Set-DnsServerResponseRateLimiting

업데이트 날짜: 2015년 5월

Set-DnsServerResponseRateLimiting

Enables RRL on a DNS server.

구문

Parameter Set: SetDnsServerRRL1
Set-DnsServerResponseRateLimiting [-CimSession <CimSession[]> ] [-ComputerName <String> ] [-ErrorsPerSec <UInt32> ] [-Force] [-InformationAction <ActionPreference> {SilentlyContinue | Stop | Continue | Inquire | Ignore | Suspend} ] [-InformationVariable <String> ] [-IPv4PrefixLength <UInt32> ] [-IPv6PrefixLength <UInt32> ] [-LeakRate <UInt32> ] [-MaximumResonsesPerWindow <UInt32> ] [-Mode <String> {LogOnly | Enable | Disable} ] [-PassThru] [-ResetToDefault] [-ResponsesPerSec <UInt32> ] [-ThrottleLimit <Int32> ] [-TruncateRate <UInt32> ] [-WindowInSec <UInt32> ] [-Confirm] [-WhatIf] [ <CommonParameters>] [ <WorkflowParameters>]

자세한 설명

The Set-DnsServerResponseRateLimiting cmdlet enables Response Rate Limiting (RRL) on a Windows DNS server.

매개 변수

-CimSession<CimSession[]>

원격 세션이나 원격 컴퓨터에서 cmdlet을 실행합니다. 컴퓨터 이름이나 New-CimSession 또는 Get-CimSession cmdlet의 출력과 같은 세션 개체를 입력하세요. 기본값은 로컬 컴퓨터 상의 현재 세션입니다.

-ComputerName<String>

Specifies a remote DNS server. You can specify an IP address or any value that resolves to an IP address, such as a fully qualified domain name (FQDN), host name, or NetBIOS name.

-ErrorsPerSec<UInt32>

Specifies the maximum number of times that the server can send an error response to a client within a one-second interval. The error responses include: REFUSED, FORMERR and SERVFAIL

-Force

사용자에게 확인 메시지를 표시하지 않고 명령을 강제 실행합니다.

-InformationAction<ActionPreference>

Specifies how this cmdlet responds to an information event. 이 매개 변수에 허용되는 값은 다음과 같습니다.

-- SilentlyContinue
-- Stop
-- Continue
-- Inquire
-- Ignore
-- Suspend

-InformationVariable<String>

Specifies a variable in which to store an information event message.

-IPv4PrefixLength<UInt32>

Specifies the IPv4 prefix length, which indicates the size of the subnet in which the incoming queries are grouped. The server applies RRL if queries resulting in the same response occur more frequently than expected in a specified time window. The default value of this parameter is 24.

-IPv6PrefixLength<UInt32>

Specifies the IPv6 prefix length, which indicates the size of the IPv6 subnet in which the incoming queries are grouped. The server applies RRL if queries resulting in the same response occur more frequently than expected in a specified time window. The default value of this parameter is 56.

-LeakRate<UInt32>

Specifies the rate at which the server responds to dropped queries. For queries that meet criteria to be dropped due to RRL, the DNS server still responds once per LeakRate queries. For example, if LeakRate is 3, the server responds to one in every 3 queries. The allowed range for LeakRate is 2 to 10. If LeakRate is set to zero, then no responses are 'leaked' by RRL. LeakRate leaves a chance for the victims in the same subnet as the forged IP address to get responses to their valid queries. The default value for LeakRate is 3.

-MaximumResonsesPerWindow<UInt32>

Specifies the maximum number of responses that the server sends to a subnet-domain address in a RRL time window. This puts an upper limit on responses in cases where the magnitude of attack is so high that even the leaked responses are enough to cause a reflection attack. The default value is 1024 responses per window.

