Set-NetEventWFPCaptureProvider

Set-NetEventWFPCaptureProvider

Modifies the configuration of a WFP capture provider.

Syntaxe

Parameter Set: BySessionName
Set-NetEventWFPCaptureProvider [[-SessionName] <String[]> ] [-CimSession <CimSession[]> ] [-InformationAction <ActionPreference> {SilentlyContinue | Stop | Continue | Inquire | Ignore | Suspend} ] [-InformationVariable <String> ] [-PassThru] [-ThrottleLimit <Int32> ] [[-Level] <Byte> ] [[-MatchAnyKeyword] <UInt64> ] [[-MatchAllKeyword] <UInt64> ] [[-CaptureLayerSet] <WFPCaptureSet> {IPv4Inbound | IPv4Outbound | IPv6Inbound | IPv6Outbound} ] [[-IPAddresses] <String[]> ] [[-TCPPorts] <UInt16[]> ] [[-UDPPorts] <UInt16[]> ] [ <CommonParameters>] [ <WorkflowParameters>]

Parameter Set: BySessionOfTheProvider
Set-NetEventWFPCaptureProvider [-AssociatedEventSession <CimInstance> ] [-CimSession <CimSession[]> ] [-InformationAction <ActionPreference> {SilentlyContinue | Stop | Continue | Inquire | Ignore | Suspend} ] [-InformationVariable <String> ] [-PassThru] [-ThrottleLimit <Int32> ] [[-Level] <Byte> ] [[-MatchAnyKeyword] <UInt64> ] [[-MatchAllKeyword] <UInt64> ] [[-CaptureLayerSet] <WFPCaptureSet> {IPv4Inbound | IPv4Outbound | IPv6Inbound | IPv6Outbound} ] [[-IPAddresses] <String[]> ] [[-TCPPorts] <UInt16[]> ] [[-UDPPorts] <UInt16[]> ] [ <CommonParameters>] [ <WorkflowParameters>]

Parameter Set: InputObject (cdxml)
Set-NetEventWFPCaptureProvider [-CimSession <CimSession[]> ] [-InformationAction <ActionPreference> {SilentlyContinue | Stop | Continue | Inquire | Ignore | Suspend} ] [-InformationVariable <String> ] [-PassThru] [-ThrottleLimit <Int32> ] [[-Level] <Byte> ] [[-MatchAnyKeyword] <UInt64> ] [[-MatchAllKeyword] <UInt64> ] [[-CaptureLayerSet] <WFPCaptureSet> {IPv4Inbound | IPv4Outbound | IPv6Inbound | IPv6Outbound} ] [[-IPAddresses] <String[]> ] [[-TCPPorts] <UInt16[]> ] [[-UDPPorts] <UInt16[]> ] [ <CommonParameters>] [ <WorkflowParameters>]

Description détaillée

The Set-NetEventWFPCaptureProvider cmdlet modifies the configuration of a Windows Firewall Platform (WFP) capture provider. For more information about the NetEventWFPCaptureProvider, see the Add-NetEventWFPCaptureProvider cmdlet.

Paramètres

-AssociatedEventSession<CimInstance>

Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.

-CaptureLayerSet<WFPCaptureSet>

Specifies a WFP capture set, which designates the layers and directions to filter. Les valeurs acceptables pour ce paramètre sont les suivantes : 

-- IPv4Inbound
-- IPv4Outbound
-- IPv6Inbound
-- IPv6Outbound

You can logically OR the direction and IP layer pairs together. For instance, you could capture incoming loopback traffic from IPv6 to avoid seeing duplicate traffic received by the loopback interface.

-CimSession<CimSession[]>

Exécute l'applet de commande dans une session distante ou sur un ordinateur distant. Entrez un nom d'ordinateur ou un objet de session, tels que le résultat d'une applet de commande New-CimSession ou Get-CimSession. La valeur par défaut est la session en cours sur l'ordinateur local.

-InformationAction<ActionPreference>

Specifies how this cmdlet responds to an informational event. Les valeurs acceptables pour ce paramètre sont les suivantes : 

-- SilentlyContinue
-- Stop
-- Continue
-- Inquire
-- Ignore
-- Suspend

-InformationVariable<String>

Specifies a variable in which to store an informationa; event.

-IPAddresses<String[]>

Specifies an array of IP addresses. The provider filters for and logs network traffic that matches the IP addresses that this parameter specifies. The provider joins multiple addresses by using logical OR.

