162 - 0xC00002B2 | The reparse attribute cannot be set because it is incompatible with an existing attribute. |
| NT_status_cant_enable_deny_only | Error | 3221226163 - 0xC00002B3 | A group marked 'use for deny only' cannot be enabled. |
| NT_status_float_multiple_faults | Error | 3221226164 - 0xC00002B4 | {EXCEPTION} Multiple floating-point faults. |
| NT_status_float_multiple_traps | Error | 3221226165 - 0xC00002B5 | {EXCEPTION} Multiple floating-point traps. |
| NT_status_device_removed | Error | 3221226166 - 0xC00002B6 | The device has been removed. |
| NT_status_journal_delete_in_progress | Error | 3221226167 - 0xC00002B7 | The volume change journal is being deleted. |
| NT_status_journal_not_active | Error | 3221226168 - 0xC00002B8 | The volume change journal is not active. |
| NT_status_nointerface | Error | 3221226169 - 0xC00002B9 | The requested interface is not supported. |
| NT_status_ds_admin_limit_exceeded | Error | 3221226177 - 0xC00002C1 | A directory service resource limit has been exceeded. |
| NT_status_driver_failed_sleep | Error | 3221226178 - 0xC00002C2 | {System Standby Failed} The driver does not support standby mode. Updating this driver may allow the system to go to standby mode. |
| NT_status_mutual_authentication_failed | Error | 3221226179 - 0xC00002C3 | Mutual Authentication failed. The server password is out of date at the domain controller. |
| NT_status_corrupt_system_file | Error | 3221226180 - 0xC00002C4 | The system file has become corrupt and has been replaced. |
| NT_status_datatype_misalignment_error | Error | 3221226181 - 0xC00002C5 | {EXCEPTION} Alignment Error A data type misalignment error was detected in a load or store instruction. |
| NT_status_wmi_read_only | Error | 3221226182 - 0xC00002C6 | The WMI data item or data block is read-only. |
| NT_status_wmi_set_failure | Error | 3221226183 - 0xC00002C7 | The WMI data item or data block could not be changed. |
| NT_status_commitment_minimum | Error | 3221226184 - 0xC00002C8 | {Virtual Memory Minimum Too Low} Your system is low on virtual memory. Windows is increasing the size of your virtual memory paging file. During this process, memory requests for some applications may be denied. For more information, see Help. |
| NT_status_reg_nat_consumption | Error | 3221226185 - 0xC00002C9 | {EXCEPTION} Register NaT consumption faults. A NaT value is consumed on a non-speculative instruction. |
| NT_status_transport_full | Error | 3221226186 - 0xC00002CA | The transport element of the medium changer contains media, which is causing the operation to fail. |
| NT_status_ds_sam_init_failure | Error | 3221226187 - 0xC00002CB | Security Accounts Manager initialization failed. Click OK to shut down this system and restart in Directory Services Restore Mode. Check the event log for more detailed information. |
| NT_status_only_if_connected | Error | 3221226188 - 0xC00002CC | This operation is supported only when you are connected to the server. |
| NT_status_ds_sensitive_group_violation | Error | 3221226189 - 0xC00002CD | Only an administrator can modify the membership list of an administrative group. |
| NT_status_pnp_restart_enumeration | Error | 3221226190 - 0xC00002CE | A device was removed so enumeration must be restarted. |
| NT_status_journal_entry_deleted | Error | 3221226191 - 0xC00002CF | The journal entry has been deleted from the journal. |
| NT_status_ds_cant_mod_primarygroupid | Error | 3221226192 - 0xC00002D0 | Cannot change the primary group ID of a domain controller account. |
| NT_status_system_image_bad_signature | Error | 3221226193 - 0xC00002D1 | {Fatal System Error} The system image is not properly signed. The file has been replaced with the signed file. The system has been shut down. |
| NT_status_pnp_reboot_required | Error | 3221226194 - 0xC00002D2 | The device will not start without a reboot. |
| NT_status_power_state_invalid | Error | 3221226195 - 0xC00002D3 | The power state of the current device cannot support this request. |
| NT_status_ds_invalid_group_type | Error | 3221226196 - 0xC00002D4 | The specified group type is invalid. |
| NT_status_ds_no_nest_globalgroup_in_mixeddomain | Error | 3221226197 - 0xC00002D5 | In a mixed domain, no nesting of a global group if the group is security enabled. |
| NT_status_ds_no_nest_localgroup_in_mixeddomain | Error | 3221226198 - 0xC00002D6 | In a mixed domain, cannot nest local groups with other local groups, if the group is security enabled. |
| NT_status_ds_global_cant_have_local_member | Error | 3221226199 - 0xC00002D7 | A global group cannot have a local group as a member. |
| NT_status_ds_global_cant_have_universal_member | Error | 3221226200 - 0xC00002D8 | A global group cannot have a universal group as a member. |