-Mode<String>

Specifies the state of RRL on the DNS server. 이 매개 변수에 허용되는 값은 다음과 같습니다. Enable, or Disable, or LogOnly. If the mode is set to LogOnly the DNS server performs all the RRL calculations but instead of taking the preventive actions (dropping or truncating responses), it only logs the potential actions as if RRL were enabled and continues with the normal responses. The default value is Enable.

-PassThru

작업 중인 항목을 나타내는 개체를 반환합니다. 기본적으로 이 cmdlet은 출력을 생성하지 않습니다.

-ResetToDefault

Indicates that this cmdlet sets all the RRL settings to their default values.

-ResponsesPerSec<UInt32>

Specifies the maximum number of times that the server sends a client the same response within a one-second interval.

-ThrottleLimit<Int32>

Cmdlet을 실행하도록 설정할 수 있는 동시 작업의 최대 수를 지정합니다. 이 매개 변수를 생략하거나 값으로 0 을 입력하면 Windows PowerShell®은 컴퓨터에서 실행 중인 CIM cmdlet의 수에 따라 cmdlet에 대한 최적의 스로틀 제한을 계산합니다. 스로틀 제한은 현재 cmdlet에만 적용되고, 세션이나 컴퓨터에는 적용되지 않습니다.

-TruncateRate<UInt32>

Specifies the rate at which the server responds with truncated responses. For queries that meet the criteria to be dropped due to RRL, the DNS server still responds with truncated responses once per TruncateRate queries. For example, if TruncateRate is 2, one in every 2 queries receives a truncated response. The TruncateRate parameter provides the valid clients a way to reconnect using TCP. The allowed range for TruncateRate is 2 to 10. If it is set to 0, then this behaviour is disabled. The default value is 2.

-WindowInSec<UInt32>

Specifies the period (in seconds) over which rates are measured and averaged for RRL. RRL is applied if queries from same subnet, resulting in same response, occur more frequently than expected in a specified time window. The default value is 5.

-Confirm

cmdlet을 실행하기 전에 확인 메시지를 표시합니다.

-WhatIf

cmdlet이 실행되는 경우 발생할 결과를 보여 줍니다. cmdlet은 실행되지 않습니다.

<CommonParameters>

이 cmdlet은 -Verbose, -Debug, -ErrorAction, -ErrorVariable, -OutBuffer, -OutVariable 등의 일반 매개 변수를 지원합니다. 자세한 내용은 TechNet의 about_CommonParameters(https://go.microsoft.com/fwlink/p/?LinkID=113216)

<WorkflowParameters>

입력

입력 형식은 cmdlet으로 파이프할 수 있는 개체의 형식입니다.

출력

출력 형식은 cmdlet 실행 시 출력되는 개체의 형식입니다.

• Microsoft.Management.Infrastructure.CimInstance#DnsServerResponseRateLimiting

  Microsoft.Management.Infrastructure.CimInstance 개체는 WMI(Windows Management Instrumentation) 개체를 표시하는 래퍼 클래스입니다. 파운드 기호(#) 뒤의 경로는 기본 WMI 개체에 대한 네임 스페이스 및 클래스 이름을 제공합니다.

예

Example 1: Set RRL parameters on a DNS server

This command sets the RRL parameters on the DNS Server.

PS C:\> Set-DnsServerResponseRateLimiting -WindowInSec 7 -LeakRate 4 -TruncateRate 3 -ErrorsPerSec 8 -ResponsesPerSec 8                         

Example 2: Reset RRL settings to default values

This command resets all the RRL parameters on the DNS Server to default values.

PS C:\> Set-DnsServerResponseRateLimiting -ResetToDefault                        

Example 3: Set RRL to LogOnly mode

This command sets the RRL on the DNS server to LogOnly mode.

PS C:\> Set-DnsServerRRL -Mode LogOnly                        

관련 항목

Add-DnsServerResponseRateLimitingExceptionlist

Get-DnsServerResponseRateLimiting

Set-DnsServerResponseRateLimitingExceptionlist