Suricata

struct timeval uses 16 bytes of space on 64 bit Linux. This is far more than needed. This structure is embedded in various memory and cache sensitive data structures:
- flow 2x (lastts, startts)
- packet (ts)
- defrag tracker (timeout)
- stream (pcap hdr storage)

timeval has 2 fields we care about: tv_sec (seconds since epoch), tv_usec (micro seconds, range 0-1000000).

If we'd use a simple uint64_t of usecs since epoch, we'd be able to express 1970-infinity.
We could further shrink it to 52 bits, which would express 1970-2100 - these 12 bits we'd further save could hold a vlan id?

E.g.:

uint64_t startts_usecs:52;
uint64_t vlan_id1:12;

When setting/checking the timestamp we'd need some helpers to set it from a struct timeval, be able to compare it with one, etc.