Add-NetEventWFPCaptureProvider

Add-NetEventWFPCaptureProvider

Creates a WFP capture provider.

構文

Parameter Set: cim:CreateInstance0
Add-NetEventWFPCaptureProvider [-SessionName] <String> [[-Level] <Byte> ] [[-MatchAnyKeyword] <UInt64> ] [[-MatchAllKeyword] <UInt64> ] [[-CaptureLayerSet] <WFPCaptureSet> {IPv4Inbound | IPv4Outbound | IPv6Inbound | IPv6Outbound} ] [[-IPAddresses] <String[]> ] [[-TCPPorts] <UInt16[]> ] [[-UDPPorts] <UInt16[]> ] [-CimSession <CimSession[]> ] [-InformationAction <ActionPreference> {SilentlyContinue | Stop | Continue | Inquire | Ignore | Suspend} ] [-InformationVariable <String> ] [-ThrottleLimit <Int32> ] [ <CommonParameters>] [ <WorkflowParameters>]

詳細説明

The Add-NetEventWFPCaptureProvider cmdlet creates a Windows Firewall Platform (WFP) capture provider for network events. The WFP captures events directly from the network stack. You can capture traffic in network tunnels and from the loopback adapter. Unlike a NetEventPacketCapture provider, the NetEventWFPCaptureProvider captures network traffic above the IP layer.

A computer typically supports only one packet capture provider. If there is an existing provider on the current computer, remove it before you run this cmdlet.

パラメーター

-CaptureLayerSet<WFPCaptureSet>

Specifies a WFP capture set, which designates the layers and directions to filter. このパラメーターに指定できる値は、次のとおりです。

-- IPv4Inbound
-- IPv4Outbound
-- IPv6Inbound
-- IPv6Outbound

You can locially OR the direction and IP layer pairs together. For instance, you could capture incoming loopback traffic from IPv6 to avoid seeing duplicate traffic received by the loopback interface.

-CimSession<CimSession[]>

リモート セッションまたはリモート コンピューターでコマンドレットを実行します。コンピューター名またはセッション オブジェクト (New-CimSession コマンドレットや Get-CimSession コマンドレットの出力など) を入力します。既定値は、ローカル コンピューター上の現在のセッションです。

-InformationAction<ActionPreference>

Specifies how this cmdlet responds to an informational event. このパラメーターに指定できる値は、次のとおりです。

-- SilentlyContinue
-- Stop
-- Continue
-- Inquire
-- Ignore
-- Suspend

-InformationVariable<String>

Specifies a variable in which to store an informational event.

-IPAddresses<String[]>

Specifies an array of IP addresses. The provider filters for and logs network traffic that matches the IP addresses that this parameter specifies. The provider joins multiple addresses by using logical ORs.

-Level<Byte>

Specifies the Event Tracing for Windows (ETW) event error levels that NetEventWFPCaptureProvider returns. Use a level of detail specifier as a filter the type of error events that are logged. The default value for this parameter is 0x4, for informational events. このパラメーターに指定できる値は、次のとおりです。

-- 0x5. Verbose
-- 0x4. Informational
-- 0x3. Warning
-- 0x2. Error
-- 0x1. Critical
-- 0x0. LogAlways

The provider must log the event if the value of the event is less than or equal to the value of this parameter. Lower level events up to and including the specified level are logged.

-MatchAllKeyword<UInt64>

Specifies a keyword bitmask that restricts the events that the provider logs.

-MatchAnyKeyword<UInt64>

Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate hexadecimal values that enable the provider to write one or more events for which it is instrumented, if a match is found. Use a set of hexadecimal values for keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see EnableTraceEx2 function (https://msdn.microsoft.com/en-us/library/windows/desktop/dd392305(v=vs.85).aspx) in the Microsoft Developer Network library.

-SessionName<String>

Specifies the name of the session that is associated with the NetEventWFPCaptureProvider. This parameter has the same value as the Name parameter for the New-NetEventSession cmdlet.

-TCPPorts<UInt16[]>

Specifies an array of TCP ports. The provider filters for and logs network traffic that matches the ports that this parameter specifies. The provider joins multiple port numbers with logical ORs.

-ThrottleLimit<Int32>

コマンドレットを実行する際に確立できる同時実行操作の最大数を指定します。このパラメーターを省略するか、値 0 を入力した場合、コンピューター上で実行されている CIM コマンドレットの数に基づいて、コマンドレットに最適なスロットル制限が Windows PowerShell® によって計算されます。スロットル制限は、セッションやコンピューターではなく、現在のコマンドレットにのみ適用されます。

-UDPPorts<UInt16[]>

Specifies an array of UDP ports. The provider filters for and logs network traffic that matches the ports that this parameter specifies. The provider joins multiple port numbers with logical ORs.

<CommonParameters>

このコマンドレットは共通のパラメーターをサポートしています(-Verbose、-Debug、-ErrorAction、-ErrorVariable、-OutBuffer、および -OutVariable)。詳細については、TechNet の「 「about_CommonParameters」 (https://go.microsoft.com/fwlink/p/?LinkID=113216) を参照してください。

<WorkflowParameters>

入力

入力型は、コマンドレットにパイプできるオブジェクトの型です。

出力

出力型は、コマンドレットが出力するオブジェクトの型です。

使用例

Example 1: Create a WFP capture provider

The first command creates a network event session by using the New-NetEventSession cmdlet. The command also assigns the name WFPCapture to the session.

The second command uses the current cmdlet to create a WFP capture provider for the session named WFPCapture.

The final command starts the event tracing session named WFPCapture.

PS C:\> New-NetEventSession -Name "WFPCapture" -CaptureMode RealtimeLocal -LocalFilePath "C:\users\DavidChew\Documents\wfpdata.etl"
PS C:\> Add-NetEventWFPCaptureProvider -SessionName "WFPCapture" 
PS C:\> Start-NetEventSession -Name "WFPCapture"

関連項目

Get-NetEventWFPCaptureProvider

Remove-NetEventWFPCaptureProvider

Set-NetEventWFPCaptureProvider

New-NetEventSession