From be2c40bde7fc07b5d207287c180cab5860dcda78 Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Sun, 30 Nov 2025 08:22:08 +0100
Subject: [PATCH] doc/af-packet: document disable-hwtimestamp option

Ticket: #1954.
---
 doc/userguide/capture-hardware/af-packet.rst | 31 ++++++++++++++++++++
 doc/userguide/capture-hardware/index.rst     |  1 +
 2 files changed, 32 insertions(+)
 create mode 100644 doc/userguide/capture-hardware/af-packet.rst

diff --git a/doc/userguide/capture-hardware/af-packet.rst b/doc/userguide/capture-hardware/af-packet.rst
new file mode 100644
index 0000000000..0bf408c587
--- /dev/null
+++ b/doc/userguide/capture-hardware/af-packet.rst
@@ -0,0 +1,31 @@
+.. _afpacket:
+
+AF_PACKET
+#########
+
+Introduction
+************
+
+AF_PACKET is a capture interface to the Linux Kernel.
+
+Config Options
+**************
+
+disable-hwtimestamp
+===================
+
+Boolean option to disable hardware timestamping on an interface.
+
+By default the hardware timestamping support is enabled if the system support it.
+
+Hardware timestamping can lead to issue of the NIC and kernel getting out of sync. See 
+`ticket 7585 <https://redmine.openinfosecfoundation.org/issues/7585>`_.
+
+::
+
+    af-packet:
+      - interface: eth0
+        cluster-id: 99
+        disable-hwtimestamp: true
+        cluster-type: cluster_flow
+
diff --git a/doc/userguide/capture-hardware/index.rst b/doc/userguide/capture-hardware/index.rst
index f7e377a8c5..dd1686abd8 100644
--- a/doc/userguide/capture-hardware/index.rst
+++ b/doc/userguide/capture-hardware/index.rst
@@ -3,6 +3,7 @@ Using Capture Hardware
 
 .. toctree::
 
+   af-packet
    endace-dag
    napatech
    myricom