What does NTSTATUS 0xC0220104 (STATUS_FWP_DROP_NOICMP) mean?

STATUS_FWP_DROP_NOICMP

The packet should be silently dropped

This status is a policy outcome: the packet is dropped and no ICMP error should be emitted. It matters for firewalls, IPsec, and filtering callouts because silent drop changes what the remote peer observes.

This result describes a WFP drop for which ICMP feedback is not generated. Correlate the drop with the matching filter and layer rather than treating the absence of ICMP as evidence that no policy decision occurred.

What to inspect

• Record the filter or callout that selected silent drop.
• Do not expect an ICMP unreachable on the wire.
• Use WFP net events or audit logs to identify the responsible policy.

References for STATUS_FWP_DROP_NOICMP

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Windows Filtering Platform
• Microsoft: Audit Filtering Platform Policy Change