Edit

Winsock Tracing Events

  • Article

This section describes detailed information on specific Winsock Tracing Events details.

Winsock tracing is a troubleshooting feature that can be enabled in retail binaries to trace certain Windows socket events with minimal overhead. This feature allows for better diagnostic capabilities for developers and product support. Winsock network event tracing supports tracing socket operations for IPv4 and IPv6 applications. Winsock catalog change tracing supports tracing changes made to the Winsock catalog by layered service providers (LSPs).

Note

Layered Service Providers are deprecated. Starting with Windows 8 and Windows Server 2012, use Windows Filtering Platform.

 

Winsock tracing uses Event Tracing for Windows (ETW), a general-purpose, high-speed tracing facility provided by the operating system. ETW provides a tracing mechanism for events raised by both user-mode applications and kernel-mode device drivers. ETW can enable and disable logging dynamically, making it easy to perform detailed tracing in production environments without requiring reboots or application restarts. Support for Winsock tracing using ETW was added on Windows Vista and later. For general information on ETW, see Improve Debugging And Performance Tuning With ETW.

The following list provides detailed information for each Winsock tracing event. For additional information on any event, click the event name.

Event Name Description
AFD_EVENT_CREATE Winsock network tracing event for a socket creation operation.
AFD_EVENT_CLOSE Winsock network tracing event for socket close operation.
WINSOCK_WS2HELP_LSP_INSTALL Winsock catalog change event for a layered service provider (LSP) installation operation.
WINSOCK_WS2HELP_LSP_REMOVE Winsock catalog change event for a layered service provider (LSP) removal operation.
WINSOCK_WS2HELP_LSP_DISABLE Winsock catalog change event for a layered service provider (LSP) disable operation.
WINSOCK_WS2HELP_LSP_RESET Winsock catalog change event for a Winsock catalog reset operation.

 

Improve Debugging And Performance Tuning With ETW

Winsock Tracing

Winsock Tracing Levels

Control of Winsock Tracing

Winsock Network Event Tracing Details

Winsock Catalog Change Tracing Details