I have a linux server which captures network pcap files and save it to a CIFS shared drive. I have found out that the creation time and modified time of the pcap files seems to be the same. Which shouldn't be, as each file has 10 seconds of data so the creation time should be 10 seconds older than the modified time. If I'm correctly understanding the time attributes. I need this difference as the software with which I extract the files from the shared drive fixes the time span with start time as creation time of first file and end time as last write /modified time of the last file. Is this happening because of a linux bug? I know there will be a difference in the creation time and modified time as I have seen it before on the system few months ago. 
creation time attribute on CIFS
samba;timestamps