HelpCache/MSFT_NetEventPacketCaptureProvider.cdxml-help.xml
|
<?xml version = "1.0" encoding = "utf-8" ?>
<helpItems schema="maml"> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"><command:details><command:name>Add-NetEventPacketCaptureProvider</command:name><maml:description><maml:para>Adds a Remote Packet Capture provider.</maml:para></maml:description><maml:copyright><maml:para /></maml:copyright><command:verb>Add</command:verb><command:noun>NetEventPacketCaptureProvider</command:noun><dev:version /></command:details><maml:description><maml:para>The Add-NetEventPacketCaptureProvider cmdlet adds a Remote Packet Capture provider. You can only use one packet capture provider at a time and you must remove an existing provider before you use this cmdlet to add a new provider. To remove an existing Remote Packet Capture provider, use the Remove-NetEventPacketCaptureProvider cmdlet.</maml:para></maml:description><command:syntax><command:syntaxItem><maml:name>Add-NetEventPacketCaptureProvider</maml:name><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="1" aliases=""><maml:name>SessionName</maml:name><maml:description><maml:para>Specifies the name of the session associated with the packet capture provider. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">String</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="10" aliases=""><maml:name>IpProtocols</maml:name><maml:description><maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">Byte[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="11" aliases=""><maml:name>TruncationLength</maml:name><maml:description><maml:para>Specifies the display length of each captured packet. The default size is 128 bytes. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt16</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="12" aliases=""><maml:name>VmCaptureDirection</maml:name><maml:description><maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">VmCaptureDirection</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="2" aliases=""><maml:name>Level</maml:name><maml:description><maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para><maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Byte</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases=""><maml:name>MatchAnyKeyword</maml:name><maml:description><maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see <maml:navigationLink><maml:linkText>http://msdn.microsoft.com/en-us/library/windows/desktop/dd392305(v=vs.85).aspx</maml:linkText><maml:uri></maml:uri></maml:navigationLink> in the Microsoft Developer Library.</maml:para><maml:para></maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases=""><maml:name>MatchAllKeyword</maml:name><maml:description><maml:para>Specifies a bitmask that restricts the events that the provider logs. Set the MatchAnyKeyword parameter value to 0 (zero) to match all keywords.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases=""><maml:name>CaptureType</maml:name><maml:description><maml:para>Specifies a capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">CaptureType</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="6" aliases=""><maml:name>MultiLayer</maml:name><maml:description><maml:para>Indicates whether the capture occurs at various layers of the stack. This setting has a value of $False by default. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">Boolean</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="7" aliases=""><maml:name>LinkLayerAddress</maml:name><maml:description><maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="8" aliases=""><maml:name>EtherType</maml:name><maml:description><maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para></maml:description><command:parameterValue required="true" variableLength="true">UInt16[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="9" aliases=""><maml:name>IpAddresses</maml:name><maml:description><maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter. </maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description></command:parameter></command:syntaxItem></command:syntax><command:parameters><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="5" aliases=""><maml:name>CaptureType</maml:name><maml:description><maml:para>Specifies a capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">CaptureType</command:parameterValue><dev:type><maml:name>CaptureType</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue><dev:type><maml:name>CimSession[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="8" aliases=""><maml:name>EtherType</maml:name><maml:description><maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para></maml:description><command:parameterValue required="true" variableLength="true">UInt16[]</command:parameterValue><dev:type><maml:name>UInt16[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="9" aliases=""><maml:name>IpAddresses</maml:name><maml:description><maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter. </maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue><dev:type><maml:name>String[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="10" aliases=""><maml:name>IpProtocols</maml:name><maml:description><maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">Byte[]</command:parameterValue><dev:type><maml:name>Byte[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="2" aliases=""><maml:name>Level</maml:name><maml:description><maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para><maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Byte</command:parameterValue><dev:type><maml:name>Byte</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="7" aliases=""><maml:name>LinkLayerAddress</maml:name><maml:description><maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue><dev:type><maml:name>String[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4" aliases=""><maml:name>MatchAllKeyword</maml:name><maml:description><maml:para>Specifies a bitmask that restricts the events that the provider logs. Set the MatchAnyKeyword parameter value to 0 (zero) to match all keywords.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue><dev:type><maml:name>UInt64</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="3" aliases=""><maml:name>MatchAnyKeyword</maml:name><maml:description><maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. For more information, see <maml:navigationLink><maml:linkText>http://msdn.microsoft.com/en-us/library/windows/desktop/dd392305(v=vs.85).aspx</maml:linkText><maml:uri></maml:uri></maml:navigationLink> in the Microsoft Developer Library.