Flow end time before flow start time

[thorgrin]

I see quite a lot of flows with end time before the start time.

ipfixprobe is running as follows

/usr/bin/ipfixprobe -i 'dpdk;p=0;q=1;e=ipfixprobe-eal --lcores (0-7)@(1,3,5,7,9,11,13,15,17,19,21,23) -a 0000:d8:00.0 --file-prefix=11263' -s 'cache;size=20;active=300;inactive=60;split' -p basicplus -p dns -p http -p tls -p quic -p passivedns -o ipfix;host=target-host;port=target-port;id=216;dir=216;

What i get is:

It is all part of the same connection (the IP addresses are the same for all shown flows).

Setup

OS: Ubuntu 22.04 LTS
Compilation as deb package using make deb with modified dh_auto_configure in debian/rules

Full configure params:

 ./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --libexecdir=\${prefix}/lib/x86_64-linux-gnu --disable-maintainer-mode --disable-d
ependency-tracking --with-pcap --with-quic --with-msects --with-dpdk --enable-debug