What does NTSTATUS 0xC0220018 (STATUS_FWP_TOO_MANY_CALLOUTS) mean?

 
Previous Next
STATUS_FWP_BUILTIN_OBJECT STATUS_FWP_NOTIFICATION_DROPPED

STATUS_FWP_TOO_MANY_CALLOUTS

Callout registration exhausted the engine’s capacity

STATUS_FWP_TOO_MANY_CALLOUTS indicates that the engine has reached its concurrent callout limit. A WFP callout is a classification component that enables custom packet processing at an applicable layer; it is not the same as an individual filter that references it.

WFP documents a limit of 100,000 simultaneously registered callouts. Reaching it normally points to leaked registrations, repeated load/reload behavior, or a design that creates a new callout for data that should be represented by filters or provider context. Raising filter counts will not resolve a callout leak.

What to inspect

  • The registration and unregistration paths across driver load, unload, and crash recovery.
  • Whether each policy update registers a new callout instead of reusing a stable callout key.
  • Filters that reference a callout and their required installation order.
  • Callout counts over time, not just the count at the failing operation.

References


Looking for a different code? Search another status or error code.