New-AzNetworkWatcherPacketCapture

Module:

Az.Network

Creates a new packet capture resource and starts a packet capture session on a VM.

Syntax

New-AzNetworkWatcherPacketCapture
   -NetworkWatcher <PSNetworkWatcher>
   -PacketCaptureName <String>
   -TargetVirtualMachineId <String>
   [-StorageAccountId <String>]
   [-StoragePath <String>]
   [-LocalFilePath <String>]
   [-BytesToCapturePerPacket <Int32>]
   [-TotalBytesPerSession <UInt32>]
   [-TimeLimitInSeconds <Int32>]
   [-Filter <PSPacketCaptureFilter[]>]
   [-AsJob]
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

New-AzNetworkWatcherPacketCapture
   -NetworkWatcherName <String>
   -ResourceGroupName <String>
   -PacketCaptureName <String>
   -TargetVirtualMachineId <String>
   [-StorageAccountId <String>]
   [-StoragePath <String>]
   [-LocalFilePath <String>]
   [-BytesToCapturePerPacket <Int32>]
   [-TotalBytesPerSession <UInt32>]
   [-TimeLimitInSeconds <Int32>]
   [-Filter <PSPacketCaptureFilter[]>]
   [-AsJob]
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

New-AzNetworkWatcherPacketCapture
   -Location <String>
   -PacketCaptureName <String>
   -TargetVirtualMachineId <String>
   [-StorageAccountId <String>]
   [-StoragePath <String>]
   [-LocalFilePath <String>]
   [-BytesToCapturePerPacket <Int32>]
   [-TotalBytesPerSession <UInt32>]
   [-TimeLimitInSeconds <Int32>]
   [-Filter <PSPacketCaptureFilter[]>]
   [-AsJob]
   [-DefaultProfile <IAzureContextContainer>]
   [-WhatIf]
   [-Confirm]
   [<CommonParameters>]

Description

The New-AzNetworkWatcherPacketCapture cmdlet creates a new packet capture resource and starts a packet capture session on a VM. The length of the Packet Capture sessions can be configured via a time constraint or a size constraint. The amount of data captured for each packet can also be configured. Filters can be applied to a given packet capture session, allowing you to customize the type of packets captured. Filters can restrict packets on local and remote IP addresses & address ranges, local and remote ports & port ranges, and the session level protocol to be captured. Filters are composable, and multiple filters can be applied to provide you with granularity of capture.

Examples

Example 1: Create a Packet Capture with multiple filters

$nw = Get-AzResource | Where-Object {$_.ResourceType -eq "Microsoft.Network/networkWatchers" -and $_.Location -eq "WestCentralUS" } 
$networkWatcher = Get-AzNetworkWatcher -Name $nw.Name -ResourceGroupName $nw.ResourceGroupName 

$storageAccount = Get-AzStorageAccount -ResourceGroupName contosoResourceGroup -Name contosostorage123

$filter1 = New-AzPacketCaptureFilterConfig -Protocol TCP -RemoteIPAddress "1.1.1.1-255.255.255" -LocalIPAddress "10.0.0.3" -LocalPort "1-65535" -RemotePort "20;80;443"
$filter2 = New-AzPacketCaptureFilterConfig -Protocol UDP 
New-AzNetworkWatcherPacketCapture -NetworkWatcher $networkWatcher -TargetVirtualMachineId $vm.Id -PacketCaptureName "PacketCaptureTest" -StorageAccountId $storageAccount.id -TimeLimitInSeconds 60 -Filter $filter1, $filter2

In this example we create a packet capture named "PacketCaptureTest" with multiple filters and a time limit. Once the session is complete, it will be saved to the specified storage account. Note: The Azure Network Watcher extension must be installed on the target virtual machine to create packet captures.

Parameters

-AsJob

Run cmdlet in the background

Type:	SwitchParameter
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-BytesToCapturePerPacket

Bytes to capture per packet.

Type:	Nullable<T>[Int32]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type:	SwitchParameter
Aliases:	cf
Position:	Named
Default value:	False
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with azure.

Type:	IAzureContextContainer
Aliases:	AzContext, AzureRmContext, AzureCredential
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Filter

Filters for packet capture session.

Type:	PSPacketCaptureFilter[]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-LocalFilePath

Local file path.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-Location

Location of the network watcher.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	False
Accept wildcard characters:	False

-NetworkWatcher

The network watcher resource.

Type:	PSNetworkWatcher
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-NetworkWatcherName

The name of network watcher.

Type:	String
Aliases:	Name
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-PacketCaptureName

The packet capture name.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-ResourceGroupName

The name of the network watcher resource group.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-StorageAccountId

Storage account Id.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-StoragePath

Storage path.

Type:	String
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-TargetVirtualMachineId

The target virtual machine ID.

Type:	String
Position:	Named
Default value:	None
Required:	True
Accept pipeline input:	True
Accept wildcard characters:	False

-TimeLimitInSeconds

Time limit in seconds.

Type:	Nullable<T>[Int32]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-TotalBytesPerSession

Total bytes per session.

Type:	Nullable<T>[UInt32]
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	True
Accept wildcard characters:	False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type:	SwitchParameter
Aliases:	wi
Position:	Named
Default value:	False
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

Inputs

PSNetworkWatcher

String

Nullable<T>[[System.Int32, System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]]

Outputs

PSPacketCaptureResult

Notes

Keywords: azure, azurerm, arm, resource, management, manager, network, networking, network watcher, packet, capture, traffic

Related Links

• New-AzNetworkWatcher
• Get-AzNetworkWatcher
• Remove-AzNetworkWatcher
• Get-AzNetworkWatcherNextHop
• Get-AzNetworkWatcherSecurityGroupView
• Get-AzNetworkWatcherTopology
• Start-AzNetworkWatcherResourceTroubleshooting
• New-AzNetworkWatcherPacketCapture
• New-AzPacketCaptureFilterConfig
• Get-AzNetworkWatcherPacketCapture
• Remove-AzNetworkWatcherPacketCapture
• Stop-AzNetworkWatcherPacketCapture
• New-AzNetworkWatcherProtocolConfiguration
• Test-AzNetworkWatcherIPFlow
• Test-AzNetworkWatcherConnectivity
• Stop-AzNetworkWatcherConnectionMonitor
• Start-AzNetworkWatcherConnectionMonitor
• Set-AzNetworkWatcherConnectionMonitor
• Set-AzNetworkWatcherConfigFlowLog
• Remove-AzNetworkWatcherConnectionMonitor
• New-AzNetworkWatcherConnectionMonitor
• Get-AzNetworkWatcherTroubleshootingResult
• Get-AzNetworkWatcherReachabilityReport
• Get-AzNetworkWatcherReachabilityProvidersList
• Get-AzNetworkWatcherFlowLogStatus
• Get-AzNetworkWatcherConnectionMonitorReport
• Get-AzNetworkWatcherConnectionMonitor