| Previous | Next |
| STATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED | STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED |
STATUS_IPSEC_DOSP_MAX_ENTRIES
The policy limit on defensive state has been reached
STATUS_IPSEC_DOSP_MAX_ENTRIES means that the IPsec denial-of-service protection component could not create a new state entry because the maximum allowed by policy had already been reached. The distinction from a generic memory shortage is important: this is an intentional quota designed to bound state consumption under load.
Investigate whether the entry pressure is expected, caused by a traffic burst, or indicates abusive or malfunctioning peers. Raising a quota can be appropriate only after measuring the resource and security implications. A higher cap without addressing the source pattern can simply move the failure to another component.
What to verify
- Measure active peer/state counts and their creation and expiry rates.
- Identify whether a small set of sources dominates the state table.
- Review policy quotas together with host memory, CPU, and monitoring capacity.
- Keep evidence of rejected peers for DoS and abuse analysis.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WFP sublayer identifiers
- Microsoft: configuring IPsec with WFP
- RFC 4301: Security Architecture for IP
Looking for a different code? Search another status or error code.