Hi Tewodros,
yes, this is indeed normal. The timestamp that is, e.g., given in conn.log is the timestamp at which the connection was created (timestamp of first packet). However, the log line is written after the connection terminates. Thus, it is expected, and completely normal, that the the timestamps will not be ordered chronologically.
I hope this helps,
Johanna