Timestamp is always set in PCAP header, whether it reads a file or listen on an interface. This information can be important for some applications and it cannot be obtained otherwise (especially when reading a PCAP file, where the timestamp is not the current time). Timestamp here is the number of microseconds since epoch. Signed-off-by: Sylvain Rodon <srn@nexatech.fr> Acked-by: Ferruh Yigit <ferruh.yigit@intel.com>