dumpcap: timestamp is years ahead when in pcapng format

[Stephen Hemminger]

On Tue, 19 Sep 2023 19:35:55 +0300
Isaac Boukris <iboukris at gmail.com> wrote:

> Looking with git log, i found the original line was:
> return pcapng_time.ns + (delta * NSEC_PER_SEC) / rte_get_tsc_hz();
> 
> Testing that does show a wrapping issue, e.g. (it stays around 08:05).
> 
> 2023-09-19 08:05:24.372037 IP _gateway.domain > Rocky8.38358: 31975
> NXDomain 0/0/0 (46)                                              10
> 2023-09-19 08:05:21.577497 ARP, Request who-has _gateway tell Rocky8,
> length 46
> 2023-09-19 08:05:21.577599 ARP, Reply _gateway is-at 00:50:56:f8:92:76
> (oui Unknown), length 46                                     13
> 2023-09-19 08:05:22.833897 IP 192.168.202.1.50886 >
> 239.255.255.250.ssdp: UDP, length 174
> 
> However with my change it looks fine and always increments. I dropped
> all the parenthesis:
> return pcapng_time.ns + delta / pcapng_time.tsc_hz * NSEC_PER_SEC;

The issue is that timestamping is in the fast path and that 64 bit divide is slow.
Looking at other alternatives.