• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1This matches if the packet arrival time/date is within a given range. All
2options are optional, but are ANDed when specified. All times are interpreted
3as UTC by default.
4.TP
5\fB\-\-datestart\fP \fIYYYY\fP[\fB\-\fP\fIMM\fP[\fB\-\fP\fIDD\fP[\fBT\fP\fIhh\fP[\fB:\fP\fImm\fP[\fB:\fP\fIss\fP]]]]]
6.TP
7\fB\-\-datestop\fP \fIYYYY\fP[\fB\-\fP\fIMM\fP[\fB\-\fP\fIDD\fP[\fBT\fP\fIhh\fP[\fB:\fP\fImm\fP[\fB:\fP\fIss\fP]]]]]
8Only match during the given time, which must be in ISO 8601 "T" notation.
9The possible time range is 1970-01-01T00:00:00 to 2038-01-19T04:17:07.
10.IP
11If \-\-datestart or \-\-datestop are not specified, it will default to 1970-01-01
12and 2038-01-19, respectively.
13.TP
14\fB\-\-timestart\fP \fIhh\fP\fB:\fP\fImm\fP[\fB:\fP\fIss\fP]
15.TP
16\fB\-\-timestop\fP \fIhh\fP\fB:\fP\fImm\fP[\fB:\fP\fIss\fP]
17Only match during the given daytime. The possible time range is 00:00:00 to
1823:59:59. Leading zeroes are allowed (e.g. "06:03") and correctly interpreted
19as base-10.
20.TP
21[\fB!\fP] \fB\-\-monthdays\fP \fIday\fP[\fB,\fP\fIday\fP...]
22Only match on the given days of the month. Possible values are \fB1\fP
23to \fB31\fP. Note that specifying \fB31\fP will of course not match
24on months which do not have a 31st day; the same goes for 28- or 29-day
25February.
26.TP
27[\fB!\fP] \fB\-\-weekdays\fP \fIday\fP[\fB,\fP\fIday\fP...]
28Only match on the given weekdays. Possible values are \fBMon\fP, \fBTue\fP,
29\fBWed\fP, \fBThu\fP, \fBFri\fP, \fBSat\fP, \fBSun\fP, or values from \fB1\fP
30to \fB7\fP, respectively. You may also use two-character variants (\fBMo\fP,
31\fBTu\fP, etc.).
32.TP
33\fB\-\-kerneltz\fP
34Use the kernel timezone instead of UTC to determine whether a packet meets the
35time regulations.
36.PP
37About kernel timezones: Linux keeps the system time in UTC, and always does so.
38On boot, system time is initialized from a referential time source. Where this
39time source has no timezone information, such as the x86 CMOS RTC, UTC will be
40assumed. If the time source is however not in UTC, userspace should provide the
41correct system time and timezone to the kernel once it has the information.
42.PP
43Local time is a feature on top of the (timezone independent) system time. Each
44process has its own idea of local time, specified via the TZ environment
45variable. The kernel also has its own timezone offset variable. The TZ
46userspace environment variable specifies how the UTC-based system time is
47displayed, e.g. when you run date(1), or what you see on your desktop clock.
48The TZ string may resolve to different offsets at different dates, which is
49what enables the automatic time-jumping in userspace. when DST changes. The
50kernel's timezone offset variable is used when it has to convert between
51non-UTC sources, such as FAT filesystems, to UTC (since the latter is what the
52rest of the system uses).
53.PP
54The caveat with the kernel timezone is that Linux distributions may ignore to
55set the kernel timezone, and instead only set the system time. Even if a
56particular distribution does set the timezone at boot, it is usually does not
57keep the kernel timezone offset - which is what changes on DST - up to date.
58ntpd will not touch the kernel timezone, so running it will not resolve the
59issue. As such, one may encounter a timezone that is always +0000, or one that
60is wrong half of the time of the year. As such, \fBusing \-\-kerneltz is highly
61discouraged.\fP
62.PP
63EXAMPLES. To match on weekends, use:
64.IP
65\-m time \-\-weekdays Sa,Su
66.PP
67Or, to match (once) on a national holiday block:
68.IP
69\-m time \-\-datestart 2007\-12\-24 \-\-datestop 2007\-12\-27
70.PP
71Since the stop time is actually inclusive, you would need the following stop
72time to not match the first second of the new day:
73.IP
74\-m time \-\-datestart 2007\-01\-01T17:00 \-\-datestop 2007\-01\-01T23:59:59
75.PP
76During lunch hour:
77.IP
78\-m time \-\-timestart 12:30 \-\-timestop 13:30
79.PP
80The fourth Friday in the month:
81.IP
82\-m time \-\-weekdays Fr \-\-monthdays 22,23,24,25,26,27,28
83.PP
84(Note that this exploits a certain mathematical property. It is not possible to
85say "fourth Thursday OR fourth Friday" in one rule. It is possible with
86multiple rules, though.)
87