The decoded timestamp in the new pcap file is different from the one printed to stdout

[advornic]

[advornic]

This is expected because datetime.utcfromtimestamp cannot represent nanoseconds (and will round the digit value of the microseconds), whereas the pcap can. Here is an example:

(Pdb)ts
1430771223.8299615
(Pdb)datetime.utcfromtimestamp(ts ).microsecond
829962

One solution could be to use something different for printing to stdout.