</maml:para><maml:para></maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue><dev:type><maml:name>UInt64</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="6" aliases=""><maml:name>MultiLayer</maml:name><maml:description><maml:para>Indicates whether the capture occurs at various layers of the stack. This setting has a value of $False by default. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">Boolean</command:parameterValue><dev:type><maml:name>Boolean</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="false" globbing="false" pipelineInput="false" position="1" aliases=""><maml:name>SessionName</maml:name><maml:description><maml:para>Specifies the name of the session associated with the packet capture provider. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">String</command:parameterValue><dev:type><maml:name>String</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue><dev:type><maml:name>Int32</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="11" aliases=""><maml:name>TruncationLength</maml:name><maml:description><maml:para>Specifies the display length of each captured packet. The default size is 128 bytes. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt16</command:parameterValue><dev:type><maml:name>UInt16</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="12" aliases=""><maml:name>VmCaptureDirection</maml:name><maml:description><maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">VmCaptureDirection</command:parameterValue><dev:type><maml:name>VmCaptureDirection</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue>false</dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue>false</dev:defaultValue></command:parameter></command:parameters><command:inputTypes><command:inputType><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:inputType></command:inputTypes><command:returnValues><command:returnValue><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:returnValue></command:returnValues><command:terminatingErrors /><command:nonTerminatingErrors /><command:examples><command:example><maml:title>Example 1: Add a packet capture provider</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\>New-NetEventSession -SessionName "Session01" PS C:\> Add-NetEventProvider -Name "Microsoft-Windows-TCPIP" -SessionName "Session01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "Session01" </dev:code><dev:remarks><maml:para>This example adds a Remote Packet Capture provider to a session.</maml:para><maml:para>The first command uses the New-NetEventSession cmdlet to create a new session named Session01.</maml:para><maml:para>The second command adds a provider named Microsoft-Windows-TCPIP to the session named Session01 by using the Add-NetEventProvider cmdlet.</maml:para><maml:para>The third command adds a packet capture provider to the session.</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example></command:examples><maml:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText><maml:uri>http://go.microsoft.com/fwlink/?LinkID=294382</maml:uri></maml:navigationLink><maml:navigationLink><maml:linkText>Add-NetEventProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>New-NetEventSession</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Remove-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Set-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink></maml:relatedLinks></command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"><command:details><command:name>Get-NetEventPacketCaptureProvider</command:name><maml:description><maml:para>Displays a Remote Packet Capture provider.</maml:para></maml:description><maml:copyright><maml:para /></maml:copyright><command:verb>Get</command:verb><command:noun>NetEventPacketCaptureProvider</command:noun><dev:version /></command:details><maml:description><maml:para>The Get-NetEventPacketCaptureProvider cmdlet displays a Remote Packet Capture provider.</maml:para></maml:description><command:syntax><command:syntaxItem><maml:name>Get-NetEventPacketCaptureProvider</maml:name><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases=""><maml:name>SessionName</maml:name><maml:description><maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter></command:syntaxItem><command:syntaxItem><maml:name>Get-NetEventPacketCaptureProvider</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>AssociatedEventSession</maml:name><maml:description><maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CimInstance</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter></command:syntaxItem><command:syntaxItem><maml:name>Get-NetEventPacketCaptureProvider</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>AssociatedCaptureTarget</maml:name><maml:description><maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CimInstance</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter></command:syntaxItem></command:syntax><command:parameters><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>AssociatedCaptureTarget</maml:name><maml:description><maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CimInstance</command:parameterValue><dev:type><maml:name>CimInstance</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>AssociatedEventSession</maml:name><maml:description><maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CimInstance</command:parameterValue><dev:type><maml:name>CimInstance</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue><dev:type><maml:name>CimSession[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases=""><maml:name>SessionName</maml:name><maml:description><maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue><dev:type><maml:name>String[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue><dev:type><maml:name>Int32</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter></command:parameters><command:inputTypes><command:inputType><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:inputType></command:inputTypes><command:returnValues><command:returnValue><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:returnValue></command:returnValues><command:terminatingErrors /><command:nonTerminatingErrors /><command:examples><command:example><maml:title>Example 1: Display a packet capture provider</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\>Get-NetEventPacketCaptureProvider -SessionName "Session01" </dev:code><dev:remarks><maml:para>This command displays a packet capture provider for a session named