time: compact alternative to struct timeval
struct timeval uses 16 bytes of space on 64 bit Linux. This is far more than needed. This structure is embedded in various memory and cache sensitive data structures:
- flow 2x (lastts, startts)
- packet (ts)
- defrag tracker (timeout)
- stream (pcap hdr storage)
timeval has 2 fields we care about: tv_sec (seconds since epoch), tv_usec (micro seconds, range 0-1000000).
If we'd use a simple uint64_t of usecs since epoch, we'd be able to express 1970-infinity.
We could further shrink it to 52 bits, which would express 1970-2100 - these 12 bits we'd further save could hold a vlan id?
uint64_t startts_usecs:52; uint64_t vlan_id1:12;
When setting/checking the timestamp we'd need some helpers to set it from a struct timeval, be able to compare it with one, etc.