| NT_status_ds_universal_cant_have_local_member | Error | 3221226201 - 0xC00002D9 | A universal group cannot have a local group as a member. |
| NT_status_ds_global_cant_have_crossdomain_member | Error | 3221226202 - 0xC00002DA | A global group cannot have a cross-domain member. |
| NT_status_ds_local_cant_have_crossdomain_local_member | Error | 3221226203 - 0xC00002DB | A local group cannot have another cross-domain local group as a member. |
| NT_status_ds_have_primary_members | Error | 3221226204 - 0xC00002DC | Cannot change to a security-disabled group because primary members are in this group. |
| NT_status_wmi_not_supported | Error | 3221226205 - 0xC00002DD | The WMI operation is not supported by the data block or method. |
| NT_status_insufficient_power | Error | 3221226206 - 0xC00002DE | There is not enough power to complete the requested operation. |
| NT_status_sam_need_bootkey_password | Error | 3221226207 - 0xC00002DF | The Security Accounts Manager needs to get the boot password. |
| NT_status_sam_need_bootkey_floppy | Error | 3221226208 - 0xC00002E0 | The Security Accounts Manager needs to get the boot key from the floppy disk. |
| NT_status_ds_cant_start | Error | 3221226209 - 0xC00002E1 | The directory service cannot start. |
| NT_status_ds_init_failure | Error | 3221226210 - 0xC00002E2 | The directory service could not start. Click OK to shut down this system and restart in Directory Services Restore Mode. Check the event log for more detailed information. |
| NT_status_sam_init_failure | Error | 3221226211 - 0xC00002E3 | The Security Accounts Manager initialization failed. Click OK to shut down this system and restart in Safe Mode. Check the event log for more detailed information. |
| NT_status_ds_gc_required | Error | 3221226212 - 0xC00002E4 | The requested operation can be performed only on a global catalog server. |
| NT_status_ds_local_member_of_local_only | Error | 3221226213 - 0xC00002E5 | A local group can only be a member of other local groups in the same domain. |
| NT_status_ds_no_fpo_in_universal_groups | Error | 3221226214 - 0xC00002E6 | Foreign security principals cannot be members of universal groups. |
| NT_status_ds_machine_account_quota_exceeded | Error | 3221226215 - 0xC00002E7 | Your computer could not be joined to the domain. You have exceeded the maximum number of computer accounts you are allowed to create in this domain. Contact your system administrator to have this limit reset or increased. |
| NT_status_multiple_fault_violation | Error | 3221226216 - 0xC00002E8 | |
| NT_status_current_domain_not_allowed | Error | 3221226217 - 0xC00002E9 | This operation cannot be performed on the current domain. |
| NT_status_cannot_make | Error | 3221226218 - 0xC00002EA | The directory or file cannot be created. |
| NT_status_system_shutdown | Error | 3221226219 - 0xC00002EB | The system is in the process of shutting down. |
| NT_status_ds_init_failure_console | Error | 3221226220 - 0xC00002EC | Directory Services could not start. Click OK to shut down the system. You can use the recovery console to diagnose the system further. |
| NT_status_ds_sam_init_failure_console | Error | 3221226221 - 0xC00002ED | Security Accounts Manager initialization failed. Click OK to shut down the system. You can use the recovery console to diagnose the system further. |
| NT_status_unfinished_context_deleted | Error | 3221226222 - 0xC00002EE | A security context was deleted before the context was completed. This is considered a logon failure. |
| NT_status_no_tgt_reply | Error | 3221226223 - 0xC00002EF | The client is trying to negotiate a context and the server requires user-to-user but did not send a TGT reply. |
| NT_status_objectid_not_found | Error | 3221226224 - 0xC00002F0 | An object ID was not found in the file. |
| NT_status_no_ip_addresses | Error | 3221226225 - 0xC00002F1 | Unable to accomplish the requested task because the local machine does not have any IP addresses. |
| NT_status_wrong_credential_handle | Error | 3221226226 - 0xC00002F2 | The supplied credential handle does not match the credential that is associated with the security context. |
| NT_status_crypto_system_invalid | Error | 3221226227 - 0xC00002F3 | The crypto system or checksum function is invalid because a required function is unavailable. |
| NT_status_max_referrals_exceeded | Error | 3221226228 - 0xC00002F4 | The number of maximum ticket referrals has been exceeded. |
| NT_status_must_be_kdc | Error | 3221226229 - 0xC00002F5 | The local machine must be a Kerberos KDC (domain controller) and it is not. |
| NT_status_strong_crypto_not_supported | Error | 3221226230 - 0xC00002F6 | The other end of the security negotiation requires strong crypto but it is not supported on the local machine. |
| NT_status_too_many_principals | Error | 3221226231 - 0xC00002F7 | The KDC reply contained more than one principal name. |
