Since you're writing a sniffer, aparently in Perl, you're almost certainly using Net::Pcap to implement the packet capturing. Why not use the second and microsecond timestamps that Net::Pcap give you with each packet it returns?

Excerpt from the Net::Pcap docs

The header information is a reference to a hash containing the following fields. ...

• tv_sec - Seconds value of the packet timestamp.
• tv_usec - Microseconds value of the packet timestamp.

Those should be the packet timestamps from the NIC or your OSes kernel; which should be slightly more accurate than an timestamp generated inside your application.