| lh | 9ed821d | 2023-04-07 01:36:19 -0700 | [diff] [blame] | 1 | This matches if the packet arrival time/date is within a given range. All |
| 2 | options are optional, but are ANDed when specified. |
| 3 | .TP |
| 4 | \fB\-\-datestart\fP \fIYYYY\fP[\fB\-\fP\fIMM\fP[\fB\-\fP\fIDD\fP[\fBT\fP\fIhh\fP[\fB:\fP\fImm\fP[\fB:\fP\fIss\fP]]]]] |
| 5 | .TP |
| 6 | \fB\-\-datestop\fP \fIYYYY\fP[\fB\-\fP\fIMM\fP[\fB\-\fP\fIDD\fP[\fBT\fP\fIhh\fP[\fB:\fP\fImm\fP[\fB:\fP\fIss\fP]]]]] |
| 7 | .IP |
| 8 | Only match during the given time, which must be in ISO 8601 "T" notation. |
| 9 | The possible time range is 1970-01-01T00:00:00 to 2038-01-19T04:17:07. |
| 10 | .IP |
| 11 | If \-\-datestart or \-\-datestop are not specified, it will default to 1970-01-01 |
| 12 | and 2038-01-19, respectively. |
| 13 | .TP |
| 14 | \fB\-\-timestart\fP \fIhh\fP\fB:\fP\fImm\fP[\fB:\fP\fIss\fP] |
| 15 | .TP |
| 16 | \fB\-\-timestop\fP \fIhh\fP\fB:\fP\fImm\fP[\fB:\fP\fIss\fP] |
| 17 | .IP |
| 18 | Only match during the given daytime. The possible time range is 00:00:00 to |
| 19 | 23:59:59. Leading zeroes are allowed (e.g. "06:03") and correctly interpreted |
| 20 | as base-10. |
| 21 | .TP |
| 22 | [\fB!\fR] \fB\-\-monthdays\fP \fIday\fP[\fB,\fP\fIday\fP...] |
| 23 | .IP |
| 24 | Only match on the given days of the month. Possible values are \fB1\fR |
| 25 | to \fB31\fR. Note that specifying \fB31\fR will of course not match |
| 26 | on months which do not have a 31st day; the same goes for 28- or 29-day |
| 27 | February. |
| 28 | .TP |
| 29 | [\fB!\fR] \fB\-\-weekdays\fP \fIday\fP[\fB,\fP\fIday\fP...] |
| 30 | .IP |
| 31 | Only match on the given weekdays. Possible values are \fBMon\fR, \fBTue\fR, |
| 32 | \fBWed\fR, \fBThu\fR, \fBFri\fR, \fBSat\fR, \fBSun\fR, or values from \fB1\fR |
| 33 | to \fB7\fR, respectively. You may also use two-character variants (\fBMo\fP, |
| 34 | \fBTu\fR, etc.). |
| 35 | .TP |
| 36 | \fB\-\-utc\fP |
| 37 | .IP |
| 38 | Interpret the times given for \fB\-\-datestart\fP, \fB\-\-datestop\fP, |
| 39 | \fB\-\-timestart\fP and \fB\-\-timestop\fP to be UTC. |
| 40 | .TP |
| 41 | \fB\-\-localtz\fP |
| 42 | .IP |
| 43 | Interpret the times given for \fB\-\-datestart\fP, \fB\-\-datestop\fP, |
| 44 | \fB\-\-timestart\fP and \fB\-\-timestop\fP to be local kernel time. (Default) |
| 45 | .PP |
| 46 | EXAMPLES. To match on weekends, use: |
| 47 | .IP |
| 48 | \-m time \-\-weekdays Sa,Su |
| 49 | .PP |
| 50 | Or, to match (once) on a national holiday block: |
| 51 | .IP |
| 52 | \-m time \-\-datestart 2007\-12\-24 \-\-datestop 2007\-12\-27 |
| 53 | .PP |
| 54 | Since the stop time is actually inclusive, you would need the following stop |
| 55 | time to not match the first second of the new day: |
| 56 | .IP |
| 57 | \-m time \-\-datestart 2007\-01\-01T17:00 \-\-datestop 2007\-01\-01T23:59:59 |
| 58 | .PP |
| 59 | During lunch hour: |
| 60 | .IP |
| 61 | \-m time \-\-timestart 12:30 \-\-timestop 13:30 |
| 62 | .PP |
| 63 | The fourth Friday in the month: |
| 64 | .IP |
| 65 | \-m time \-\-weekdays Fr \-\-monthdays 22,23,24,25,26,27,28 |
| 66 | .PP |
| 67 | (Note that this exploits a certain mathematical property. It is not possible to |
| 68 | say "fourth Thursday OR fourth Friday" in one rule. It is possible with |
| 69 | multiple rules, though.) |