How can I display DNS time to live (TTL) in Days Hours Minutes Seconds format?

edit

I posted a screenshot. it's of an old video, ca. 2009, perhaps it used to work this way? I'll file an enhancement (regression, maybe) request.

It used to work this way; commit 42c52d86127263dcb84791f7213726964a3ef025 was checked in on 2013-10-18, and that changed the format.

It can be changed back without too much effort by changing the field type from FT_UINT32 to FT_RELATIVE_TIME and arranging that relative time values have both "signed" and "unsigned" versions of the various representations (DNS TTLs are unsigned, although any TTL value with the uppermost bit set is not guaranteed to be handled correctly by all recipients - RFC 1035 said "signed" in one place and "unsigned' in another, and RFC 2181 resolves the ambiguity by saying "unsigned, but limit values to 0 to 2^31-1).

There are fields for SOA and RRSIG that have the format you're looking for.

ti = proto_tree_add_item(rr_tree, hf_dns_rrsig_original_ttl, tvb, cur_offset, 4, ENC_BIG_ENDIAN);
proto_item_append_text(ti, " (%s)", signed_time_secs_to_str(wmem_packet_scope(), tvb_get_ntohl(tvb, cur_offset)));

Also hf_dns_soa_refresh_interval, hf_dns_soa_retry_interval, hf_dns_soa_expire_limit, hf_dns_soa_minimum_ttl

The examples above are from the existing code so might help in your bugzilla request.

Some time fields get a detailed breakdown after them, some don't. They should probably all be converted to FT_RELATIVE_TIME (or maybe we should have separate signed and unsigned versions of that type), which will automatically put the detailed breakdown into the field.