MANUAL TEST FUNCTIONS
67
Up to this point, all data has been collected, and processed and shown in both the
NetworkStreams
list and in the
Frequency
graph. Look at the original VoIP Plus+ Control interface. It shows filter
selections in the upper right of the display that can be enabled to limit the type of packets analyzed.
The receive filter options are:
All
(Default) – All receive or file data is processed and included in the
NetworkStreams
list and
Frequency
graph, unless customized by other settings.
Ignore ARPs
– When enabled, ARPs will not be included in the analysis. Windows 8 and later PCs
will search the network for connected devices. This reduces that influence on the data.
Suspect
–When enabled, analysis focuses on packets that use ports that have been used in the
past for malicious activity.
NotEthernet2
– When enabled, analysis focuses on packets that are not classified as
“Ethernet2”, the latest standard. While it is the most used standard now, there are many
business networks that still have Novell, SNAP, and/or 802.3Raw. All three of these should not
be present on modern networks. Yet they can exist and modern Network Analyzers might not
see them because newer network cards in PCs today are not set up to receive them. SNAP and
802.3Raw do not require a server, but have been used for tunneling or unauthorized VPNs in
the past, and do reside on networks today, such as an iDevice tunnel in to a VPN and would go
unnoticed by modern network analyzers and therefore might not be seen by network
administrators.
VoIPPorts
– When enabled, analysis is performed on packets that use known VoIP Ports only.
This can be done in other Network Analyzer programs, but, it is a LONG list of ports that are
known VoIP ports and takes a lot of time to set up the filter manually.
HTTP
(80, 443) – This is reliant on checking VoIP Ports, you can further isolate the VoIP Ports by
specifically leaving out 80 and 443 data. These are typically used for HTTP traffic (meaning the
web page itself). BUT, google and others have been experimenting with a QUIC protocol for
VoIP based on UDP that is sent via normal HTTP ports 80/443. This permits you to find those
specifically.
