A user investigation suggests that Intel's network optimization software, Intel Connectivity Performance Suite (ICPS), may be destabilizing IPv6 connections on some Windows PCs.
A user who had been investigating a OneNote bug, in which note contents failed to appear even though the app showed that syncing was complete, published test results on October 7, 2026. According to those results, replacing ICPS with a newer generic version from Intel raised the number of successful IPv6 connections sharply, from 138 out of 170 to 169 out of 170.
The suspected cause is behavior in the ICPS driver that rewrites identifying information contained in packets mid-connection. However, the fact that the newer version showed improvement does not mean it will be delivered to each PC maker's devices. Those are separate questions.
From a OneNote sync failure to a communication filter in Intel's software
The problem was reported by a Samsung Galaxy Book user known as "COOLak." The user posted to the Intel Community on October 2, sharing details of the environment and findings.
The test machine was a Samsung Galaxy Book 960QHA with an Intel Wi-Fi 7 BE201 wireless adapter, running Windows 11 Pro. The investigation was carried out on an IPv6 IPoE connection over Japan's NTT FLET'S line.
According to the user's investigation report, OneNote had shown blank notes marked as "synced" for about three weeks.
Meanwhile, OneNote on the web and on a smartphone worked normally. Looking only at the Windows app, it was therefore hard to tell that a network problem was involved.
The investigation ultimately pointed to ICPS.
ICPS is software that optimizes network communication on supported Intel-based PCs.
On the affected machine, the ICPS application version was "40.25.926.0" and the driver package was "40.25.926.173."
The reporter examined not only the Wi-Fi adapter itself but also the filter driver that handles network traffic, and concluded that IntcCo11X64.sys, included in ICPS, was likely involved.
Using Windows' packet capture functionality, the user analyzed the packets visible at the wireless adapter after they had passed through the filter, and found unusual changes.
Stopping only ICPS's bandwidth management service did not fix the problem. But when the driver named INTCCoSvc and the ICPS-related services were stopped, IPv6 connectivity recovered and OneNote synced normally.
This suggests that stopping the bandwidth management service alone may leave the problematic traffic processing running.
IPv6 "flow labels" rewritten mid-connection
Key to understanding this issue is the IPv6 packet header field known as the "Flow Label."
The Flow Label is a 20-bit value used to identify packets belonging to the same communication. Network equipment can combine it with information such as the source and destination to decide which path or processing destination to send a packet to.
RFC 6437, which defines the handling of IPv6 flow labels, recommends that packets belonging to the same flow carry a consistent value.
However, in the packet analysis results published by COOLak, this value was rewritten mid-connection.
Specifically, the SYN packet that starts a TCP connection carried a non-zero flow label, but subsequent ACK packets and data-carrying packets had the value changed to 0.
In the initial test, none of the 42 subsequent packets retained the original flow label.
When the problematic ICPS driver and related services were stopped, the flow label was preserved in all 65 packets examined.
That said, a flow label of 0 is not a problem in itself.
Under RFC 6437, 0 is an accepted value indicating that no flow label is set. If 0 is set from the start of a connection, that alone is not abnormal.
What is being flagged here is that the flow label changes partway through a connection, even though the packets belong to the same communication.
If network equipment uses the flow label for load balancing, the packets at the start of a connection and the later packets could be sent to different servers.
The reporter explains that on the Microsoft cloud service side, later packets are sent to a different server that has no knowledge of the connection state, which results in the connection being reset.
However, RFC 6437 does not assume that traffic is distributed based on the flow label alone, and envisions it being used together with other header information.
The RFC specification cannot tell us what algorithm Microsoft actually uses to distribute traffic.
The reporter also notes that flow label rewriting by the older ICPS version was observed even in traffic to sites that connected successfully.
In other words, a rewritten flow label does not necessarily cause a connection to fail.
Symptoms such as being unable to reach only certain sites, or working normally over IPv4, could arise from the combination of processing on the device and the load-balancing mechanisms along the route to the destination.
Intel's newer generic version raises IPv6 success rate from 81.2% to 99.4%
On October 7, COOLak retested on the same Galaxy Book using a newer generic ICPS version provided by Intel.
The test attempted IPv6 connections to 34 websites, five times each, for a total of 170 attempts. For comparison, connection tests were also run over IPv4, and packet headers were recorded at the wireless adapter.
