text: #include <stdio.h>
  #include <unistd.h>
  #include <stdlib.h>
  #include <pcap.h>
  #include <err.h>
  #include <string.h>
  #include <time.h>
  #include <errno.h>
  #include <assert.h>
  
  #include <sys/types.h>
  #include <sys/socket.h>
  #include <netinet/in.h>
  #include <arpa/inet.h>
  
  #define XCMP(X,Y) (X<Y?-1:(X>Y?1:0))
  
  int ARRAYSZ = 1 << 20;
  struct timeval *tvals = NULL;
  int count;
  int misordered = 0;
  
  int
  tv_cmp(struct timeval *a, struct timeval *b)
  {
      return (a->tv_sec == b->tv_sec) ? XCMP(a->tv_usec, b->tv_usec) : XCMP(a->tv_sec, b->tv_sec);
  }
  
  void
  flush(int keep)
  {
      if (keep)
  	memmove(tvals, tvals + count - keep, keep * sizeof(*tvals));
      count = keep;
  }
  
  void
  push(struct pcap_pkthdr *hdr, const u_char * data)
  {
      assert(count < ARRAYSZ);
      *(tvals + count) = hdr->ts;
      count++;
      if (count < 2)
  	return;
      if (0 > tv_cmp(tvals + count - 1, tvals + count - 2)) {
  	printf("timestamp went from %10lld.%06ld to %10lld.%06ld\n",
  	    (long long int) (tvals + count - 2)->tv_sec,
  	    (tvals + count - 2)->tv_usec, (long long int) (tvals + count - 1)->tv_sec, (tvals + count - 1)->tv_usec);
  	misordered++;
      }
  }
  
  int
  main(int argc, char *argv[])
  {
      pcap_t *in = NULL;
      char errbuf[PCAP_ERRBUF_SIZE + 1];
      struct pcap_pkthdr hdr;
      const u_char *data;
  
  
      if (argc < 2) {
  	fprintf(stderr, "usage: pcap-reorder sortsize\n");
  	exit(1);
      }
      ARRAYSZ = atoi(argv[1]);
      if (ARRAYSZ < 2) {
  	fprintf(stderr, "sortsize should be greater than 1\n");
  	exit(1);
      }
      tvals = calloc(ARRAYSZ, sizeof(*tvals));
  
      in = pcap_open_offline("-", errbuf);
      if (NULL == in) {
  	fprintf(stderr, "stdin: %s", errbuf);
  	exit(1);
      }
      while ((data = pcap_next(in, &hdr))) {
  	push(&hdr, data);
  	if (ARRAYSZ == count)
  	    flush(3 * count / 4);
      }
      pcap_close(in);
      exit(0 == misordered ? 0 : 1);
  }
  