TimeFilter Element Documentation
- NAME
- SYNOPSIS
- DESCRIPTION
- ELEMENT HANDLERS
- SEE ALSO
- COMMENTS

This is automatically generated documentation. Edit after the "COMMENTS" heading; changes to the main body will be lost.

TimeFilter Element Documentation

NAME

TimeFilter -- Click element; filter packets by timestamp

SYNOPSIS

TimeFilter(keywords START, START_AFTER, START_DELAY, END, END_AFTER, END_DELAY, INTERVAL, STOP, END_CALL)

Ports: 1 input, 1-2 outputs
Processing: agnostic, but output 1 is push
Package: analysis (core)

DESCRIPTION

TimeFilter passes packets through only if they lie within a timestamp range. You can specify that range absolutely or relative to the first timestamp TimeFilter sees. Keyword arguments are:

START: T is absolute time in seconds since the epoch. Output packets with timestamps at least T.

START_AFTER: T is relative time in seconds (or use suffixes like `ms', `hr'). Output packets with timestamps at least T seconds after the first packet seen.

START_DELAY: T is relative time. Output packets with timestamps at least T seconds after initialize time.

END: T is absolute time. Output packets with timestamps up to T.

END_AFTER: T is relative time. Output packets with timestamps up to T seconds after the first packet seen.

END_DELAY: T is relative time. Output packets with timestamps up to T seconds after initialize time.

INTERVAL: T is relative time. Output packets for T seconds after the start time, as specified by START or START_AFTER.

STOP: Boolean. If true, stop the driver once the end time is exceeded. Default is false.

END_CALL: Specifies a write handler to call when the first packet after END is seen. The variable "$t" in the write handler argument is expanded to the packet's timestamp. STOP and END_CALL are mutually exclusive. Supply at most one of START, START_AFTER, and START_DELAY, and at most one of END, END_AFTER, END_DELAY, and INTERVAL.

ELEMENT HANDLERS

start (read/write): Returns or sets the START time. If you used START_AFTER or START_DELAY, then this handler returns garbage until a packet has passed.

end (read/write): Returns or sets the END time. If you used START_AFTER or START_DELAY, then this handler returns garbage until a packet has passed.

interval (read/write): Returns or sets the INTERVAL. Setting INTERVAL leaves the current START as is and adjusts END.

extend_interval (write-only): Takes a timestamp. Extends the LAST time by that amount. If extend_interval is called from an END_CALL handler, then the triggering packet is not dropped.

COMMENTS