| NT_status_no_pa_data | Error | 3221226232 - 0xC00002F8 | Expected to find PA data for a hint of what etype to use, but it was not found. |
| NT_status_pkinit_name_mismatch | Error | 3221226233 - 0xC00002F9 | The client certificate does not contain a valid UPN, or does not match the client name in the logon request. Contact your administrator. |
| NT_status_smartcard_logon_required | Error | 3221226234 - 0xC00002FA | Smart card logon is required and was not used. |
| NT_status_kdc_invalid_request | Error | 3221226235 - 0xC00002FB | An invalid request was sent to the KDC. |
| NT_status_kdc_unable_to_refer | Error | 3221226236 - 0xC00002FC | The KDC was unable to generate a referral for the service requested. |
| NT_status_kdc_unknown_etype | Error | 3221226237 - 0xC00002FD | The encryption type requested is not supported by the KDC. |
| NT_status_shutdown_in_progress | Error | 3221226238 - 0xC00002FE | A system shutdown is in progress. |
| NT_status_server_shutdown_in_progress | Error | 3221226239 - 0xC00002FF | The server machine is shutting down. |
| NT_status_not_supported_on_sbs | Error | 3221226240 - 0xC0000300 | This operation is not supported on a computer running Windows Server 2003 for Small Business Server. |
| NT_status_wmi_guid_disconnected | Error | 3221226241 - 0xC0000301 | The WMI GUID is no longer available. |
| NT_status_wmi_already_disabled | Error | 3221226242 - 0xC0000302 | Collection or events for the WMI GUID is already disabled. |
| NT_status_wmi_already_enabled | Error | 3221226243 - 0xC0000303 | Collection or events for the WMI GUID is already enabled. |
| NT_status_mft_too_fragmented | Error | 3221226244 - 0xC0000304 | The master file table on the volume is too fragmented to complete this operation. |
| NT_status_copy_protection_failure | Error | 3221226245 - 0xC0000305 | Copy protection failure. |
| NT_status_css_authentication_failure | Error | 3221226246 - 0xC0000306 | Copy protection error—DVD CSS Authentication failed. |
| NT_status_css_key_not_present | Error | 3221226247 - 0xC0000307 | Copy protection error—The specified sector does not contain a valid key. |
| NT_status_css_key_not_established | Error | 3221226248 - 0xC0000308 | Copy protection error—DVD session key not established. |
| NT_status_css_scrambled_sector | Error | 3221226249 - 0xC0000309 | Copy protection error—The read failed because the sector is encrypted. |
| NT_status_css_region_mismatch | Error | 3221226250 - 0xC000030A | Copy protection error—The region of the specified DVD does not correspond to the region setting of the drive. |
| NT_status_css_resets_exhausted | Error | 3221226251 - 0xC000030B | Copy protection error—The region setting of the drive may be permanent. |
| NT_status_pkinit_failure | Error | 3221226272 - 0xC0000320 | The Kerberos protocol encountered an error while validating the KDC certificate during smart card logon. There is more information in the system event log. |
| NT_status_smartcard_subsystem_failure | Error | 3221226273 - 0xC0000321 | The Kerberos protocol encountered an error while attempting to use the smart card subsystem. |
| NT_status_no_kerb_key | Error | 3221226274 - 0xC0000322 | The target server does not have acceptable Kerberos credentials. |
| NT_status_host_down | Error | 3221226320 - 0xC0000350 | The transport determined that the remote system is down. |
| NT_status_unsupported_preauth | Error | 3221226321 - 0xC0000351 | An unsupported pre-authentication mechanism was presented to the Kerberos package. |
| NT_status_efs_alg_blob_too_big | Error | 3221226322 - 0xC0000352 | The encryption algorithm that is used on the source file needs a bigger key buffer than the one that is used on the destination file. |
| NT_status_port_not_set | Error | 3221226323 - 0xC0000353 | An attempt to remove a processes DebugPort was made, but a port was not already associated with the process. |
| NT_status_debugger_inactive | Error | 3221226324 - 0xC0000354 | An attempt to do an operation on a debug port failed because the port is in the process of being deleted. |
| NT_status_ds_version_check_failure | Error | 3221226325 - 0xC0000355 | This version of Windows is not compatible with the behavior version of the directory forest, domain, or domain controller. |
| NT_status_auditing_disabled | Error | 3221226326 - 0xC0000356 | The specified event is currently not being audited. |
| NT_status_prent4_machine_account | Error | 3221226327 - 0xC0000357 | The machine account was created prior to Windows NT 4.0. The account needs to be recreated. |
| NT_status_ds_ag_cant_have_universal_member | Error | 3221226328 - 0xC0000358 | An account group cannot have a universal group as a member. |