Session01</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example></command:examples><maml:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText><maml:uri>http://go.microsoft.com/fwlink/?LinkID=294388</maml:uri></maml:navigationLink><maml:navigationLink><maml:linkText>Add-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Remove-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Set-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventNetworkAdapter</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventVmNetworkAdapter</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventVmSwitch</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventSession</maml:linkText><maml:uri /></maml:navigationLink></maml:relatedLinks></command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"><command:details><command:name>Remove-NetEventPacketCaptureProvider</command:name><maml:description><maml:para>Removes the Remote Packet Capture provider and deletes the settings. </maml:para></maml:description><maml:copyright><maml:para /></maml:copyright><command:verb>Remove</command:verb><command:noun>NetEventPacketCaptureProvider</command:noun><dev:version /></command:details><maml:description><maml:para>The Remove-NetEventPacketCaptureProvider cmdlet removes a Remote Packet Capture provider and deletes the settings.</maml:para></maml:description><command:syntax><command:syntaxItem><maml:name>Remove-NetEventPacketCaptureProvider</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>PassThru</maml:name><maml:description><maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>InputObject</maml:name><maml:description><maml:para>Specifies the input to this cmdlet. You can use this parameter, or you can pipe the input to this cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimInstance[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description></command:parameter></command:syntaxItem><command:syntaxItem><maml:name>Remove-NetEventPacketCaptureProvider</maml:name><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases=""><maml:name>SessionName</maml:name><maml:description><maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>PassThru</maml:name><maml:description><maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description></command:parameter></command:syntaxItem></command:syntax><command:parameters><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue><dev:type><maml:name>CimSession[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>InputObject</maml:name><maml:description><maml:para>Specifies the input to this cmdlet. You can use this parameter, or you can pipe the input to this cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimInstance[]</command:parameterValue><dev:type><maml:name>CimInstance[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>PassThru</maml:name><maml:description><maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases=""><maml:name>SessionName</maml:name><maml:description><maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue><dev:type><maml:name>String[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue><dev:type><maml:name>Int32</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue>false</dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue>false</dev:defaultValue></command:parameter></command:parameters><command:inputTypes><command:inputType><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:inputType></command:inputTypes><command:returnValues><command:returnValue><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:returnValue></command:returnValues><command:terminatingErrors /><command:nonTerminatingErrors /><command:examples><command:example><maml:title>Example 1: Remove a packet capture provider</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\>Remove-NetEventPacketCaptureProvider -SessionName "Session01" </dev:code><dev:remarks><maml:para>This command removes a packet capture provider named Session01.</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example></command:examples><maml:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText><maml:uri>http://go.microsoft.com/fwlink/?LinkID=294396</maml:uri></maml:navigationLink><maml:navigationLink><maml:linkText>Add-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Set-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink></maml:relatedLinks></command:command> <command:command xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:command="http://schemas.microsoft.com/maml/dev/command/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10" xmlns:MSHelp="http://msdn.microsoft.com/mshelp"><command:details><command:name>Set-NetEventPacketCaptureProvider</command:name><maml:description><maml:para>Modifies the configuration for a Remote Packet Capture provider.</maml:para></maml:description><maml:copyright><maml:para /></maml:copyright><command:verb>Set</command:verb><command:noun>NetEventPacketCaptureProvider</command:noun><dev:version /></command:details><maml:description><maml:para>The Set-NetEventPacketCaptureProvider cmdlet modifies the configuration for a Remote Packet Capture provider.</maml:para></maml:description><command:syntax><command:syntaxItem><maml:name>Set-NetEventPacketCaptureProvider</maml:name><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases=""><maml:name>SessionName</maml:name><maml:description><maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases=""><maml:name>Level</maml:name><maml:description><maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para><maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Byte</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases=""><maml:name>MatchAnyKeyword</maml:name><maml:description><maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases=""><maml:name>MatchAllKeyword</maml:name><maml:description><maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases=""><maml:name>CaptureType</maml:name><maml:description><maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CaptureType</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases=""><maml:name>MultiLayer</maml:name><maml:description><maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Boolean</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases=""><maml:name>LinkLayerAddress</maml:name><maml:description><maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases=""><maml:name>EtherType</maml:name><maml:description><maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para></maml:description><command:parameterValue