PTP ADS
Profile-based anomaly detection for IEEE 1588 PTP networks
by PowerProfs
About
PTP ADS captures PTP from a live Linux interface or replays PCAP files, comparing observed behavior against a trusted timing profile. It handles raw Ethernet (0x88F7) and UDP 319/320 over IPv4 or IPv6, plain, VLAN, and QinQ framing, and parses Sync, Follow_Up, Delay_Req, Delay_Resp, and Announce messages. Domain, trusted clock identities, MAC addresses, source-port identities, BMCA values, clock quality, flags, message intervals, sequence continuity, request/response correlation, duplicate or conflicting timestamps, and timing behavior are all validated against legacy single-Grandmaster or multi-Grandmaster, redundant-master, multi-domain, and per-domain slave profiles. Alerts are enriched with severity, confidence, MITRE ATT&CK for ICS, CWE, and CVE context, stored in SQLite WAL mode, and streamed live to a React dashboard over WebSocket alongside stored 1-, 12-, and 24-hour analysis. Capture requires AppOrc approval to start and stops on permanent heartbeat rejection or license expiry.
What's New
v0.7.0- Multi-domain and redundant-master profile support
- Candidate profile generation from stored evidence
- AppOrc-gated capture lifecycle
Updated 3d ago
Capabilities
Live capture & PCAP replay
Captures IEEE 1588 PTP over raw Ethernet (0x88F7) and UDP 319/320, or replays PCAP files for offline analysis.
Profile-based anomaly detection
Compares observed BMCA, clock quality, timing, and sequence behavior against a trusted profile — legacy single-GM through multi-domain, multi-Grandmaster setups.
Enriched alert evidence
Severity, confidence, MITRE ATT&CK for ICS, CWE, and CVE context attached to every alert, backed by packet-level evidence.
Live + historical dashboard
WebSocket-streamed live state plus stored 1-, 12-, and 24-hour analysis views for GM trust, timing health, and topology.