Tool providing complex reports with analysis of PTPv2 over Ethernet signal from pcap files
See examples below or in examples directory
Analysis provide:
- Checking amount of particular PTP packet type
- Announce data change within pcap file
- MAC addresses and Clock ID consistency
- Consistency in PTP message sequence ID increasing
- Detection and check of message rate errors
- Providing statistics of intervals and rates
- Checking PTP messages not in sequence (one-step-mode)
- Providing statistics of intervals between PTP message exchanges
- Timestamp to capture time consistency histogram
The PTPv2 layer is automatically bound to the Ethernet layer based on its type field (0x88F7).
Tested with tcpdump pcaps from ordinaryclock one-step mode.
Should handle two-step and transparentclocks tcpdumps as well.
Should work under Windows and Linux
I needed a script to quickly analyse pcaps from several ports (ordinary clock) from tcpdump running for 1-2 minutes for some time. This need turned out into this script/app, and grew along with my analysis so architecture might be not as noble as might be. However, after all works perfect for finding issues between master clock and boundry clock in terms of timing or queue stuck.
Python 3.7+ scapy[basic], and matplotlib
git clone https://github.com/marcinszeremeta94/ptp-analyzer.git
cd ptp-analyzer
pip install -r requirements.txt
chmod u+x PtpAnalyzer.py
python PtpAnalyzer.py ../my_pcaps/eth2_ptp.pcap
./PtpAnalyzer.py eth2_ptp.pcap --verbose --no-prints
./PtpAnalyzer.py eth2_ptp.pcap -v --no-prints --no-plots
Application accepts pcap files eg. got as result as work of tcpdump -i eth0 -w ptp.pcap ether proto 0x88F7
PtpAnalyzer.py script file can be run as python script or simply ./ from shell
python PtpAnalyzer.py [FILENAME] [options]
./PtpAnalyzer.py [FILENAME] [options]
example
python PtpAnalyzer.py eth2_ptp.pcap
./PtpAnalyzer.py eth2_ptp.pcap
./PtpAnalyzer.py eth2_ptp.pcap -v --no-prints
report location is printed when analysis is done.
Argument [FILENAME] is mandatory. Pcap file is dispatched by scapy, which does not accept tcpdumps taken from all interfaces (Linux cooked capture). All other options are, well optional and not required. Default arguments are marked as DEFAULT in argument list below. Order of options does not matter, however if more than one option impact the same functionality last one is taken. Analysis depth arguments adds up. Analysis reports are stored in /reports/ as .log files named same as provided pcap file same as plots with .png extention. If file exist will be overwritten!
OPTIONS:
-v or --verbose - More logging and printing, all warnings and wrong frames appear time
-l or --no-logs - Turns off creating report file
-p or --no-prints - Turns off printing logs to console
-t or --no-plots - Turns off timings histogram png file creation
--full - Analysis Depth - all available analysis - DEFAULT
--announce - Analysis Depth - announce PTP messages check
--ports - Analysis Depth - MAC and Clock ID check
--sequenceId - Analysis Depth - PTP message sequence ID check
--timing - Analysis Depth - Message rate and interval check with statistics
--match - Analysis Depth - One step mesage exchange check with statistics
-h or --help - Print help
Plots
Seems ok
Here are some issues in ordinary clock queue
two-step, no announce - acceptable
Reports
Initial Check
Announce
Sequence OK
Timings and rates OK - two-step so timestamps in followups, no announce
PTP msg exhange OK - verbose
PTP exchange, at the begining of pcap no Delay_Req - Resp - verbose - OK
Some slight issues with message rates
Issues with sequence number
Some wierd things in pcap detected as well
No PTP in pcap
Sometimes matplotlib has some issues seting logarithmic scale with big inconsistencies
PTP frames extraction in mptp/PtpPackets is extension of layers and fields files of: scapy-gptp repository by Christoph Weinsheimer
I hope it may be useful for someone :)