| NT_status_invalid_image_win_32 | Error | 3221226329 - 0xC0000359 | The specified image file did not have the correct format; it appears to be a 32-bit Windows image. |
| NT_status_invalid_image_win_64 | Error | 3221226330 - 0xC000035A | The specified image file did not have the correct format; it appears to be a 64-bit Windows image. |
| NT_status_bad_bindings | Error | 3221226331 - 0xC000035B | The client's supplied SSPI channel bindings were incorrect. |
| NT_status_network_session_expired | Error | 3221226332 - 0xC000035C | The client session has expired; so the client must re-authenticate to continue accessing the remote resources. |
| NT_status_apphelp_block | Error | 3221226333 - 0xC000035D | The AppHelp dialog box canceled; thus preventing the application from starting. |
| NT_status_all_sids_filtered | Error | 3221226334 - 0xC000035E | The SID filtering operation removed all SIDs. |
| NT_status_not_safe_mode_driver | Error | 3221226335 - 0xC000035F | The driver was not loaded because the system is starting in safe mode. |
| NT_status_access_disabled_by_policy_default | Error | 3221226337 - 0xC0000361 | Access has been restricted by your Administrator by the default software restriction policy level. |
| NT_status_access_disabled_by_policy_path | Error | 3221226338 - 0xC0000362 | Access has been restricted by your Administrator by location with policy rule. |
| NT_status_access_disabled_by_policy_publisher | Error | 3221226339 - 0xC0000363 | Access has been restricted by your Administrator by software publisher policy. |
| NT_status_access_disabled_by_policy_other | Error | 3221226340 - 0xC0000364 | Access to has been restricted by your Administrator by policy rule. |
| NT_status_failed_driver_entry | Error | 3221226341 - 0xC0000365 | The driver was not loaded because it failed its initialization call. |
| NT_status_device_enumeration_error | Error | 3221226342 - 0xC0000366 | The device encountered an error while applying power or reading the device configuration. This may be caused by a failure of your hardware or by a poor connection. |
| NT_status_mount_point_not_resolved | Error | 3221226344 - 0xC0000368 | The create operation failed because the name contained at least one mount point that resolves to a volume to which the specified device object is not attached. |
| NT_status_invalid_device_object_parameter | Error | 3221226345 - 0xC0000369 | The device object parameter is either not a valid device object or is not attached to the volume that is specified by the file name. |
| NT_status_mca_occured | Error | 3221226346 - 0xC000036A | A machine check error has occurred. Check the system event log for additional information. |
| NT_status_driver_blocked_critical | Error | 3221226347 - 0xC000036B | Driver has been blocked from loading. |
| NT_status_driver_blocked | Error | 3221226348 - 0xC000036C | Driver has been blocked from loading. |
| NT_status_driver_database_error | Error | 3221226349 - 0xC000036D | There was error processing the driver database. |
| NT_status_system_hive_too_large | Error | 3221226350 - 0xC000036E | System hive size has exceeded its limit. |
| NT_status_invalid_import_of_non_dll | Error | 3221226351 - 0xC000036F | A dynamic link library (DLL) referenced a module that was neither a DLL nor the process's executable image. |
| NT_status_smartcard_wrong_pin | Error | 3221226368 - 0xC0000380 | An incorrect PIN was presented to the smart card. |
| NT_status_smartcard_card_blocked | Error | 3221226369 - 0xC0000381 | The smart card is blocked. |
| NT_status_smartcard_card_not_authenticated | Error | 3221226370 - 0xC0000382 | No PIN was presented to the smart card. |
| NT_status_smartcard_no_card | Error | 3221226371 - 0xC0000383 | No smart card is available. |
| NT_status_smartcard_no_key_container | Error | 3221226372 - 0xC0000384 | The requested key container does not exist on the smart card. |
| NT_status_smartcard_no_certificate | Error | 3221226373 - 0xC0000385 | The requested certificate does not exist on the smart card. |
| NT_status_smartcard_no_keyset | Error | 3221226374 - 0xC0000386 | The requested keyset does not exist. |
| NT_status_smartcard_io_error | Error | 3221226375 - 0xC0000387 | A communication error with the smart card has been detected. |
| NT_status_downgrade_detected | Error | 3221226376 - 0xC0000388 | The system detected a possible attempt to compromise security. Ensure that you can contact the server that authenticated you. |
| NT_status_smartcard_cert_revoked | Error | 3221226377 - 0xC0000389 | The smart card certificate used for authentication has been revoked. Contact your system administrator. There may be additional information in the event log. |
| NT_status_issuing_ca_untrusted | Error | 3221226378 - 0xC000038A | An untrusted certificate authority was detected while processing the smart card certificate that is used for authentication. Contact your system administrator. |
