| Previous | Next |
| STATUS_IPSEC_DOSP_INVALID_PACKET | STATUS_IPSEC_DOSP_MAX_ENTRIES |
STATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED
The defensive state table has no usable entry for this packet
STATUS_IPSEC_DOSP_STATE_LOOKUP_FAILED means that the IPsec denial-of-service protection path could not find the state it needed to process the packet. This is a state-correlation result; it does not by itself prove that the packet is malformed or that a cryptographic check failed.
Look for timing and lifecycle issues: a state entry may have expired, been removed after a policy change, never have been created because earlier negotiation was blocked, or be unavailable because traffic arrived through a different path. It is particularly useful to correlate this status with preceding DoS, negotiation and SA events for the same peer.
What to verify
- Correlate the event with prior packets and state-creation attempts for the same peer.
- Check policy reload, service restart, rekey, and expiry timing.
- Record direction and interface because state may be scoped by processing path.
- Do not assume a missing DoS state is the same as a missing IPsec SA.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: configuring IPsec with WFP
- Microsoft: WFP sublayer identifiers
- RFC 4301: Security Architecture for IP
Looking for a different code? Search another status or error code.