Winsock Tracing Events
This section describes detailed information on specific Winsock Tracing Events details.
Winsock tracing is a troubleshooting feature that can be enabled in retail binaries to trace certain Windows socket events with minimal overhead. This feature allows for better diagnostic capabilities for developers and product support. Winsock network event tracing supports tracing socket operations for IPv4 and IPv6 applications. Winsock catalog change tracing supports tracing changes made to the Winsock catalog by layered service providers (LSPs).
Layered Service Providers are deprecated. Starting with Windows 8 and Windows Server 2012, use Windows Filtering Platform.
Winsock tracing uses Event Tracing for Windows (ETW), a general-purpose, high-speed tracing facility provided by the operating system. ETW provides a tracing mechanism for events raised by both user-mode applications and kernel-mode device drivers. ETW can enable and disable logging dynamically, making it easy to perform detailed tracing in production environments without requiring reboots or application restarts. Support for Winsock tracing using ETW was added on Windows Vista and later. For general information on ETW, see Improve Debugging And Performance Tuning With ETW.
The following list provides detailed information for each Winsock tracing event. For additional information on any event, click the event name.
|AFD_EVENT_CREATE||Winsock network tracing event for a socket creation operation.|
|AFD_EVENT_CLOSE||Winsock network tracing event for socket close operation.|
|WINSOCK_WS2HELP_LSP_INSTALL||Winsock catalog change event for a layered service provider (LSP) installation operation.|
|WINSOCK_WS2HELP_LSP_REMOVE||Winsock catalog change event for a layered service provider (LSP) removal operation.|
|WINSOCK_WS2HELP_LSP_DISABLE||Winsock catalog change event for a layered service provider (LSP) disable operation.|
|WINSOCK_WS2HELP_LSP_RESET||Winsock catalog change event for a Winsock catalog reset operation.|