106 lines
3.9 KiB
Markdown
106 lines
3.9 KiB
Markdown
# PCAP Analyzer for IRIG106 Chapter 10 and IEEE1588 PTP
|
|
|
|
A Python tool for analyzing Wireshark PCAP files containing IRIG106 Chapter 10 streaming data and IEEE1588 PTP frames.
|
|
|
|
## Features
|
|
|
|
- **Chapter 10 Analysis**: Parses IRIG106 Chapter 10 headers and displays packet details in tabular format
|
|
- **PTP Analysis**: Analyzes IEEE1588 PTP messages (Sync, Announce, Delay_Req, etc.)
|
|
- **Statistical Analysis**: Provides timing statistics and detects intermittent issues such as:
|
|
- Timing outliers and jitter
|
|
- Sequence number gaps and duplicates
|
|
- Message distribution analysis
|
|
|
|
## Installation
|
|
|
|
1. Install dependencies:
|
|
```bash
|
|
python3 -m venv venv
|
|
source venv/bin/activate
|
|
pip install -r requirements.txt
|
|
```
|
|
|
|
## Usage
|
|
|
|
### Basic Analysis
|
|
```bash
|
|
python3 pcap_analyzer.py "1 PTPGM.pcapng"
|
|
```
|
|
|
|
### Options
|
|
- `--ch10-only`: Show only Chapter 10 analysis
|
|
- `--ptp-only`: Show only PTP analysis
|
|
- `--stats-only`: Show only statistical analysis
|
|
- `--summary-only`: Show only summary information (no detailed tables or stats)
|
|
- `--no-tables`: Skip detailed packet tables (show summaries and stats only)
|
|
- `--tmats`: Display TMATS (Telemetry Attributes Transfer Standard) content
|
|
- `--tmats-only`: Show only TMATS content
|
|
|
|
### Examples
|
|
```bash
|
|
# Analyze only PTP packets
|
|
python3 pcap_analyzer.py --ptp-only "1 PTPGM.pcapng"
|
|
|
|
# Show only statistics
|
|
python3 pcap_analyzer.py --stats-only "1 PTPGM.pcapng"
|
|
|
|
# Show only summaries (quick overview)
|
|
python3 pcap_analyzer.py --summary-only "1 PTPGM.pcapng"
|
|
|
|
# Show summaries and statistics but skip detailed tables
|
|
python3 pcap_analyzer.py --no-tables "1 PTPGM.pcapng"
|
|
|
|
# Display TMATS metadata content
|
|
python3 pcap_analyzer.py --tmats "1 PTPGM.pcapng"
|
|
|
|
# Show only TMATS content
|
|
python3 pcap_analyzer.py --tmats-only "1 PTPGM.pcapng"
|
|
```
|
|
|
|
## Output
|
|
|
|
The tool provides five types of analysis:
|
|
|
|
1. **Protocol Summaries**: High-level overview with packet counts, time spans, and distribution statistics
|
|
2. **Detailed Packet Tables**: Complete packet-by-packet analysis (Chapter 10 and PTP)
|
|
3. **Statistical Analysis**: Timing statistics, outlier detection, and intermittent issue identification
|
|
4. **TMATS Content**: Assembled telemetry metadata and scaling information from Chapter 10 TMATS frames
|
|
|
|
### Summary Output
|
|
- **Chapter 10 Summary**: Packet counts, channel distribution, data type distribution, size statistics, and data rates
|
|
- **PTP Summary**: Message type distribution, domain analysis, source IP breakdown, and timing rates
|
|
- **TMATS Output**: Complete assembled ASCII metadata with frame counts and statistics
|
|
|
|
## Chapter 10 Header Fields
|
|
|
|
- **Sync Pattern**: Should be 0xEB25 for valid Ch10 packets
|
|
- **Channel ID**: Identifies the data source
|
|
- **Sequence Number**: Packet sequence (0-255, wraps around)
|
|
- **Data Type**: Type of data payload
|
|
- **Packet/Data Length**: Size information
|
|
- **Flags**: Status and configuration flags
|
|
|
|
## PTP Message Types
|
|
|
|
- **Sync**: Master clock synchronization
|
|
- **Follow_Up**: Precise timing information
|
|
- **Delay_Req**: Slave delay measurement request
|
|
- **Delay_Resp**: Master delay measurement response
|
|
- **Announce**: Clock quality and hierarchy information
|
|
|
|
## TMATS (Telemetry Attributes Transfer Standard)
|
|
|
|
TMATS frames contain ASCII metadata that describes the telemetry setup, channel configurations, and scaling information:
|
|
|
|
- **Automatic Assembly**: Combines multiple TMATS frames into complete metadata
|
|
- **ASCII Display**: Clean formatting of telemetry attributes
|
|
- **Statistics**: Frame counts, total length, attribute and comment line counts
|
|
- **Mixed Frame Support**: Handles both full Chapter 10 headers and continuation frames
|
|
|
|
## Statistical Features
|
|
|
|
- **Timing Analysis**: Interval statistics, jitter detection
|
|
- **Sequence Analysis**: Gap detection, duplicate identification
|
|
- **Distribution Analysis**: Message type frequency
|
|
- **Outlier Detection**: Identifies packets with unusual timing
|
|
- **Frame Number Reporting**: Shows actual PCAP frame numbers for easy Wireshark correlation |