5.1.4
by Soren Hansen
Import upstream version 1.4.0 |
1 |
This matches if the packet arrival time/date is within a given range. All |
2 |
options are optional, but are ANDed when specified. |
|
3 |
.TP
|
|
4 |
\fB--datestart\fR \fIYYYY\fR[\fB-\fR\fIMM\fR[\fB-\fR\fIDD\fR[\fBT\fR\fIhh\fR[\fB:\fR\fImm\fR[\fB:\fR\fIss\fR]]]]] |
|
5 |
.TP
|
|
6 |
\fB--datestop\fR \fIYYYY\fR[\fB-\fR\fIMM\fR[\fB-\fR\fIDD\fR[\fBT\fR\fIhh\fR[\fB:\fR\fImm\fR[\fB:\fR\fIss\fR]]]]] |
|
7 |
.IP
|
|
8 |
Only match during the given time, which must be in ISO 8601 "T" notation. |
|
9 |
The possible time range is 1970-01-01T00:00:00 to 2038-01-19T04:17:07. |
|
10 |
.IP
|
|
11 |
If --datestart or --datestop are not specified, it will default to 1970-01-01 |
|
12 |
and 2038-01-19, respectively. |
|
13 |
.TP
|
|
14 |
\fB--timestart\fR \fIhh\fR\fB:\fR\fImm\fR[\fB:\fR\fIss\fR] |
|
15 |
.TP
|
|
16 |
\fB--timestop\fR \fIhh\fR\fB:\fR\fImm\fR[\fB:\fR\fIss\fR] |
|
17 |
.IP
|
|
18 |
Only match during the given daytime. The possible time range is 00:00:00 to |
|
19 |
23:59:59. Leading zeroes are allowed (e.g. "06:03") and correctly interpreted |
|
20 |
as base-10. |
|
21 |
.TP
|
|
22 |
[\fB!\fR] \fB--monthday\fR \fIday\fR[\fB,\fR\fIday\fR...] |
|
23 |
.IP
|
|
24 |
Only match on the given days of the month. Possible values are \fB1\fR |
|
25 |
to \fB31\fR. Note that specifying \fB31\fR will of course not match |
|
26 |
on months which do not have a 31st day; the same goes for 28- or 29-day |
|
27 |
February. |
|
28 |
.TP
|
|
29 |
[\fB!\fR] \fB--weekdays\fR \fIday\fR[\fB,\fR\fIday\fR...] |
|
30 |
.IP
|
|
31 |
Only match on the given weekdays. Possible values are \fBMon\fR, \fBTue\fR, |
|
32 |
\fBWed\fR, \fBThu\fR, \fBFri\fR, \fBSat\fR, \fBSun\fR, or values from \fB1\fR |
|
33 |
to \fB7\fR, respectively. You may also use two-character variants (\fBMo\fR, |
|
34 |
\fBTu\fR, etc.). |
|
35 |
.TP
|
|
36 |
\fB--utc\fR |
|
37 |
.IP
|
|
38 |
Interpret the times given for \fB--datestart\fR, \fB--datestop\fR, |
|
39 |
\fB--timestart\fR and \fB--timestop\fR to be UTC. |
|
40 |
.TP
|
|
41 |
\fB--localtz\fR |
|
42 |
.IP
|
|
43 |
Interpret the times given for \fB--datestart\fR, \fB--datestop\fR, |
|
44 |
\fB--timestart\fR and \fB--timestop\fR to be local kernel time. (Default) |
|
45 |
.PP
|
|
46 |
EXAMPLES. To match on weekends, use: |
|
47 |
.IP
|
|
48 |
-m time --weekdays Sa,Su |
|
49 |
.PP
|
|
50 |
Or, to match (once) on a national holiday block: |
|
51 |
.IP
|
|
52 |
-m time --datestart 2007-12-24 --datestop 2007-12-27 |
|
53 |
.PP
|
|
54 |
Since the stop time is actually inclusive, you would need the following stop |
|
55 |
time to not match the first second of the new day: |
|
56 |
.IP
|
|
57 |
-m time --datestart 2007-01-01T17:00 --datestop 2007-01-01T23:59:59 |
|
58 |
.PP
|
|
59 |
During lunch hour: |
|
60 |
.IP
|
|
61 |
-m time --timestart 12:30 --timestop 13:30 |
|
62 |
.PP
|
|
63 |
The fourth Friday in the month: |
|
64 |
.IP
|
|
65 |
-m time --weekdays Fr --monthdays 22,23,24,25,26,27,28 |
|
66 |
.PP
|
|
67 |
(Note that this exploits a certain mathematical property. It is not possible to |
|
68 |
say "fourth Thursday OR fourth Friday" in one rule. It is possible with |
|
69 |
multiple rules, though.) |