Edit

Winsock Tracing Levels

  • Article

Levels of Winsock Tracing

There are two levels of logging possible in Winsock tracing:

  • Information
  • Verbose

The information level traces socket create and close events, as well as any errors that occur on the socket.

The verbose level includes the information level events, and adds additional tracing for send and receive events. The verbose logging would be used to catch buffer corruption issues as well as poorly written applications.

Either the information or verbose level can be used with the Winsock Network Event tracing. The Winsock Catalog Change tracing supports only information level.

Information Event Tracing

The following list details those Winsock network event socket operations that are traced at the information level:

  • Socket creation

    An event is logged on socket creation which can be used to trace the lifetime of a socket. These events also includes sockets created by accepting connections on a listening socket.

  • Bind

    The local IP address is logged to help correlate the Winsock tracing information to an application's socket calls.

  • Connect

    The remote IP address of the connected socket is logged to help correlate the Winsock tracing information to an application's socket calls.

  • Winsock-initiated aborts and cancels

    Anytime Winsock actively aborts or cancels a request, the event is logged.

  • Transport initiated resets

    Anytime the underlying transport indicates a connection has been reset, the event is logged.

  • Send and receive errors

    Whenever a send or receive call to the underlying transport fails, the event is logged.

  • Socket disconnect and close

    An event is logged when a socket handle is closed.

Verbose Event Tracing

All of the information events are traced at the verbose level. The following list details those additional Winsock network event socket operations that are traced at the verbose level:

  • Send and receive buffers

    Events are logged of user buffer addresses and lengths when send and receive calls are posted to Winsock, as well as upon completion of these calls. This is useful for diagnosing buffer re-use issues as well as inefficient use of buffers.

  • Socket options

    An event is logged when an application changes certain socket option values. Some of the options logged include SO_SNDBUF, SO_RCVBUF, SIO_ENABLE_CIRCULAR_QUEUEING, and FIONBIO.

  • WSAPoll and select

    An event is logged of an application's usage of WSAPoll and select calls which can be used to find performance bottlenecks.

  • Winsock-initiated aborts and cancels

    Anytime Winsock actively aborts or cancels a request, the event is logged.

  • Event mask

    An event is logged of the event mask an application registers for using the WSAEventSelect function.

  • Datagram

    An event is logged whenever a datagram arrives and there is no buffer space in which to copy it.

Control of Winsock Tracing

Winsock Tracing

Winsock Catalog Change Tracing Details

Winsock Network Event Tracing Details