In case others wind up here, the issue described here appears to be
addressed by "libpcapng: fix timestamp wrapping in output files".  Thanks
for the patch!

https://patches.dpdk.org/project/dpdk/patch/20220517100115.157888-1-quentin@armitage.org.uk/

On Fri, Jan 14, 2022 at 11:15 AM Stephen Hemminger <
stephen@networkplumber.org> wrote:

> On Thu, 13 Jan 2022 21:38:06 -0500
> Ben Magistro <koncept1@gmail.com> wrote:
>
> > While utilizing dumpcap with our app, we have observed the captured file
> > producing out of order timestamps to include negative times.  We are
> still
> > investigating the root cause but believe it is in lib/pcapng.  While
> doing
> > some testing of this issue, this behavior was not observed with pcap.  In
> > the attached pcap, there are 5 streams (same curl multiple times a few
> > seconds apart), with streams 1 and 3 showing oddities.  Specifically,
> > stream 1 is in the future relative to the packet order and stream 3 has a
> > negative time.
> >
> > Not sure if the pcap file will actual post/attach, if it doesn't will try
> > something.
> >
> > System: CentOS7 + devtoolset 9
> > DPDK: v21.11
>
> The library hast convert from TSC (cpu clock) to nanoseconds since 1/1/1970
> The function pcapng_init computes the offset.
>