| Previous | Next |
| STATUS_FWP_INVALID_FLAGS | STATUS_FWP_INVALID_RANGE |
STATUS_FWP_INVALID_NET_MASK
The address test is malformed before WFP can classify traffic
STATUS_FWP_INVALID_NET_MASK is about the address-and-mask representation supplied to WFP, not proof that a remote host is unreachable. A WFP condition may carry an IPv4 or IPv6 address-and-mask value, and BFE validates that representation before it can compare packet fields against the rule.
Log the binary address, mask, field key, and address family rather than only a formatted CIDR string. A policy generator can accidentally combine a value encoded for one family with a condition field from another, or preserve a non-network mask after converting a rule from an external configuration format.
What to inspect
- The condition field GUID and whether the selected layer exposes an IPv4 or IPv6 address field.
- The exact address bytes and mask bytes supplied to the WFP structure.
- The source configuration notation and any conversion between prefix length and mask.
- Whether the same rule also has incompatible match type or condition-value type errors.
References
- Microsoft: WFP error codes
- Microsoft: FWP_CONDITION_VALUE0
- Microsoft: FWP_DATA_TYPE address and mask types
- Microsoft: WFP filtering layers
Looking for a different code? Search another status or error code.