Can you explain the timestamps at the sniffer, are these calculated on sniffer or has anything to do with coordinator or endpoint?

The timestamp is the number of milliseconds from the previous message. The first message will always be 0, the second message will have the time from the first message, the third message shows the time from the second message, and so on.