next up previous contents index
Next: Port Type Up: Values, Types, and Constants Previous: Patterns   Contents   Index

Subsections


Temporal Types

Bro supports types representing absolute and relative times with the time and interval types, respectively.


Temporal Constants

There is currently no way to specify an absolute time as a constant (though see the current_time and network_time functions in § ). You can specify interval constants, however, by appending a time unit after a numeric constant. For example,

    3.5 min
denotes 210 seconds. The different time units are usec, sec, min, hr, and day, representing microseconds, seconds, minutes, hours, and days, respectively. The whitespace between the numeric constant and the unit is optional, and the letter ``s'' may be added to pluralize the unit (this has no semantic effect). So the above example could also be written:
    3.5mins
or
    150 secs


Temporal Operators

You can apply arithmetic and relational operators to temporal values, as follows.


Temporal Negation

The unary - operator can be applied to an interval value to yield another interval value. For example,

    - 12 hr
represents ``twelve hours in the past.''


Temporal Addition

Adding two interval values yields another interval value. For example,

    5 sec + 2 min
yields 125 seconds. Adding a time value to an interval yields another time value.


Temporal Subtraction

Subtracting a time value from another time value yields an interval value, as does subtracting an interval value from another interval, while subtracting an interval from a time yields a time.


Temporal Multiplication

You can multiply an interval value by a numeric value to yield another interval value. For example,

   5 min * 6.5
yields 1,950 seconds. time values cannot be scaled by multiplication or division.


Temporal Division

You can also divide an interval value by a numeric value to yield another interval value. For example,

   5 min / 2
yields 150 seconds. Furthermore, you can divide one interval value by another to yield a double. For example,
   5 min / 30 sec
yields 10.


Temporal Relationals

You may compare two time values or two interval values for equality, and also for ordering, where times or intervals further in the future are considered larger than times or intervals nearer in the future, or in the past.


next up previous contents index
Next: Port Type Up: Values, Types, and Constants Previous: Patterns   Contents   Index
Vern Paxson 2002-11-17