Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

answered 2024-11-30 15:26:13 +0000

Chuckc gravatar image 
    { &hf_cp56time,
         { "CP56Time", "iec60870_asdu.cp56time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0,
            NULL, HFILL }},

See wsutil/nstime.c#L304 comments on "ISO 8601". Time string format defined in rfc3339.

For sample capture IEC104_All.pcap attached to issue 8849: Buggy IEC104 dissector caused by commit r48958:

iec60870_asdu.cp56time > "2013-07-04T08:23" && iec60870_asdu.cp56time < "2013-07-04T08:24

    { &hf_cp56time,
         { "CP56Time", "iec60870_asdu.cp56time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0,
            NULL, HFILL }},

See wsutil/nstime.c#L304 comments on "ISO 8601". Time string format defined in rfc3339.

For sample capture IEC104_All.pcap attached to issue 8849: Buggy IEC104 dissector caused by commit r48958:

iec60870_asdu.cp56time > "2013-07-04T08:23" && iec60870_asdu.cp56time < "2013-07-04T08:24"2013-07-04T08:24"

The filter in the question could be written as:
(iec60870_asdu.cp56time < "2024-12-01T12:34") && (iec60870_asdu.cp56time > "2024-12-01T12:30")

 { &hf_cp56time,
 { "CP56Time", "iec60870_asdu.cp56time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0,
            NULL, HFILL }},

See wsutil/nstime.c#L304 comments on "ISO 8601". Time string format defined in rfc3339.

For sample capture IEC104_All.pcap attached to issue 8849: Buggy IEC104 dissector caused by commit r48958:

iec60870_asdu.cp56time > "2013-07-04T08:23" && iec60870_asdu.cp56time < "2013-07-04T08:24"

The filter in the question could be written as:
(iec60870_asdu.cp56time < "2024-12-01T12:34") && (iec60870_asdu.cp56time > "2024-12-01T12:30")