Export (0) Print
Expand All
This topic has not yet been rated - Rate this topic

Winsock Catalog Change Tracing Details

Note  Layered Service Providers are deprecated. Starting with Windows 8 and Windows Server 2012, use Windows Filtering Platform.

Winsock Catalog Change event tracing for layered Service providers (LSPs) is related to LSP installation, LSP removal, LSP disable, and Winsock catalog reset operations. All of the following events are written to the Microsoft-Windows-Winsock-WS2HELP/Operational channel which is different from the other Winsock network event tracing logged on Windows Vista and later.

The following details each of the Winsock LSP events that can be traced and describes which parameters and information are logged.

LSP Install

Event ID = 1

Level = 4 (Information)

The following Winsock LSP events are traced for an LSP install operation:

  • A protocol entry is installed into the Winsock catalog.

The following parameters are logged for a LSP install event:

ParameterDescription

LSP Name

The name of the LSP as obtained from the szProtocol member of the WSAPROTOCOL_INFO structure for the LSP being installed.

Catalog

The Winsock catalog (32-bit or 64-bit) where the LSP is being installed. This is an integer value that is either 32 or 64.

Installer

The module filename of the application making the LSP install call.

GUID

The GUID value of the Winsock transport provider that the LSP is being installed under.

Category

The dwCatalogEntryId member of the WSAPROTOCOL_INFO structure for the LSP being installed.

 

LSP Uninstall

Event ID = 2

Level = 4 (Information)

The following Winsock LSP events are traced for an LSP uninstall operation:

  • A protocol entry is removed from the Winsock catalog.

The following parameters are logged for a LSP uninstall event:

ParameterDescription

LSP Name

The name of the LSP as obtained from the szProtocol member of the WSAPROTOCOL_INFO structure for the LSP being removed.

Catalog

The Winsock catalog (32-bit or 64-bit) where the LSP is being removed. This is an integer value that is either 32 or 64.

Installer

The module filename of the application making the LSP remove call.

GUID

The GUID value of the Winsock transport provider that the LSP is removed from.

Category

The dwCatalogEntryId member of the WSAPROTOCOL_INFO structure for the LSP being removed.

 

LSP Disable

Event ID = 3

Level = 4 (Information)

The following Winsock LSP events are traced for an LSP disable operation:

  • A protocol entry is disabled in the Winsock catalog.

The following parameters are logged for a LSP disable event:

ParameterDescription

LSP Name

The name of the LSP as obtained from the szProtocol member of the WSAPROTOCOL_INFO structure for the LSP being disabled.

Catalog

The Winsock catalog (32-bit or 64-bit) where the LSP is being disabled. This is an integer value that is either 32 or 64.

Installer

The module filename of the application making the LSP disable call.

GUID

The GUID value of the Winsock transport provider where the LSP is being disabled.

Category

The dwCatalogEntryId member of the WSAPROTOCOL_INFO structure for the LSP being disabled.

 

Winsock Catalog Reset

Event ID = 4

Level = 4 (Information)

The following Winsock LSP events are traced for a Winsock catalog reset operation:

  • The Winsock catalog is reset.

The following parameters are logged for a Winsock catalog reset event:

ParameterDescription

Catalog

The Winsock catalog (32-bit or 64-bit) that is being reset. This is an integer value that is either 32 or 64.

 

Related topics

Control of Winsock Tracing
Winsock Tracing
Winsock Tracing Levels
Winsock Network Event Tracing Details

 

 

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft. All rights reserved.