-Level<Byte>

Specifies the Event Tracing for Windows (ETW) event error levels that NetEventWFPCaptureProvider returns. Use a level of detail specifier as a filter the type of error events that are logged. The default value for this parameter is 0x4, for informational events. Les valeurs acceptables pour ce paramètre sont les suivantes : 

-- 0x5. Verbose
-- 0x4. Informational
-- 0x3. Warning
-- 0x2. Error
-- 0x1. Critical
-- 0x0. LogAlways

The provider must log the event if the value of the event is less than or equal to the value of this parameter. Lower level events up to and including the specified level are logged.

-MatchAllKeyword<UInt64>

Specifies a keyword bitmask that restricts the events that the provider logs.

-MatchAnyKeyword<UInt64>

Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate hexadecimal values that enable the provider to write one or more events for which it is instrumented, if a match is found. Use a set of hexadecimal values for keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see EnableTraceEx2 function (https://msdn.microsoft.com/en-us/library/windows/desktop/dd392305(v=vs.85).aspx) in the Microsoft Developer Network library.

-PassThru

Renvoie un objet qui représente l'élément sur lequel vous travaillez. Par défaut, cette applet de commande ne génère pas de sortie.

-SessionName<String[]>

Specifies an array of session names that are associated with the NetEventWFPCaptureProvider. This parameter has the same value as the Name parameter for the New-NetEventSession cmdlet.

-TCPPorts<UInt16[]>

Specifies an array of TCP ports. The provider filters and logs network traffic that matches the ports that this parameter specifies. The provider joins multiple port numbers with logical OR.

-ThrottleLimit<Int32>

Spécifie le nombre maximal d'opérations simultanées qui peuvent être établies pour exécuter l'applet de commande. Si ce paramètre est omis ou si la valeur 0 est entrée, Windows PowerShell® calcule un seuil de limitation optimal pour l'applet de commande en fonction du nombre d'applets de commande CIM exécutées sur l'ordinateur. Le seuil de limitation s'applique uniquement à l'applet de commande en cours, non pas à la session ou à l'ordinateur.

-UDPPorts<UInt16[]>

Specifies an array of UDP ports. The provider filters and logs network traffic that matches the ports that this parameter specifies. The provider joins multiple port numbers with logical OR.

<CommonParameters>

Cette applet de commande prend en charge les paramètres courants : -Verbose, -Debug, -ErrorAction, -ErrorVariable, -OutBuffer et -OutVariable. Pour plus d'informations, consultez  . about_CommonParameters (https://go.microsoft.com/fwlink/p/?LinkID=113216).

<WorkflowParameters>

Entrées

Le type d'entrée correspond au type des objets que vous pouvez adresser à l'applet de commande.

Sorties

Le type de sortie correspond au type des objets que l'applet de commande émet.

Exemples

Example 1: Modify a WFP capture provider

The first command creates a network event session by using the New-NetEventSession cmdlet. This command also assigns the name WFPCapture to the session.

The second command uses the current cmdlet to create a WFP capture provider for the session named WFPCapture.

The third command configures the provider for capture layer directional filtering and loopback IP addresses.

The fourth command starts the session named WFPCapture.

The fifth and commands use the ping utility to test the local host address in both IPv4 and IPv6. The provider should capture both of these local test connections.

The final two commands stop the session named WFPCapture and remove it.

PS C:\> New-NetEventSession -Name "WFPCapture" -CaptureMode RealtimeLocal -LocalFilePath "C:\users\DavidChew\Documents\wfpdata.etl"
PS C:\> Add-NetEventWFPCaptureProvider -SessionName "WFPCapture"
PS C:\> Set-NetEventWFPCaptureProvider -SessionName "WFPCapture" -CaptureLayerSet IPv4Inbound, IPv6Inbound -IPAddresses "127.0.0.1", "::1"
PS C:\> Start-NetEventSession -Name "WFPCapture"
PS C:\> ping 127.0.0.1
PS C:\> ping ::1
PS C:\> Stop-NetEventSession -Name "WFPCapture"
PS C:\> Remove-NetEventSession -Name "WFPCapture" 

Rubriques connexes

Add-NetEventWFPCaptureProvider

Get-NetEventWFPCaptureProvider

Remove-NetEventWFPCaptureProvider