required="true" variableLength="true">UInt16[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases=""><maml:name>IpAddresses</maml:name><maml:description><maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases=""><maml:name>IpProtocols</maml:name><maml:description><maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">Byte[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases=""><maml:name>TruncationLength</maml:name><maml:description><maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt16</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases=""><maml:name>VmCaptureDirection</maml:name><maml:description><maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">VmCaptureDirection</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>PassThru</maml:name><maml:description><maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description></command:parameter></command:syntaxItem><command:syntaxItem><maml:name>Set-NetEventPacketCaptureProvider</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases=""><maml:name>Level</maml:name><maml:description><maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para><maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Byte</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases=""><maml:name>MatchAnyKeyword</maml:name><maml:description><maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases=""><maml:name>MatchAllKeyword</maml:name><maml:description><maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases=""><maml:name>CaptureType</maml:name><maml:description><maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CaptureType</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases=""><maml:name>MultiLayer</maml:name><maml:description><maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Boolean</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases=""><maml:name>LinkLayerAddress</maml:name><maml:description><maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases=""><maml:name>EtherType</maml:name><maml:description><maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para></maml:description><command:parameterValue required="true" variableLength="true">UInt16[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases=""><maml:name>IpAddresses</maml:name><maml:description><maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases=""><maml:name>IpProtocols</maml:name><maml:description><maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">Byte[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases=""><maml:name>TruncationLength</maml:name><maml:description><maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt16</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases=""><maml:name>VmCaptureDirection</maml:name><maml:description><maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">VmCaptureDirection</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>PassThru</maml:name><maml:description><maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>InputObject</maml:name><maml:description><maml:para>Specifies the input to this cmdlet. You can use this parameter, or you can pipe the input to this cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimInstance[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description></command:parameter></command:syntaxItem><command:syntaxItem><maml:name>Set-NetEventPacketCaptureProvider</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases=""><maml:name>Level</maml:name><maml:description><maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para><maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Byte</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases=""><maml:name>MatchAnyKeyword</maml:name><maml:description><maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases=""><maml:name>MatchAllKeyword</maml:name><maml:description><maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases=""><maml:name>CaptureType</maml:name><maml:description><maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CaptureType</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases=""><maml:name>MultiLayer</maml:name><maml:description><maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Boolean</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases=""><maml:name>LinkLayerAddress</maml:name><maml:description><maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases=""><maml:name>EtherType</maml:name><maml:description><maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para></maml:description><command:parameterValue required="true" variableLength="true">UInt16[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases=""><maml:name>IpAddresses</maml:name><maml:description><maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases=""><maml:name>IpProtocols</maml:name><maml:description><maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">Byte[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases=""><maml:name>TruncationLength</maml:name><maml:description><maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt16</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases=""><maml:name>VmCaptureDirection</maml:name><maml:description><maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">VmCaptureDirection</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>AssociatedEventSession</maml:name><maml:description><maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CimInstance</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>PassThru</maml:name><maml:description><maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description></command:parameter></command:syntaxItem><command:syntaxItem><maml:name>Set-NetEventPacketCaptureProvider</maml:name><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases=""><maml:name>Level</maml:name><maml:description><maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para><maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Byte</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases=""><maml:name>MatchAnyKeyword</maml:name><maml:description><maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases=""><maml:name>MatchAllKeyword</maml:name><maml:description><maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases=""><maml:name>CaptureType</maml:name><maml:description><maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CaptureType</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases=""><maml:name>MultiLayer</maml:name><maml:description><maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Boolean</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases=""><maml:name>LinkLayerAddress</maml:name><maml:description><maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases=""><maml:name>EtherType</maml:name><maml:description><maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para></maml:description><command:parameterValue