On Thu, 13 Jan 2022 21:38:06 -0500 Ben Magistro <konce...@gmail.com> wrote:
> While utilizing dumpcap with our app, we have observed the captured file > producing out of order timestamps to include negative times. We are still > investigating the root cause but believe it is in lib/pcapng. While doing > some testing of this issue, this behavior was not observed with pcap. In > the attached pcap, there are 5 streams (same curl multiple times a few > seconds apart), with streams 1 and 3 showing oddities. Specifically, > stream 1 is in the future relative to the packet order and stream 3 has a > negative time. > > Not sure if the pcap file will actual post/attach, if it doesn't will try > something. > > System: CentOS7 + devtoolset 9 > DPDK: v21.11 The library hast convert from TSC (cpu clock) to nanoseconds since 1/1/1970 The function pcapng_init computes the offset.
