On Thu, 13 Jan 2022 21:38:06 -0500
Ben Magistro <koncept1@gmail.com> wrote:

> While utilizing dumpcap with our app, we have observed the captured file
> producing out of order timestamps to include negative times.  We are still
> investigating the root cause but believe it is in lib/pcapng.  While doing
> some testing of this issue, this behavior was not observed with pcap.  In
> the attached pcap, there are 5 streams (same curl multiple times a few
> seconds apart), with streams 1 and 3 showing oddities.  Specifically,
> stream 1 is in the future relative to the packet order and stream 3 has a
> negative time.
>
> Not sure if the pcap file will actual post/attach, if it doesn't will try
> something.
>
> System: CentOS7 + devtoolset 9
> DPDK: v21.11

The library hast convert from TSC (cpu clock) to nanoseconds since 1/1/1970
The function pcapng_init computes the offset.