fix: detect NTP direction via mode byte (RFC 5905)

mantis/src/detection/ml/flow_tracker.rs

@@ -450,5 +450,19 @@ fn detect_initiator(payload: &[u8], protocol: u8, src_port: u16, dst_port: u16)
         return Some((payload[2] >> 7) == 0);
     }
 
+    // NTP over UDP (port 123, RFC 5905): byte 0, bits 2-0 = mode.
+    //   3 = client (initiator), 4 = server (responder)
+    // Handles the symmetric case where both src and dst use port 123.
+    if protocol == 17 && (src_port == 123 || dst_port == 123) {
+        let mode = payload[0] & 0x07;
+        if mode == 3 {
+            return Some(true);
+        }
+        if mode == 4 {
+            return Some(false);
+        }
+    }
+
+
     None
 }