Honeyntp

Honeyntp is an NTP-based honeypot and logging tool that captures and analyzes Network Time Protocol (NTP) traffic for security monitoring purposes. The tool functions as both a scanner logger and honeypot, recording all incoming NTP packets into a Redis database for storage and analysis. It maintains detailed tracking information including first-seen and last-seen timestamps for each unique IP address and port combination. Built on the ntplib library, Honeyntp has been tested and verified to work on both Linux and Windows 7 operating systems. The tool provides cross-platform compatibility for deployment in various network environments. One of the primary use cases for Honeyntp is detecting Distributed Denial of Service (DDoS) attacks that leverage NTP amplification techniques. The tool is particularly effective at identifying malicious traffic patterns where attackers commonly use port 80 as the source port for their attacks. The Redis database backend enables efficient storage and retrieval of captured NTP traffic data, allowing security analysts to perform historical analysis and identify trends in attack patterns over time.