| NT_status_revocation_offline_c | Error | 3221226379 - 0xC000038B | The revocation status of the smart card certificate that is used for authentication could not be determined. Contact your system administrator. |
| NT_status_pkinit_client_failure | Error | 3221226380 - 0xC000038C | The smart card certificate used for authentication was not trusted. Contact your system administrator. |
| NT_status_smartcard_cert_expired | Error | 3221226381 - 0xC000038D | The smart card certificate used for authentication has expired. Contact your system administrator. |
| NT_status_driver_failed_prior_unload | Error | 3221226382 - 0xC000038E | The driver could not be loaded because a previous version of the driver is still in memory. |
| NT_status_wow_assertion | Error | 3221264536 - 0xC0009898 | WOW Assertion Error. |
| RPC_NT_invalid_string_binding | Error | 3221356545 - 0xC0020001 | The string binding is invalid. |
| RPC_NT_wrong_kind_of_binding | Error | 3221356546 - 0xC0020002 | The binding handle is not the correct type. |
| RPC_NT_invalid_binding | Error | 3221356547 - 0xC0020003 | The binding handle is invalid. |
| RPC_NT_protseq_not_supported | Error | 3221356548 - 0xC0020004 | The RPC protocol sequence is not supported. |
| RPC_NT_invalid_rpc_protseq | Error | 3221356549 - 0xC0020005 | The RPC protocol sequence is invalid. |
| RPC_NT_invalid_string_uuid | Error | 3221356550 - 0xC0020006 | The string UUID is invalid. |
| RPC_NT_invalid_endpoint_format | Error | 3221356551 - 0xC0020007 | The endpoint format is invalid. |
| RPC_NT_invalid_net_addr | Error | 3221356552 - 0xC0020008 | The network address is invalid. |
| RPC_NT_no_endpoint_found | Error | 3221356553 - 0xC0020009 | No endpoint was found. |
| RPC_NT_invalid_timeout | Error | 3221356554 - 0xC002000A | The time-out value is invalid. |
| RPC_NT_object_not_found | Error | 3221356555 - 0xC002000B | The object UUID was not found. |
| RPC_NT_already_registered | Error | 3221356556 - 0xC002000C | The object UUID has already been registered. |
| RPC_NT_type_already_registered | Error | 3221356557 - 0xC002000D | The type UUID has already been registered. |
| RPC_NT_already_listening | Error | 3221356558 - 0xC002000E | The RPC server is already listening. |
| RPC_NT_no_protseqs_registered | Error | 3221356559 - 0xC002000F | No protocol sequences have been registered. |
| RPC_NT_not_listening | Error | 3221356560 - 0xC0020010 | The RPC server is not listening. |
| RPC_NT_unknown_mgr_type | Error | 3221356561 - 0xC0020011 | The manager type is unknown. |
| RPC_NT_unknown_if | Error | 3221356562 - 0xC0020012 | The interface is unknown. |
| RPC_NT_no_bindings | Error | 3221356563 - 0xC0020013 | There are no bindings. |
| RPC_NT_no_protseqs | Error | 3221356564 - 0xC0020014 | There are no protocol sequences. |
| RPC_NT_cant_create_endpoint | Error | 3221356565 - 0xC0020015 | The endpoint cannot be created. |
| RPC_NT_out_of_resources | Error | 3221356566 - 0xC0020016 | Insufficient resources are available to complete this operation. |
| RPC_NT_server_unavailable | Error | 3221356567 - 0xC0020017 | The RPC server is unavailable. |
| RPC_NT_server_too_busy | Error | 3221356568 - 0xC0020018 | The RPC server is too busy to complete this operation. |
| RPC_NT_invalid_network_options | Error | 3221356569 - 0xC0020019 | The network options are invalid. |
| RPC_NT_no_call_active | Error | 3221356570 - 0xC002001A | No RPCs are active on this thread. |
| RPC_NT_call_failed | Error | 3221356571 - 0xC002001B | The RPC failed. |
| RPC_NT_call_failed_dne | Error | 3221356572 - 0xC002001C | The RPC failed and did not execute. |
| RPC_NT_protocol_error | Error | 3221356573 - 0xC002001D | An RPC protocol error occurred. |
| RPC_NT_unsupported_trans_syn | Error | 3221356575 - 0xC002001F | The RPC server does not support the transfer syntax. |
| RPC_NT_unsupported_type | Error | 3221356577 - 0xC0020021 | The type UUID is not supported. |
| RPC_NT_invalid_tag | Error | 3221356578 - 0xC0020022 | The tag is invalid. |
| RPC_NT_invalid_bound | Error | 3221356579 - 0xC0020023 | The array bounds are invalid. |
| RPC_NT_no_entry_name | Error | 3221356580 - 0xC0020024 | The binding does not contain an entry name. |
| RPC_NT_invalid_name_syntax | Error | 3221356581 - 0xC0020025 | The name syntax is invalid. |
| RPC_NT_unsupported_name_syntax | Error | 3221356582 - 0xC0020026 | The name syntax is not supported. |
| RPC_NT_uuid_no_address | Error | 3221356584 - 0xC0020028 | No network address is available to construct a UUID. |
| RPC_NT_duplicate_endpoint | Error | 3221356585 - 0xC0020029 | The endpoint is a duplicate. |
| RPC_NT_unknown_authn_type | Error | 3221356586 - 0xC002002A | The authentication type is unknown. |
