Epoch-relative Timestamps

I am researching the behaviour of TCP in relation to DASH video applications. I am using the `tcp_probe` tracepoint with [perf-tools tpoint](https://github.com/brendangregg/perf-tools/blob/master/system/tpoint) however this gives me a time from boot.

In order for me to combine output from different machines I would like to instead get the time in terms of nanoseconds since UNIX epoch. The [kernel timekeeping documentation](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/Documentation/core-api/timekeeping.rst?h=v4.19.6#n31) suggests `u64 ktime_get_real_ns( void )` is likely to be the function I need to call.

I would like to replace my usage of `tcp_probe` with a tool written using bcc, however the only built-in timing method available is `u64 bpf_ktime_get_ns(void)` which returns a time from boot. I have tried to use `u64 ktime_get_real_ns( void )` as outlined above, however on doing so I receive the error: `LLVM ERROR: Program used external function 'ktime_get_with_offset' which could not be resolved!`.

I'm fairly new to BPF and tracing in general so I searched online and [this post](https://lists.iovisor.org/g/iovisor-dev/topic/bcc_on_32_bit_arm/21386252?p=,,,20,0,0,0::recentpostdate%2Fsticky,,,20,2,80,21386252) mentions external function calls being disallowed in BPF code. I subsequently tried to move `ktime_get_with_offset` (and the various functions it relies upon) into the C text of the program but received an invalid bytecode error, unfortunately I didn't save this at the time but I am confident I could recreate it if it would help.

If anyone can offer any pointers on how I would be able to do what I am outlining using bcc or offer an alternative method to accomplish the same task it would be much appreciated.

Start by comparing the kernel timekeeping documentation's ktime_get_real_ns() with the available bpf_ktime_get_ns() helper and the reported ktime_get_with_offset resolution error. Determine a supported way for a BCC program to produce nanoseconds since the UNIX epoch, and verify that its output can be combined across machines as requested.

Written by the indexing model from the issue text.