In case others wind up here, the issue described here appears to be addressed by "libpcapng: fix timestamp wrapping in output files". Thanks for the patch!
https://patches.dpdk.org/project/dpdk/patch/20220517100115.157888-1-quen...@armitage.org.uk/ On Fri, Jan 14, 2022 at 11:15 AM Stephen Hemminger < step...@networkplumber.org> wrote: > On Thu, 13 Jan 2022 21:38:06 -0500 > Ben Magistro <konce...@gmail.com> wrote: > > > While utilizing dumpcap with our app, we have observed the captured file > > producing out of order timestamps to include negative times. We are > still > > investigating the root cause but believe it is in lib/pcapng. While > doing > > some testing of this issue, this behavior was not observed with pcap. In > > the attached pcap, there are 5 streams (same curl multiple times a few > > seconds apart), with streams 1 and 3 showing oddities. Specifically, > > stream 1 is in the future relative to the packet order and stream 3 has a > > negative time. > > > > Not sure if the pcap file will actual post/attach, if it doesn't will try > > something. > > > > System: CentOS7 + devtoolset 9 > > DPDK: v21.11 > > The library hast convert from TSC (cpu clock) to nanoseconds since 1/1/1970 > The function pcapng_init computes the offset. >