| RPC_NT_max_calls_too_small | Error | 3221356587 - 0xC002002B | The maximum number of calls is too small. |
| RPC_NT_string_too_long | Error | 3221356588 - 0xC002002C | The string is too long. |
| RPC_NT_protseq_not_found | Error | 3221356589 - 0xC002002D | The RPC protocol sequence was not found. |
| RPC_NT_procnum_out_of_range | Error | 3221356590 - 0xC002002E | The procedure number is out of range. |
| RPC_NT_binding_has_no_auth | Error | 3221356591 - 0xC002002F | The binding does not contain any authentication information. |
| RPC_NT_unknown_authn_service | Error | 3221356592 - 0xC0020030 | The authentication service is unknown. |
| RPC_NT_unknown_authn_level | Error | 3221356593 - 0xC0020031 | The authentication level is unknown. |
| RPC_NT_invalid_auth_identity | Error | 3221356594 - 0xC0020032 | The security context is invalid. |
| RPC_NT_unknown_authz_service | Error | 3221356595 - 0xC0020033 | The authorization service is unknown. |
| EPT_NT_invalid_entry | Error | 3221356596 - 0xC0020034 | The entry is invalid. |
| EPT_NT_cant_perform_op | Error | 3221356597 - 0xC0020035 | The operation cannot be performed. |
| EPT_NT_not_registered | Error | 3221356598 - 0xC0020036 | No more endpoints are available from the endpoint mapper. |
| RPC_NT_nothing_to_export | Error | 3221356599 - 0xC0020037 | No interfaces have been exported. |
| RPC_NT_incomplete_name | Error | 3221356600 - 0xC0020038 | The entry name is incomplete. |
| RPC_NT_invalid_vers_option | Error | 3221356601 - 0xC0020039 | The version option is invalid. |
| RPC_NT_no_more_members | Error | 3221356602 - 0xC002003A | There are no more members. |
| RPC_NT_not_all_objs_unexported | Error | 3221356603 - 0xC002003B | There is nothing to unexport. |
| RPC_NT_interface_not_found | Error | 3221356604 - 0xC002003C | The interface was not found. |
| RPC_NT_entry_already_exists | Error | 3221356605 - 0xC002003D | The entry already exists. |
| RPC_NT_entry_not_found | Error | 3221356606 - 0xC002003E | The entry was not found. |
| RPC_NT_name_service_unavailable | Error | 3221356607 - 0xC002003F | The name service is unavailable. |
| RPC_NT_invalid_naf_id | Error | 3221356608 - 0xC0020040 | The network address family is invalid. |
| RPC_NT_cannot_support | Error | 3221356609 - 0xC0020041 | The requested operation is not supported. |
| RPC_NT_no_context_available | Error | 3221356610 - 0xC0020042 | No security context is available to allow impersonation. |
| RPC_NT_internal_error | Error | 3221356611 - 0xC0020043 | An internal error occurred in the RPC. |
| RPC_NT_zero_divide | Error | 3221356612 - 0xC0020044 | The RPC server attempted to divide an integer by zero. |
| RPC_NT_address_error | Error | 3221356613 - 0xC0020045 | An addressing error occurred in the RPC server. |
| RPC_NT_fp_div_zero | Error | 3221356614 - 0xC0020046 | A floating point operation at the RPC server caused a divide by zero. |
| RPC_NT_fp_underflow | Error | 3221356615 - 0xC0020047 | A floating point underflow occurred at the RPC server. |
| RPC_NT_fp_overflow | Error | 3221356616 - 0xC0020048 | A floating point overflow occurred at the RPC server. |
| RPC_NT_call_in_progress | Error | 3221356617 - 0xC0020049 | An RPC is already in progress for this thread. |
| RPC_NT_no_more_bindings | Error | 3221356618 - 0xC002004A | There are no more bindings. |
| RPC_NT_group_member_not_found | Error | 3221356619 - 0xC002004B | The group member was not found. |
| EPT_NT_cant_create | Error | 3221356620 - 0xC002004C | The endpoint mapper database entry could not be created. |
| RPC_NT_invalid_object | Error | 3221356621 - 0xC002004D | The object UUID is the nil UUID. |
| RPC_NT_no_interfaces | Error | 3221356623 - 0xC002004F | No interfaces have been registered. |
| RPC_NT_call_cancelled | Error | 3221356624 - 0xC0020050 | The RPC was canceled. |
| RPC_NT_binding_incomplete | Error | 3221356625 - 0xC0020051 | The binding handle does not contain all the required information. |
| RPC_NT_comm_failure | Error | 3221356626 - 0xC0020052 | A communications failure occurred during an RPC. |
| RPC_NT_unsupported_authn_level | Error | 3221356627 - 0xC0020053 | The requested authentication level is not supported. |
| RPC_NT_no_princ_name | Error | 3221356628 - 0xC0020054 | No principal name was registered. |
| RPC_NT_not_rpc_error | Error | 3221356629 - 0xC0020055 | The error specified is not a valid Windows RPC error code. |
| RPC_NT_sec_pkg_error | Error | 3221356631 - 0xC0020057 | A security package-specific error occurred. |
| RPC_NT_not_cancelled | Error | 3221356632 - 0xC0020058 | The thread was not canceled. |
| RPC_NT_invalid_async_handle | Error | 3221356642 - 0xC0020062 | Invalid asynchronous RPC handle. |
| RPC_NT_invalid_async_call | Error | 3221356643 - 0xC0020063 | Invalid asynchronous RPC call handle for this operation. |
