2017-07-25 06:31 AM
How do you get the current date so it can be used to compare another variable using LUA? I've tried os.date and even nwtypes.TimeT and I can get it to load into a variable.
2017-07-25 08:34 AM
The os library isn't available to a lua parser. A callback for a key with type TimeT is infeasible for other more complicated reasons.
You can get the timestamp from a packet (epoch), which should reflect time of capture.
local packet = nwsession.getFirstPacket()
local pTimestamp = nwpacket.getTimestamp(packet)
2017-07-27 05:01 AM
William,
Thanks for the help! That helped to get epoch. Do you have any code samples to convert from or to epoch? The samples I'm finding on the internet are working for me.
Thanks!
2017-07-27 10:34 AM
Normally you could use os.time and os.date. But of course the os library isn't available. Most / all of the examples you can find assume you can load libraries which aren't pure lua, which are also not available to a parser.
So you have to do it in pure lua. Below are a couple examples. No guarantee that either is the "best" way.
From Epoch
-- NOTE: will produce incorrect month and day for leap years
local epochYears = {
[1] = {["year"] = "2038", ["first"] = 2145916800},
[2] = {["year"] = "2037", ["first"] = 2114380800},
[3] = {["year"] = "2036", ["first"] = 2082758400},
[4] = {["year"] = "2035", ["first"] = 2051222400},
[5] = {["year"] = "2034", ["first"] = 2019686400},
[6] = {["year"] = "2033", ["first"] = 1988150400},
[7] = {["year"] = "2032", ["first"] = 1956528000},
[8] = {["year"] = "2031", ["first"] = 1924992000},
[9] = {["year"] = "2030", ["first"] = 1893456000},
[10] = {["year"] = "2029", ["first"] = 1861920000},
[11] = {["year"] = "2028", ["first"] = 1830297600},
[12] = {["year"] = "2027", ["first"] = 1798761600},
[13] = {["year"] = "2026", ["first"] = 1767225600},
[14] = {["year"] = "2025", ["first"] = 1735689600},
[15] = {["year"] = "2024", ["first"] = 1704067200},
[16] = {["year"] = "2023", ["first"] = 1672531200},
[17] = {["year"] = "2022", ["first"] = 1640995200},
[18] = {["year"] = "2021", ["first"] = 1609459200},
[19] = {["year"] = "2020", ["first"] = 1577836800},
[20] = {["year"] = "2019", ["first"] = 1546300800},
[21] = {["year"] = "2018", ["first"] = 1514764800},
[22] = {["year"] = "2017", ["first"] = 1483228800},
[23] = {["year"] = "2016", ["first"] = 1451606400},
[24] = {["year"] = "2015", ["first"] = 1420070400},
[25] = {["year"] = "2014", ["first"] = 1388534400},
[26] = {["year"] = "2013", ["first"] = 1356998400},
[27] = {["year"] = "2012", ["first"] = 1325376000},
[28] = {["year"] = "2011", ["first"] = 1293840000},
[29] = {["year"] = "2010", ["first"] = 1262304000},
[30] = {["year"] = "2009", ["first"] = 1230768000},
[31] = {["year"] = "2008", ["first"] = 1199145600},
[32] = {["year"] = "2007", ["first"] = 1167609600},
[33] = {["year"] = "2006", ["first"] = 1136073600},
[34] = {["year"] = "2005", ["first"] = 1104537600},
[35] = {["year"] = "2004", ["first"] = 1072915200},
[36] = {["year"] = "2003", ["first"] = 1041379200},
[37] = {["year"] = "2002", ["first"] = 1009843200},
[38] = {["year"] = "2001", ["first"] = 978307200},
[39] = {["year"] = "2000", ["first"] = 946684800},
[40] = {["year"] = "1999", ["first"] = 915148800},
[41] = {["year"] = "1998", ["first"] = 883612800},
[42] = {["year"] = "1997", ["first"] = 852076800},
[43] = {["year"] = "1996", ["first"] = 820454400},
[44] = {["year"] = "1995", ["first"] = 788918400},
[45] = {["year"] = "1994", ["first"] = 757382400},
[46] = {["year"] = "1993", ["first"] = 725846400},
[47] = {["year"] = "1992", ["first"] = 694224000},
[48] = {["year"] = "1991", ["first"] = 662688000},
[49] = {["year"] = "1990", ["first"] = 631152000},
[50] = {["year"] = "1989", ["first"] = 599616000},
[51] = {["year"] = "1988", ["first"] = 567993600},
[52] = {["year"] = "1987", ["first"] = 536457600},
[53] = {["year"] = "1986", ["first"] = 504921600},
[54] = {["year"] = "1985", ["first"] = 473385600},
[55] = {["year"] = "1984", ["first"] = 441763200},
[56] = {["year"] = "1983", ["first"] = 410227200},
[57] = {["year"] = "1982", ["first"] = 378691200},
[58] = {["year"] = "1981", ["first"] = 347155200},
[59] = {["year"] = "1980", ["first"] = 315532800},
