TDI Event Done 0x000002C6: Not a Real Error

When does 0x000002C6 pop up?

You'll see the TDI Event Done error code (0x000002C6) in the Windows System Event Viewer log under the source Tcpip or AFD. It usually happens after you install a network driver update, or when you're running a packet monitor like Wireshark or Microsoft Network Monitor. You might also see it if you have verbose logging enabled for network diagnostics on Windows 10, 11, Server 2019, or Server 2022.

The event text says: {TDI Event Done} The TDI indication has completed successfully. The hex value 0x000002C6 equals decimal 710.

What's really happening here?

The Transport Driver Interface (TDI) is a layer in Windows networking that sits between network protocols (like TCP/IP) and applications. When an app sends or receives data, TDI handles the handshakes. The 0x000002C6 code simply means a TDI indication event—like a connection request or data arrival—completed without errors.

Your real problem: you're seeing this event and thinking it's a failure. It's not. Microsoft defines 0x000002C6 as a success code, not an error. The name is misleading—'Event Done' sounds like something finished, but it's actually a normal part of network traffic logging. If you enable verbose TDI logging (which some diagnostics tools do), you flood your event log with these 'success' entries.

Think of it like getting a receipt after buying coffee—it's not a problem, it's proof the transaction worked.

How to stop seeing 0x000002C6

Since this is a success code, you don't fix the event itself. But you can stop it from cluttering your Event Viewer. Here's the practical approach:

Check if you have verbose logging enabled. Open Event Viewer (eventvwr.msc). Go to Windows Logs > System. Look at the source column for Tcpip or AFD events. If you see hundreds of 0x000002C6 entries per minute, something is forcing verbose logging.
Disable network driver logging. Go to Device Manager, find your network adapter (e.g., Intel I219-V or Realtek RTL8168). Right-click, select Properties, go to the Advanced tab. Look for settings like Log Verbose Connection State or Detailed Logging. Set them to Disabled or Low.
Remove third-party packet monitors. Apps like Wireshark, Microsoft Network Monitor, or even some VPN clients install TDI filters that generate these events. Uninstall them if you're not actively debugging. Reboot after.
Filter the event log. If step 1-3 don't help, create a custom filter in Event Viewer to hide 0x000002C6 events. Click Filter Current Log on the right, go to the XML tab, and add:
```
<Select Path="System">*[System[(EventID!=710)]]</Select>
```
This hides all events with ID 710 (decimal for 0x2C6) from the System log.

What's the real root cause?

In my experience, the real cause is a network driver from Intel, Realtek, or Qualcomm Atheros that enables verbose TDI logging by default on certain Windows builds. For example, the Intel Ethernet driver version 26.0+ on Windows 10 21H2 started logging these events aggressively. The driver thinks you want to see every packet handshake. It's not a bug, it's a 'feature' that doesn't respect the average user.

If it still shows up after the fix

Try a clean boot to isolate the culprit. Press Win+R, type msconfig, go to Services, check Hide all Microsoft services, then disable all third-party services. Restart. If the events stop, re-enable services one by one until you find the offender. Usually, it's a network monitoring tool or a legacy VPN client like Cisco AnyConnect.

Also check the Windows Event Forwarding or Diagnostic Policy Service—these can log TDI events when collecting network data for Microsoft. Disable the service DPS (Diagnostic Policy Service) only if you're comfortable turning off telemetry, but do not disable it on a production server without understanding the consequences—it can break Group Policy reporting.

Bottom line: 0x000002C6 is harmless. Stop worrying about it and filter it out. If you absolutely can't stand seeing it, the driver registry tweak is your best bet—but honestly, just ignore it.