| RPC_NT_proxy_access_denied | Error | 3221356644 - 0xC0020064 | Access to the HTTP proxy is denied. |
| RPC_NT_no_more_entries | Error | 3221422081 - 0xC0030001 | The list of RPC servers available for auto-handle binding has been exhausted. |
| RPC_NT_ss_char_trans_open_fail | Error | 3221422082 - 0xC0030002 | The file designated by DCERPCCHARTRANS cannot be opened. |
| RPC_NT_ss_char_trans_short_file | Error | 3221422083 - 0xC0030003 | The file containing the character translation table has fewer than 512 bytes. |
| RPC_NT_ss_in_null_context | Error | 3221422084 - 0xC0030004 | A null context handle is passed as an [in] parameter. |
| RPC_NT_ss_context_mismatch | Error | 3221422085 - 0xC0030005 | The context handle does not match any known context handles. |
| RPC_NT_ss_context_damaged | Error | 3221422086 - 0xC0030006 | The context handle changed during a call. |
| RPC_NT_ss_handles_mismatch | Error | 3221422087 - 0xC0030007 | The binding handles passed to an RPC do not match. |
| RPC_NT_ss_cannot_get_call_handle | Error | 3221422088 - 0xC0030008 | The stub is unable to get the call handle. |
| RPC_NT_null_ref_pointer | Error | 3221422089 - 0xC0030009 | A null reference pointer was passed to the stub. |
| RPC_NT_enum_value_out_of_range | Error | 3221422090 - 0xC003000A | The enumeration value is out of range. |
| RPC_NT_byte_count_too_small | Error | 3221422091 - 0xC003000B | The byte count is too small. |
| RPC_NT_bad_stub_data | Error | 3221422092 - 0xC003000C | The stub received bad data. |
| RPC_NT_invalid_es_action | Error | 3221422169 - 0xC0030059 | Invalid operation on the encoding/decoding handle. |
| RPC_NT_wrong_es_version | Error | 3221422170 - 0xC003005A | Incompatible version of the serializing package. |
| RPC_NT_wrong_stub_version | Error | 3221422171 - 0xC003005B | Incompatible version of the RPC stub. |
| RPC_NT_invalid_pipe_object | Error | 3221422172 - 0xC003005C | The RPC pipe object is invalid or corrupt. |
| RPC_NT_invalid_pipe_operation | Error | 3221422173 - 0xC003005D | An invalid operation was attempted on an RPC pipe object. |
| RPC_NT_wrong_pipe_version | Error | 3221422174 - 0xC003005E | Unsupported RPC pipe version. |
| RPC_NT_pipe_closed | Error | 3221422175 - 0xC003005F | The RPC pipe object has already been closed. |
| RPC_NT_pipe_discipline_error | Error | 3221422176 - 0xC0030060 | The RPC call completed before all pipes were processed. |
| RPC_NT_pipe_empty | Error | 3221422177 - 0xC0030061 | No more data is available from the RPC pipe. |
### smbsubcommand This field does not allow any custom items.
| Name | Value | Description |
|---|---|---|
| SMB_TRANS_set_nmpipe_state | 1:37:1 | The TRANS_SET_NMPIPE_STATE subcommand allows a client to set the read mode and the non-blocking mode of a specified named pipe. |
| SMB_TRANS_raw_read_nmpipe | 1:37:17 | The TRANS_RAW_READ_NMPIPE subcommand allows for a raw read of data from a name pipe. |
| SMB_TRANS_query_nmpipe_state | 1:37:33 | The TRANS_QUERY_NMPIPE_STATE subcommand allows a client to retrieve information about a specified named pipe. |
| SMB_TRANS_query_nmpipe_info | 1:37:34 | The TRANS_QUERY_NMPIPE_INFO subcommand allows for a client to retrieve information about a specified named pipe. |
| SMB_TRANS_peek_nmpipe | 1:37:35 | The TRANS_PEEK_NMPIPE subcommand is used to copy data out of a named pipe without removing it and to retrieve information about data in a named pipe. |
| SMB_TRANS_transact_nmpipe | 1:37:38 | The TRANS_TRANSACT_NMPIPE subcommand is used to execute a transacted exchange against a named pipe. |
| SMB_TRANS_raw_write_nmpipe | 1:37:49 | The TRANS_RAW_WRITE_NMPIPE subcommand allows for a raw write of data to a named pipe. Raw writes to named pipes put bytes directly into a pipe in byte mode, regardless of whether it is a message mode pipe or byte mode pipe. |
| SMB_TRANS_read_nmpipe | 1:37:54 | The TRANS_READ_NMPIPE subcommand allows a client to read data from a named pipe. |
| SMB_TRANS_write_nmpipe | 1:37:55 | The TRANS_WRITE_NMPIPE subcommand allows a client to write data to a named pipe. |
| SMB_TRANS_wait_nmpipe | 1:37:83 | The TRANS_WAIT_NMPIPE subcommand allows a client to be notified when the specified named pipe is available to be connected to. |
| SMB_TRANS_call_nmpipe | 1:37:84 | The TRANS_CALL_NMPIPE subcommand allows a client to open a named pipe, issue a write to the named pipe, issue a read from the named pipe, and close the named pipe. |
| SMB_TRANS2_open2 | 1:50:0 | Open or create a file and set extended attributes on the file. |
| SMB_TRANS2_find_first2 | 1:50:1 | Begin a search for file(s) within a directory or for a directory. |
| SMB_TRANS2_find_next2 | 1:50:2 | Continue a search for file(s) within a directory or for a directory. The search MUST have been initiated using TRANS2_FIND_FIRST2. |