[60] = {["year"] = "1979", ["first"] = 283996800},
[61] = {["year"] = "1978", ["first"] = 252460800},
[62] = {["year"] = "1977", ["first"] = 220924800},
[63] = {["year"] = "1976", ["first"] = 189302400},
[64] = {["year"] = "1975", ["first"] = 157766400},
[65] = {["year"] = "1974", ["first"] = 126230400},
[66] = {["year"] = "1973", ["first"] = 94694400},
[67] = {["year"] = "1972", ["first"] = 63072000},
[68] = {["year"] = "1971", ["first"] = 31536000},
[69] = {["year"] = "1970", ["first"] = 0}
}
local epochMonths = {
[1] = {["month"] = "Dec", ["first"] = 28857600},
[2] = {["month"] = "Nov", ["first"] = 26265600},
[3] = {["month"] = "Oct", ["first"] = 23587200},
[4] = {["month"] = "Sep", ["first"] = 20995200},
[5] = {["month"] = "Aug", ["first"] = 18316800},
[6] = {["month"] = "Jul", ["first"] = 15638400},
[7] = {["month"] = "Jun", ["first"] = 13046400},
[8] = {["month"] = "May", ["first"] = 10368000},
[9] = {["month"] = "Apr", ["first"] = 7776000},
[10] = {["month"] = "Mar", ["first"] = 5097600},
[11] = {["month"] = "Feb", ["first"] = 2678400},
[12] = {["month"] = "Jan", ["first"] = 0}
}
local function convertFromEpoch(epoch)
local year, month, day, hour, minute, seconds
local remainder
for i,j in ipairs(epochYears) do
if epoch > j.first then
year = j.year
epoch = epoch - j.first
break
end
end
if not year then
return
end
for i,j in ipairs(epochMonths) do
if epoch > j.first then
month = j.month
epoch = epoch - j.first
break
end
end
if not month then
return
end
day = string.format("%02d", math.floor(epoch / 86400))
epoch = epoch - (day * 86400)
hour = string.format("%02d", math.floor(epoch / 3600))
epoch = epoch - (hour * 3600)
minute = string.format("%02d", math.floor(epoch / 60))
seconds = string.format("%02d", epoch - (minute * 60))
print(year .. " " .. month .. " " .. day .. " " .. hour .. ":" .. minute .. ":" .. seconds)
end
To Epoch
-- NOTE
-- Expects either:
-- YYYY/MM/DD HH:MM:SS GMT-HH:MM e.g., 2014/06/18 17:03:30 GMT-05:00
-- YYYY-MM-DDTHH:MM:SS.sss-HH:MM e.g., 2011-08-30T09:30:16.768-04:00
local monthSeconds = ({
[1] = 0,
[2] = 2678400,
[3] = 5097600,
[4] = 7776000,
[5] = 10368000,
[6] = 13046400,
[7] = 15638400,
[8] = 18316800,
[9] = 20995200,
[10] = 23587200,
[11] = 26265600,
[12] = 28857600
})
local function convertToEpoch(timeStamp)
if not timeStamp or type(timeStamp) ~= "string" or string.len(timeStamp) < 29 then
return
end
local year = tonumber(string.sub(timeStamp, 1, 4))
local month = tonumber(string.sub(timeStamp, 6, 7))
local day = tonumber(string.sub(timeStamp, 9, 10))
local hour = tonumber(string.sub(timeStamp, 12, 13))
local minute = tonumber(string.sub(timeStamp, 15, 16))
local second = tonumber(string.sub(timeStamp, 18,19))
-- failsafes
if not year or year < 1970 then
return
end
if not month or month > 12 then
return
end
if not day or day > 31 then
return
end
if not hour or hour > 23 then
return
end
if not minute or minute > 59 then
return
end
if not second or second > 59 then
return
end
local epoch
-- calculate years since 1970
local numYears = year - 1970
-- calculate seconds from years
epoch = numYears * 31536000
-- calculate number of leap years
local leapYears = math.floor(numYears / 4)
-- account for days in leap years
epoch = epoch + (leapYears * 86400)
-- determine if there was a recent leap year not accounted for above
local numYearsMod4 = math.mod(numYears, 4)
if numYearsMod4 > 2 then
-- account for the most recent leap year
-- doesn't consider if ~this~ is a leap year
epoch = epoch + 86400
elseif numYearsMod4 == 2 and month > 2 then
-- this is a leap year, and the date is past feb
epoch = epoch + 86400
end
-- add month seconds
epoch = epoch + monthSeconds[month]
-- add day seconds
epoch = epoch + ((day - 1) * 86400)
-- add hour seconds
epoch = epoch + (hour * 3600)
-- add minute seconds
epoch = epoch + (minute * 60)
-- add seconds
epoch = epoch + second
--[[
kludge for leap seconds:
* there were 27 leap seconds added from 1970 to 2016
* does not account for any future leap seconds (if any)
--]]
epoch = epoch + 27
print(epoch)
end
2017-08-03 02:38 PM
William, thanks for the sample code.
Just FYI
math.mod has been deprecated in 5.1 and removed in 5.2. I changed it to fmod and got everything working.