required="true" variableLength="true">UInt16[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases=""><maml:name>IpAddresses</maml:name><maml:description><maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases=""><maml:name>IpProtocols</maml:name><maml:description><maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">Byte[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases=""><maml:name>TruncationLength</maml:name><maml:description><maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt16</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases=""><maml:name>VmCaptureDirection</maml:name><maml:description><maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">VmCaptureDirection</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>AssociatedCaptureTarget</maml:name><maml:description><maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CimInstance</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>PassThru</maml:name><maml:description><maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description></command:parameter></command:syntaxItem></command:syntax><command:parameters><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>AsJob</maml:name><maml:description><maml:para>Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete. The cmdlet immediately returns an object that represents the job and then displays the command prompt. You can continue to work in the session while the job completes. To manage the job, use the *-Job cmdlets. To get the job results, use the <maml:navigationLink><maml:linkText>Receive-Job</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. For more information about Windows PowerShell® background jobs, see <maml:navigationLink><maml:linkText>about_Jobs</maml:linkText><maml:uri></maml:uri></maml:navigationLink>.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>AssociatedCaptureTarget</maml:name><maml:description><maml:para>Specifies the associated capture target as a CIM object. The capture target is one of the three following objects: -- MSFT_NetEventNetworkAdapter -- MSFT_NetEventVmNetworkAdapter -- MSFT_NetEventVmSwitch To obtain a capture target, use the Get-NetEventNetworkAdapter cmdlet, the Get-NetEventVmNetworkAdapter cmdlet, or the Get-NetEventVmSwitch cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CimInstance</command:parameterValue><dev:type><maml:name>CimInstance</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>AssociatedEventSession</maml:name><maml:description><maml:para>Specifies the associated network event session, as a CIM object. To obtain the network event session, use the Get-NetEventSession cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CimInstance</command:parameterValue><dev:type><maml:name>CimInstance</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4008" aliases=""><maml:name>CaptureType</maml:name><maml:description><maml:para>Specifies the capture type. Acceptable values for this parameter are: -- SaveToFile. Writes events to a local .etl file. -- RealtimeRPC. Creates a real-time capture session and forwards the events to a remote host as they are recorded. -- RealtimeLocal. Creates a real-time capture session and forwards the events to a local Event Tracing for Windows (ETW) listener as they are recorded.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">CaptureType</command:parameterValue><dev:type><maml:name>CaptureType</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named" aliases="Session"><maml:name>CimSession</maml:name><maml:description><maml:para>Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a <maml:navigationLink><maml:linkText>New-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> or <maml:navigationLink><maml:linkText>Get-CimSession</maml:linkText><maml:uri></maml:uri></maml:navigationLink> cmdlet. The default is the current session on the local computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimSession[]</command:parameterValue><dev:type><maml:name>CimSession[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4011" aliases=""><maml:name>EtherType</maml:name><maml:description><maml:para>Specifies an array of ether types. The most common ether types and their values are IPv4 (0800), IPv6 (86DD) and ARP (0806).</maml:para></maml:description><command:parameterValue required="true" variableLength="true">UInt16[]</command:parameterValue><dev:type><maml:name>UInt16[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="true" variableLength="true" globbing="false" pipelineInput="True (ByValue)" position="named" aliases=""><maml:name>InputObject</maml:name><maml:description><maml:para>Specifies the input to this cmdlet. You can use this parameter, or you can pipe the input to this cmdlet.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">CimInstance[]</command:parameterValue><dev:type><maml:name>CimInstance[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4012" aliases=""><maml:name>IpAddresses</maml:name><maml:description><maml:para>Specifies an array of IP addresses on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue><dev:type><maml:name>String[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4013" aliases=""><maml:name>IpProtocols</maml:name><maml:description><maml:para>Specifies an array of one or more IP protocols, such as TCP or UDP, on which to filter. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">Byte[]</command:parameterValue><dev:type><maml:name>Byte[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4005" aliases=""><maml:name>Level</maml:name><maml:description><maml:para>Specifies the level of Event Tracing for Windows (ETW) events for the provider. Use the level of detail for the event to filter the events that are logged. The default value for this parameter is 0x4. Acceptable values for this parameter are: -- 0x5. Verbose -- 0x4. Informational -- 0x3. Warning -- 0x2. Error -- 0x1. Critical -- 0x0. LogAlways </maml:para><maml:para>The provider must log the event if the value of the event is less than or equal to the value of this parameter.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Byte</command:parameterValue><dev:type><maml:name>Byte</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="4010" aliases=""><maml:name>LinkLayerAddress</maml:name><maml:description><maml:para>Specifies an array of link layer, or Media Access Control (MAC), addresses. The packet capture provider logs network traffic that matches this filter.