| Previous | Next |
| ERROR_IPSEC_AUTH_FIREWALL_DROP | ERROR_IPSEC_DOSP_BLOCK |
ERROR_IPSEC_THROTTLE_DROP
The data path intentionally shed traffic under protection pressure
This is a denial-of-service throttling decision in the IPsec path. The packet was dropped because protection logic applied a throttle, not because its SPI, integrity value, or replay sequence necessarily failed. That distinction determines what evidence to collect.
A single throttled packet can be expected during defensive pressure; sustained events require identifying the traffic pattern and the protection state that triggered throttling. Compare source distribution, packet rate, SA creation pressure, and IKE DoS-prevention events. Do not simply increase application retry rates, because retries can amplify the packet load being throttled.
What to inspect
- Measure packet and negotiation rate around the drop interval.
- Correlate with IKE DoS-prevention mode and dynamic SA/filter growth.
- Identify whether a small set of sources or selectors is responsible before changing protection policy.
Get-NetIPsecMainModeSA | Measure-Object
Get-NetIPsecQuickModeSA | Measure-ObjectReferences
- Microsoft Open Specifications: IKE DoS protection
- Microsoft: IPsec audit events
- Microsoft: Windows Filtering Platform API sets
Looking for a different code? Search another status or error code.