| Previous | Next |
| STATUS_EOF_ON_GHOSTED_RANGE | STATUS_ND_QUEUE_OVERFLOW |
STATUS_IPSEC_QUEUE_OVERFLOW
A pipeline-capacity status, not an IPsec authenticity verdict
STATUS_IPSEC_QUEUE_OVERFLOW means that Windows reached the capacity of an internal queue used while IPsec-related processing was still pending. The packet was not accepted for later processing simply because the queue had no room; this status does not say that the packet failed ESP authentication, matched the wrong security association, or violated a policy selector.
Treat it as a pressure signal. Correlate the time of the drops with packet rate, IKE/AuthIP negotiation activity, CPU pressure, and any WFP callout or firewall telemetry. The useful question is which stage was backlogged and why; increasing retries at the application layer normally cannot recover the packet that has already been discarded.
What to verify
- Record the peer, direction, protocol, packet rate, and nearby IPsec/WFP events.
- Separate bursts during rekeying or policy changes from sustained queue pressure.
- Check whether a security product or custom callout adds latency at the same filtering stage.
- Do not label this an integrity or encryption failure without a corresponding packet-validation status.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: configuring IPsec with WFP
- Microsoft: WFP operation
- RFC 4301: Security Architecture for IP
Looking for a different code? Search another status or error code.