modified timestamp tcp observation