To calculate the total time between the first and last DHCPACK after a DHCPOFFER, you can use a combination of SQL window functions and conditional logic. Here's an example query that might help you achieve the desired result:

WITH offers AS (
    SELECT
        _row_id as offer_uid,
        timestamp as offer_start,
        lead(timestamp) over (partition by rid order by timestamp) as offer_end,
        rid
    FROM t WHERE dhcp_action = 'DHCPOFFER'
),
actions AS (
    SELECT
        offers.rid,
        offers.offer_uid,
        t.timestamp,
        t.dhcp_action
    FROM t JOIN offers
    ON t.rid = offers.rid AND
        CASE offers.offer_end IS NULL
            WHEN true THEN t.timestamp >= offers.offer_start
            ELSE t.timestamp >= offers.offer_start AND t.timestamp < offers.offer_end
        END
)
SELECT
    rid,
    offer_uid,
    first_value(timestamp) OVER (PARTITION BY rid, offer_uid ORDER BY timestamp) FILTER (WHERE dhcp_action = 'DHCPACK') AS first_ack,
    last_value(timestamp) OVER (PARTITION BY rid, offer_uid ORDER BY timestamp) FILTER (WHERE dhcp_action = 'DHCPACK') AS last_ack
FROM actions
GROUP BY rid, offer_uid;

This query creates a CTE (offers) to identify the start and end times of each DHCPOFFER period for each rid. Then, it joins this CTE with the original table (actions) to find all DHCP actions that fall within each offer period. Finally, it selects the first and last DHCPACK timestamps for each offer period and calculates the difference between them to find the total time.