Need help in understanding "timestamp" field in "flow" event type of eve.json

Help
1

Hi all, I need some help in understanding the meaning of “timestamp” field of flow event types in eve.json output of Suricata. What does this timestamp represent? I noticed that “timestamp” is different from “start” and “end” of the flow. In some cases, the value of timestamps are before the start of flow, in other cases, timestamps are after the start of flow. In some cases, I also observed the timestamp is 1970-01-01T00:00:00.000000+0000 (which i guessed could be because suricata is somehow reading unix timestamp 0).
Any help in understanding this is much appreciated.

Thanks

2

The timestamp in flow records corresponds to the wall clock time when Suricata ingests packets from a “live” data source, e.g, using eth0 or equivalent.

When Suricata ingests packets fro a pcap, the timestop will correspond to the timestamp of packet being processed by suricata.