diff options
Diffstat (limited to 'doc/primary-expression.txt')
-rw-r--r-- | doc/primary-expression.txt | 27 |
1 files changed, 25 insertions, 2 deletions
diff --git a/doc/primary-expression.txt b/doc/primary-expression.txt index fc17a02c..c5d25eee 100644 --- a/doc/primary-expression.txt +++ b/doc/primary-expression.txt @@ -2,7 +2,7 @@ META EXPRESSIONS ~~~~~~~~~~~~~~~~ [verse] *meta* {*length* | *nfproto* | *l4proto* | *protocol* | *priority*} -[*meta*] {*mark* | *iif* | *iifname* | *iiftype* | *oif* | *oifname* | *oiftype* | *skuid* | *skgid* | *nftrace* | *rtclassid* | *ibrname* | *obrname* | *pkttype* | *cpu* | *iifgroup* | *oifgroup* | *cgroup* | *random* | *ipsec* | *iifkind* | *oifkind*} +[*meta*] {*mark* | *iif* | *iifname* | *iiftype* | *oif* | *oifname* | *oiftype* | *skuid* | *skgid* | *nftrace* | *rtclassid* | *ibrname* | *obrname* | *pkttype* | *cpu* | *iifgroup* | *oifgroup* | *cgroup* | *random* | *ipsec* | *iifkind* | *oifkind* | *time* | *hour* | *day* } A meta expression refers to meta data associated with a packet. @@ -115,7 +115,16 @@ boolean (1 bit) |iifkind| Input interface kind | |oifkind| -Output interface kind +Output interface kind| +|time| +Absolute time of packet reception| +Integer (32 bit) or string +|day| +Day of week| +Integer (8 bit) or string +|hour| +Hour of day| +String |==================== .Meta expression specific types @@ -141,6 +150,20 @@ Packet type: *host* (addressed to local host), *broadcast* (to all), *multicast* (to group), *other* (addressed to another host). |ifkind| Interface kind (16 byte string). Does not have to exist. +|time| +Either an integer or a date in ISO format. For example: "2019-06-06 17:00". +Hour and seconds are optional and can be omitted if desired. If omitted, +midnight will be assumed. +The following three would be equivalent: "2019-06-06", "2019-06-06 00:00" +and "2019-06-06 00:00:00". +When an integer is given, it is assumed to be a UNIX timestamp. +|day| +Either a day of week ("Monday", "Tuesday", etc.), or an integer between 0 and 6. +Strings are matched case-insensitively, and a full match is not expected (e.g. "Mon" would match "Monday"). +When an integer is given, 0 is Sunday and 6 is Saturday. +|hour| +A string representing an hour in 24-hour format. Seconds can optionally be specified. +For example, 17:00 and 17:00:00 would be equivalent. |============================= .Using meta expressions |