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue><dev:type><maml:name>String[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4007" aliases=""><maml:name>MatchAllKeyword</maml:name><maml:description><maml:para>Specifies a bitmask that restricts the events that the provider logs.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue><dev:type><maml:name>UInt64</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4006" aliases=""><maml:name>MatchAnyKeyword</maml:name><maml:description><maml:para>Specifies keywords as a set of hexadecimal values. Keywords are flags that you can combine to generate values. Use a set of hexadecimal values of the keywords instead of the keyword names, and apply a filter to write ETW events for keyword matches. </maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt64</command:parameterValue><dev:type><maml:name>UInt64</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4009" aliases=""><maml:name>MultiLayer</maml:name><maml:description><maml:para>Indicates whether the capture should occur at various layers in the stack. This setting has a value of $False by default.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Boolean</command:parameterValue><dev:type><maml:name>Boolean</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>PassThru</maml:name><maml:description><maml:para>Returns an object representing the item with which you are working. By default, this cmdlet does not generate any output.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="True (ByPropertyName)" position="1" aliases=""><maml:name>SessionName</maml:name><maml:description><maml:para>Specifies the name of the session associated with the packet capture provider.</maml:para></maml:description><command:parameterValue required="true" variableLength="true">String[]</command:parameterValue><dev:type><maml:name>String[]</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="named" aliases=""><maml:name>ThrottleLimit</maml:name><maml:description><maml:para>Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">Int32</command:parameterValue><dev:type><maml:name>Int32</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4014" aliases=""><maml:name>TruncationLength</maml:name><maml:description><maml:para>Specifies the display length of each captured packet. The default size is 128 bytes.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">UInt16</command:parameterValue><dev:type><maml:name>UInt16</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="false" globbing="false" pipelineInput="false" position="4015" aliases=""><maml:name>VmCaptureDirection</maml:name><maml:description><maml:para>Specifies the direction of network traffic for a Virtual Machine (VM) capture. The acceptable values for this parameter are: -- Ingress. Network traffic from a VM to a virtual switch. -- Egress. Network traffic from a virtual switch to a VM.</maml:para></maml:description><command:parameterValue required="true" variableLength="false">VmCaptureDirection</command:parameterValue><dev:type><maml:name>VmCaptureDirection</maml:name><maml:uri /></dev:type><dev:defaultValue></dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>Confirm</maml:name><maml:description><maml:para>Prompts you for confirmation before running the cmdlet.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue>false</dev:defaultValue></command:parameter><command:parameter required="false" variableLength="true" globbing="false" pipelineInput="false" position="named"><maml:name>WhatIf</maml:name><maml:description><maml:para>Shows what would happen if the cmdlet runs. The cmdlet is not run.</maml:para></maml:description><command:parameterValue required="false" variableLength="false">SwitchParameter</command:parameterValue><dev:type><maml:name>SwitchParameter</maml:name><maml:uri /></dev:type><dev:defaultValue>false</dev:defaultValue></command:parameter></command:parameters><command:inputTypes><command:inputType><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:inputType></command:inputTypes><command:returnValues><command:returnValue><dev:type><maml:name></maml:name><maml:uri></maml:uri><maml:description><maml:para /></maml:description></dev:type><maml:description></maml:description></command:returnValue></command:returnValues><command:terminatingErrors /><command:nonTerminatingErrors /><command:examples><command:example><maml:title>Example 1: Modify a packet capture provider</maml:title><maml:introduction><maml:para></maml:para></maml:introduction><dev:code>PS C:\>New-NetEventSession -SessionName "Session01" PS C:\> Add-NetEventProvider -Name "Microsoft-Windows-TCPIP" -SessionName "Session01" PS C:\> Add-NetEventPacketCaptureProvider -SessionName "Session01" PS C:\> Set-NetEventPacketCaptureProvider -SessionName "Session01" -IpAddresses 182.168.0.1 -IpProtocol 6 </dev:code><dev:code>PS C:\> </dev:code><dev:code>PS C:\> </dev:code><dev:code>PS C:\> </dev:code><dev:remarks><maml:para>This example modifies a packet capture provider.</maml:para><maml:para>The first command uses the New-NetEventSession cmdlet to create a new session named Session01.</maml:para><maml:para>The second command uses the Add-NetEventProvider cmdlet to add a TCP/IP Net provider to the session.</maml:para><maml:para>The third command uses the Add-NetEventPacketCaptureProvider cmdlet to add a packet capture provider to a session named Session01.</maml:para><maml:para>The fourth command modifies the packet capture provider settings.</maml:para></dev:remarks><command:commandLines><command:commandLine><command:commandText /></command:commandLine></command:commandLines></command:example></command:examples><maml:relatedLinks><maml:navigationLink><maml:linkText>Online Version:</maml:linkText><maml:uri>http://go.microsoft.com/fwlink/?LinkID=294402</maml:uri></maml:navigationLink><maml:navigationLink><maml:linkText>Add-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Add-NetEventProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>New-NetEventSession</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Remove-NetEventPacketCaptureProvider</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventNetworkAdapter</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventVmNetworkAdapter</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventVmSwitch</maml:linkText><maml:uri /></maml:navigationLink><maml:navigationLink><maml:linkText>Get-NetEventSession</maml:linkText><maml:uri /></maml:navigationLink></maml:relatedLinks></command:command> </helpItems> |