| Previous | Next |
| STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED | STATUS_VID_DUPLICATE_HANDLER |
STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES
Per-address rate-control capacity was exhausted
STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES means that IPsec DoS protection could not create another rate-limit queue for an internal IP because the policy maximum had been reached. It is narrower than STATUS_IPSEC_DOSP_MAX_ENTRIES: the constrained resource is specifically the collection of per-address rate-limit queues.
This should be investigated as an address-distribution and policy-capacity issue. A large number of internal addresses, address churn, or a policy that assigns queues too eagerly can reach the cap even when total packet volume is not extreme. The status is not evidence that an individual protected packet failed cryptographic validation.
What to verify
- Measure how many internal addresses are creating queues and how long queues persist.
- Check address translation, roaming, virtualization, and DHCP churn around the event.
- Compare the per-IP cap with expected tenant or endpoint scale.
- Avoid raising the cap without considering state growth and abuse resistance.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WFP sublayer identifiers
- Microsoft: configuring IPsec with WFP
- RFC 4301: Security Architecture for IP
Looking for a different code? Search another status or error code.