Need help in understanding "timestamp" field in "flow" event type of eve.json

Help
1

Hi all, I need some help in understanding the meaning of “timestamp” field of flow event types in eve.json output of Suricata. What does this timestamp represent? I noticed that “timestamp” is different from “start” and “end” of the flow. In some cases, the value of timestamps are before the start of flow, in other cases, timestamps are after the start of flow. In some cases, I also observed the timestamp is 1970-01-01T00:00:00.000000+0000 (which i guessed could be because suricata is somehow reading unix timestamp 0).
Any help in understanding this is much appreciated.

Thanks

2

The timestamp in flow records corresponds to the wall clock time when Suricata ingests packets from a “live” data source, e.g, using eth0 or equivalent.

When Suricata ingests packets fro a pcap, the timestop will correspond to the timestamp of packet being processed by suricata.

3

Hi,

Why, when I run offline PCAP processing, do I get timestamp values in flow events that are outside the flow.start / flow.end range, even sometimes earlier than flow.start?
am running Suricata like this:

suricata -r test.pcap --runmode single -l logs/ -S /dev/null

{
  "timestamp": "2026-07-08T07:19:20.591000+0200",
  "flow_id": 691801799589794,
  "event_type": "flow",
  "src_ip": "172.17.27.189",
  "src_port": 60432,
  "dest_ip": "172.17.13.98",
  "dest_port": 443,
  "proto": "TCP",
  "app_proto": "tls",
  "flow": {
    "pkts_toserver": 11,
    "pkts_toclient": 12,
    "bytes_toserver": 1334,
    "bytes_toclient": 7557,
    "start": "2026-07-08T07:34:10.030000+0200",
    "end": "2026-07-08T07:34:10.207000+0200",
    "age": 0,
    "state": "closed",
    "reason": "shutdown",
    "alerted": false
  },
  "tcp": {
    "tcp_flags": "1b",
    "tcp_flags_ts": "1b",
    "tcp_flags_tc": "1b",
    "syn": true,
    "fin": true,
    "psh": true,
    "ack": true,
    "state": "closed",
    "ts_max_regions": 1,
    "tc_max_regions": 1
  }
}

In this case:

  • timestamp = 2026-07-08T07:19:20.591000+0200
  • flow.start = 2026-07-08T07:34:10.030000+0200
  • flow.end = 2026-07-08T07:34:10.207000+0200

So the top-level timestamp is not only different from the flow range, but actually earlier than flow.start.

Is this expected behavior for offline PCAP processing?
If yes, what exactly does the top-level timestamp represent for event_type: "flow"?

Thanks.