Port 320: PTP General Messages — The Control Plane of Precision Time

Port 320 is the designated port for PTP General Messages, part of the IEEE 1588 Precision Time Protocol (PTP). While its sibling port 319 carries the time-critical event messages with precise timestamps, port 320 handles all the coordination, management, and housekeeping that makes precision clock synchronization work.

What PTP Does

The Precision Time Protocol synchronizes clocks across a network with sub-microsecond accuracy.¹ It's what allows distributed systems—industrial control equipment, financial trading platforms, telecommunications infrastructure, data centers—to maintain a shared sense of time far more precisely than NTP ever could.

PTP achieves this by dividing its traffic into two categories:

• Event Messages (Port 319): Time-critical packets that must be timestamped at the hardware level—Sync, Delay_Req, Pdelay_Req, and Pdelay_Resp messages
• General Messages (Port 320): Everything else that doesn't require nanosecond precision

What Flows Through Port 320

Port 320 carries the control plane of PTP:²

• Announce messages: Establishing which clock is the master and building the hierarchy
• Follow_Up messages: Containing the precise timestamp from a Sync message
• Delay_Resp messages: Responding to delay requests for path measurement
• Pdelay_Resp_Follow_Up messages: Follow-up to peer delay responses
• Management messages: Configuration, monitoring, and control
• Signaling messages: Negotiating protocol capabilities

These messages aren't stamped with hardware-level precision because they don't need to be. They're about coordination, not measurement.

The History

IEEE 1588 was first published in 2002 as IEEE 1588-2002.³ The assignment of UDP ports 319 and 320 has been part of the standard since the beginning—319 for event messages, 320 for general messages. This separation allows hardware to prioritize the time-critical traffic while handling the rest through normal software processing.

IEEE 1588-2008 (PTP Version 2) brought significant improvements and became the widely adopted version, though it wasn't backward compatible with the 2002 version. IEEE 1588-2019 added further refinements while maintaining backward compatibility with the 2008 specification.

Why the Split Matters

The division between ports 319 and 320 reflects a fundamental design principle: not all clock synchronization traffic is equal.⁴

Event messages on port 319 need hardware timestamping—the network interface card marks the exact moment the packet crosses the wire. Any software delay would destroy the precision. These packets get special handling all the way down to the silicon.

General messages on port 320 can flow through normal software paths. An Announce message telling you which clock is the master doesn't need nanosecond precision. A management packet adjusting protocol parameters can tolerate milliseconds of latency.

By splitting the traffic, PTP allows hardware to focus its expensive precision timestamping capabilities on the packets that actually need it, while handling everything else through cheaper, more flexible software processing.

Security and Access

Port 320 uses UDP, chosen for its lower latency compared to TCP. In a properly designed PTP network, this traffic should be restricted to trusted network segments. PTP has no built-in authentication in the original 2008 specification, though the 2019 revision added security mechanisms.

If you find port 320 open to the public Internet, something is misconfigured. PTP is an internal protocol for trusted networks.

Related Ports

• Port 319: PTP Event Messages (the time-critical sibling)

Checking Port 320

On Linux or macOS:

# See if anything is listening on port 320
sudo lsof -i :320

# Check for PTP traffic
sudo tcpdump -i any port 320

On Windows:

# Check for listening services
netstat -an | findstr :320