| Previous | Next |
| ERROR_IPSEC_DOSP_STATE_LOOKUP_FAILED | ERROR_IPSEC_DOSP_KEYMOD_NOT_ALLOWED |
ERROR_IPSEC_DOSP_MAX_ENTRIES
The exhausted resource is tracked connection state
ERROR_IPSEC_DOSP_MAX_ENTRIES means the feature reached MaxStateEntries, the configured limit on concurrently tracked connections. Each successful authentication path can create a state entry containing public and internal IPv6 endpoints, counters, and lifetime. Once the table is full, another flow cannot be admitted into the same stateful protection model.
Measure current entries and their ages before increasing the limit. A high count can be legitimate load, an idle timeout that retains stale flows too long, asymmetric traffic that prevents normal reuse, or deliberate state exhaustion. Raising the limit consumes more memory and only postpones failure if arrival rate remains higher than expiration. Tune the maximum together with StateIdleTimeoutSeconds and upstream rate controls.
Capacity analysis
- Compare active state count with
MaxStateEntries. - Inspect entry ages to find stale or unexpectedly long-lived flows.
- Estimate creation and expiration rates during the incident.
- Increase capacity only after checking for abuse and routing asymmetry.
References
- Microsoft: MaxStateEntries and StateIdleTimeoutSeconds
- Microsoft: enumerate tracked state
- Microsoft: MSFT_NetIPsecDoSPSetting limits
Looking for a different code? Search another status or error code.