While utilizing dumpcap with our app, we have observed the captured file producing out of order timestamps to include negative times. We are still investigating the root cause but believe it is in lib/pcapng. While doing some testing of this issue, this behavior was not observed with pcap. In the attached pcap, there are 5 streams (same curl multiple times a few seconds apart), with streams 1 and 3 showing oddities. Specifically, stream 1 is in the future relative to the packet order and stream 3 has a negative time.
Not sure if the pcap file will actual post/attach, if it doesn't will try something. System: CentOS7 + devtoolset 9 DPDK: v21.11
1060.pcapng
Description: Binary data