| SMB_TRANS2_query_fs_info | 1:50:3 | Request information about the object store underlying a share on the server. |
| SMB_TRANS2_set_fs_information | 1:50:4 | This subcommand is reserved but not implemented. |
| SMB_TRANS2_query_path_information | 1:50:5 | Get information about a specific file or directory. There are several information levels that can be queried. |
| SMB_TRANS2_set_path_information | 1:50:6 | Set the standard and extended attribute information of a specific file or directory on the server. |
| SMB_TRANS2_query_file_information | 1:50:7 | This transaction is an alternative to TRANS2_QUERY_PATH_INFORMATION. |
| SMB_TRANS2_set_file_information | 1:50:8 | This transaction is an alternative to TRANS2_SET_PATH_INFORMATION. |
| SMB_TRANS2_fsctl | 1:50:9 | This subcommand is reserved but not implemented. |
| SMB_TRANS2_ioctl2 | 1:50:10 | This subcommand is reserved but not implemented. |
| SMB_TRANS2_find_notify_first | 1:50:11 | This command was rendered obsolete. |
| SMB_TRANS2_find_notify_next | 1:50:12 | This command was rendered obsolete. |
| SMB_TRANS2_create_directory | 1:50:13 | This transaction is used to create a new directory and can be used to set extended attribute information. |
| SMB_TRANS2_session_setup | 1:50:14 | This subcommand is reserved but not implemented. |
| SMB_TRANS2_get_dfs_referral | 1:50:16 | Request a referral for a disk object in DFS. |
| SMB_TRANS2_report_dfs_inconsistency | 1:50:17 | This subcommand is reserved but not implemented. |
| SMB_NT_TRANSACT_create | 1:160:1 | This transaction subcommand is used to create or open a file or directory when extended attributes (EAs) or a security descriptor (SD) need to be applied. |
| SMB_NT_TRANSACT_ioctl | 1:160:2 | This transaction subcommand allows IOCTL and FSCTL functions to be transferred transparently from client to server. This command is useful for sending platform-specific or implementation-specific information to the server. |
| SMB_NT_TRANSACT_set_security_desc | 1:160:3 | This transaction subcommand allows a client to set the security descriptors for a file. |
| SMB_NT_TRANSACT_notify_change | 1:160:4 | This command notifies the client when the directory, specified by FID, is modified. It also returns the names of all file system objects that changed, and the ways in which they were modified. The command is a "single shot" and therefore needs to be reissued to watch for more directory changes. |
| SMB_NT_TRANSACT_rename | 1:160:5 | This subcommand was reserved but not implemented. |
| SMB_NT_TRANSACT_query_security_desc | 1:160:6 | This transaction subcommand allows a client to retrieve the security descriptor for a file. |
### socks5_address_type | Name | Value | | — | —-| | IP V4 address | 1 - 0x1 | | DOMAINNAME | 3 - 0x3 | | IP V6 address | 4 - 0x4 |
### socks5_authentication_method | Name | Value | | — | —-| | NO AUTHENTICATION REQUIRED | 0 - 0x0 | | GSSAPI | 1 - 0x1 | | USERNAME/PASSWORD | 2 - 0x2 | | Challenge-Handshake Authentication Protocol | 3 - 0x3 | | Unassigned | 4 - 0x4 | | Challenge-Response Authentication Method | 5 - 0x5 | | Secure Sockets Layer | 6 - 0x6 | | NDS Authentication | 7 - 0x7 | | Multi-Authentication Framework | 8 - 0x8 | | JSON Parameter Block | 9 - 0x9 | | NO ACCEPTABLE METHODS | 255 - 0xFF |
### socks5_command | Name | Value | Description | | — | —-| —-| | CONNECT | 1 - 0x1 | establish a TCP/IP stream connection| | BIND | 2 - 0x2 | establish a TCP/IP port binding| | UDP ASSOCIATE | 3 - 0x3 | associate a UDP port|
### socks5_response_status | Name | Value | | — | —-| | succeeded | 0 - 0x0 | | general SOCKS server failure | 1 - 0x1 | | connection not allowed by ruleset | 2 - 0x2 | | Network unreachable | 3 - 0x3 | | Host unreachable | 4 - 0x4 | | Connection refused | 5 - 0x5 | | TTL expired | 6 - 0x6 | | Command not supported | 7 - 0x7 | | Address type not supported | 8 - 0x8 |
### tls_version | Name | Value | | — | —-| | SSL 3.0 | 48 - 0x30 | | TLS 1.0 | 49 - 0x31 | | TLS 1.1 | 50 - 0x32 | | TLS 1.2 | 51 - 0x33 | | TLS 1.3 | 52 - 0x34 |
### vnc_authentication_result | Name | Value | | — | —-| | Success | 0 - 0x0 | | Failure | 1 - 0x1 | | Too many attempts | 2 - 0x2 |
### vnc_encryption_type This field does not allow any custom items.
| Name | Value |
|---|---|
| Invalid | 0 - 0x0 |
| None | 1 - 0x1 |
| VNC Authentication | 2 - 0x2 |
| RealVNC | 3 - 0x3 |
| Hostname | 4 - 0x4 |
| RA2 | 5 - 0x5 |
| RA2ne | 6 - 0x6 |
| TightVNC | 16 - 0x10 |
| UltraVNC | 17 - 0x11 |
| TLS | 18 - 0x12 |
| VeNCrypt | 19 - 0x13 |
| Gtk VNC (SASL) | 20 - 0x14 |
| MD5 Hash Authentication | 21 - 0x15 |
| XVP | 22 - 0x16 |
| ARD | 30 - 0x1E |
| VNC Tight Auth ULGNAUTH | 119 - 0x77 |
| VNC Tight Auth XTRNAUTH | 130 - 0x82 |
### vnc_version | Name | Value | | — | —-| | 3.3 | 3003 - 0xBBB | | 3.7 | 3007 - 0xBBF | | 3.8 | 3008 - 0xBC0 |