| Previous | Next |
| STATUS_IPSEC_THROTTLE_DROP | STATUS_IPSEC_DOSP_RECEIVED_MULTICAST |
STATUS_IPSEC_DOSP_BLOCK
The packet matched an explicit DoS-protection block rule
STATUS_IPSEC_DOSP_BLOCK is not a generic resource failure. It means that the IPsec denial-of-service protection logic matched an explicit block rule. The packet was rejected because policy said to reject that class of traffic, not because Windows could not parse or decrypt it.
This distinction makes policy provenance essential. Review the effective rule, scope, precedence, peer identity and traffic classification that led to the match. If the packet was expected, correct the rule design or negotiation path; do not turn the event into an allow decision by broadly weakening unrelated IPsec or firewall policy.
What to verify
- Identify the effective DoS-protection rule and its match conditions.
- Record the source, destination, protocol, direction, and whether the packet was negotiation or data traffic.
- Compare the effective policy with the intended deployment on both peers.
- Preserve explicit block events in security telemetry even when a policy correction is planned.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WFP sublayer identifiers
- Microsoft: configuring IPsec with WFP
- RFC 4301: Security Architecture for IP
Looking for a different code? Search another status or error code.