According to the measurement results in the published technical analysis (rows B and G), the older and newer versions differed as follows.
| Comparison item | Previous OEM version | Intel's newer generic version |
|---|---|---|
| ICPS package | 40.25.926.173 | 50.26.623.243 |
| Communication control driver | 11.5.11.19 | 12.10.14.33 |
| Successful IPv6 connections | 138/170 | 169/170 |
| Packets retaining flow label | 8,457/9,842 | 11,711/11,711 |
| Packets with flow label rewritten to 0 | 1,385 | 0 |
The IPv6 connection success rate thus improved from 81.2% with the older version to 99.4% with the newer one, a difference of 18.2 percentage points.
The success rate was calculated by dividing successful connections by 170, and the improvement is (169−138) ÷ 170 × 100, rounded to one decimal place.
Furthermore, with the newer version, the flow label was retained in all 11,711 observed packets, and no rewriting to 0 was seen.
However, these are measurements from a single device, under specific site and line conditions. In addition, because the connection success rate and the flow label retention rate have different denominators, they cannot be compared as the same metric.
Even with the newer ICPS, not all 170 connections succeeded.
The one remaining failure was a timeout connecting to www.microsoft.com, but according to the reporter, the same phenomenon was seen over IPv4, so it is considered unrelated to the flow label problem.
The ICPS communication control driver itself was still running with the newer version.
This suggests that, in the test environment, flow label rewriting was resolved without stopping ICPS entirely.
Similar IPv6 connection problems reported on an ASUS laptop
Beyond this Samsung Galaxy Book, other IPv6 connection problems apparently caused by ICPS have been reported.
A report posted to the Intel Community in July described similar symptoms on an ASUS Vivobook S 14.
That device was running ICPS "40.25.725.165," and about 40–60% of IPv6 HTTPS connections to Amazon Web Services (AWS) CloudFront were reportedly failing.
IPv4 connections, by contrast, were stable.
The problem reproduced not only over Wi-Fi but also with a USB wired LAN adapter.
It was reported that after disabling or removing ICPS and rebooting, no failures occurred in repeated connection tests.
However, the investigation on the ASUS device did not measure the flow label itself.
It therefore cannot be concluded that the flow label rewriting confirmed on the Samsung Galaxy Book occurred in the same way on the ASUS device.
Although IPv6 connection problems seemingly related to ICPS have been reported on multiple devices, whether they all share the same cause requires further verification.
Even if a fixed version is available, it may not reach every PC
Intel currently offers ICPS "50.26.623.243" on its official download page.
However, the release notes from September 2026 contain no clear statement that a bug related to the IPv6 flow label was fixed.
They describe changes to supported products and improvements to the user interface and compatibility.
As a result, although the version in which users confirmed an improvement is known, it is difficult to determine from official documents alone which version first fixed the problem or which versions are affected.
Moreover, even if Intel publishes a newer generic version, it is not necessarily delivered automatically to every PC maker's machines.
In COOLak's review of the Windows Update Catalog as of October 7, the "50.26.623.243" package registered for Samsung targeted only the device IDs SID_1001 and SID_1002.
The reporter's own Galaxy Book, on which the problem was confirmed, was SID_0001.
Because the device IDs do not match, the reporter says that, at least according to the registration at the time of the investigation, the newer version would not be delivered to this machine.
This shows that a new driver being registered in the Windows Update catalog is different from the PC you actually use being eligible to receive it.
However, the number of catalog entries cannot be used to estimate how many PCs are affected. Nor are all ICPS versions older than the new one necessarily subject to the same problem.
The reporter also states explicitly that some builds between the old and new versions could not be tested.
Microsoft also reportedly considering mitigation
There have also been reports of movement on the Microsoft side.
According to records of communications with the companies published by COOLak, on October 8 a Microsoft Azure networking representative acknowledged that changing the flow label alters where packets are routed.
The representative reportedly said they would coordinate with the Windows team and work on mitigation on the Azure Front Door side.
However, this is the reporter's summary of private exchanges, not an official announcement from Microsoft of the fix or its timing.
It is therefore unclear when Microsoft's measures will be introduced or what range of connection problems they will resolve.
Users and system administrators considering an ICPS update because of this issue need to check not just whether a newer version has been released, but whether their PC is formally among the supported targets.
Intel's generic ICPS targets selected environments such as Intel Evo and vPro, and also requires compatible Wi-Fi and Management Engine drivers.
Intel itself recommends consulting the PC manufacturer before installing it.
Therefore, installing the generic version without checking the manufacturer's support status is not necessarily appropriate just because a problem is occurring.
The focus going forward is whether Intel and the PC makers clarify the scope of the impact and reliably deliver a fixed version to affected devices.
Only when manufacturers distribute updates matching the target device IDs, and users can confirm that their IPv6 connections and OneNote sync have actually recovered, can the improvement be judged to have reached users broadly.