Can you explain the timestamps at the sniffer, are these calculated on sniffer or has anything to do with coordinator or endpoint?
The timestamp is the number of milliseconds from the previous message.
The first message will always be 0, the second message will have the
time from the first message, the third message shows the time from the
second message, and so on.