Latest release notes of the VoIP Analyzer Tool

v26.01.16.00

• Support AudioCodes Call CDR records

• Support AudioCodes Media CDR records

• Support AudioCodes SDR records

• Adapt Audit handling after midnight

• Syslog listening port for service in registry

• siplog2pcap: support OpenScape Desktop Client Personal Edition sip logs

• siplog2pcap: correct OpenScape Desktop Client Personal Edition time format

• Service: Show summary of detected SIP interfaces at start

• Service: empty queue when service is stopped

• Service: optimize thread handling

• SQL: add database version schema

• SQL: optimize Day prefix handling

• SQL: rework of useragent/diversion sql query

• SQL: restart connection on exception

• SQL: correction on day idependable tables

• SQL: Closing and opening SQL database only via the SQL thread

• SQL: improve GUI handling

• Support Graphs and Reports as output

• Show thread ID

v25.12.06.00

• siplog2pcap : new SIP LOG formats + corrections

• siplog2pcap: support Ribbon SBC sip logs

• siplog2pcap: support Unify IP Phone syslog to pcap

• siplog2pcap: support Oracle Acme Packet SBC sip logs

• siplog2pcap: support Polycom SIP logs

• siplog2pcap: support Blink SIP logs

• siplog2pcap: support OpenScape mediaserver

• siplog2pcap: support vendor Grandstream

• text2pcap : new formats + corrections

• text2pcap: three digit prefix format

• syslog2pcap: support fragmented SIP messages

• syslog2pcap: support CDRs AudioCodes

• syslog2pcap: write readme.txt for Wireshark pipe 

• Service for syslog capturing

• Service control via GUI

• Processing service handling at midnight

• SQL database introduction (MySQL/MariaDB)

• Day selection for database

• Filtering for audit from SQL database

• Audit to SQL database (MySQL/MariaDB)

• Improved xml config handling (also save xml)

•  SIP error codes configurable in xml

•  Word/pdf output configurable via XML

• Separating Audit processing and audit reporting (output)

• Handling of incomplete SIP calls

• New code signing certificate (Certum)

• Align gen_Logging code between GUI/CMD/SRV

• Change internal certificate for license

• Separate threads for syslog to pcap/pipe/sql

• Improvements on corrupted packet handling

• Flush of pcapng file

• Python code for making the graphs + example markdown file for generating the report

• Word/pdf output in separate file

• Password encrypting/decrypting

• Rework of CSTA message handling: dictionary and splitting of content

• Rework of exception handling

• Rework of DLL handling in building the software

• Richtextbox improvements for main Form

• Detect SIP BYE exact 20 seconds after SDP SendOnly attribute was sent

• Anonymizing for GSM/ISDN bit-oriented protocols

• String concatination performance improvement

• Reorder of pcap/pcapng files before audit

v24.06.01.00

• Make build for Windows + Linux + macOS

v24.05.30.00

• Anonymize additional parameters for following protocols: mysql, stun
• Mark SIP calls with a missing SIP ACK as an incomplete call
• Optimize extracting of UDP and TCP

v24.05.10.00

• text2pcap: support lots of text files with new hex formats
• text2pcap: autodetect all possible pcap link layers
• text2pcap: write pcapng format with possible different linklayers
• text2pcap: support the OSIX format
• text2pcap: support vlan tagged frames
• text2pcap: optimize processing of Juniper hex dump logs
• text2pcap: optimize processing of LTE hex dump logs
• text2pcap: optimize rawIP detection
• text2pcap: optimize detection of 0000 prefixes in hex dump
• flexible anonymize: anonymize MAC addresses to "private" OUI
• flexible anonymize: anonymize all IMSI fields (any layer, any protocol)
• flexible anonymize: anonymize LLDP
• flexible anonymize: anonymize the SCTP protocol
• flexible anonymize: anonymize IPv6 in IPv4 (6to4)
• flexible anonymize: anonymize IPv4 in IPv6: support Teredo tunneling
• flexible anonymize: remapmac for ssl.src.eth
• flexible anonymize: correct VRRP checksum
• flexible anonymize: correct FPP checksum
• flexible anonymize: leave 127.0.0.0/8 original during anonymize
• siplog2pcap: support TEL URI
• siplog2pcap: optimize Grandstream SIP logs
• siplog2pcap: support detection of SIP INFO messages
• merge: write pcapng format after merge
• reoder: support the reoder of pcap files in GUI
• code signing: codesigning of executable with Certum certificate

v23.11.20.00

• Remap all Wireshark fields with IPv4 field type
• Remap all Wireshark fields with Ethernet field type
• Remap IPv4 addresses for the OSPF protocol
• Optimize mapping of MSISDN to anonymous phone numbers
• Optimize ICMP checksum calculation during anonymize
• Optimize calculation of CRC frame checksums after anonymize of a pcap file
• Optimize TCP segmentation during pcap anonymisation
• Optimize broadcast and multicast MAC addresses during anonymisation
• Optimize anonymisation of SIP TEL URI
• Support anonymisation of gsm-r-uus1.elda: GSM: Enhanced Location Dependant Addressing 
• Anonymize "sip.r-uri" also when there is no .user or .host part 
• Support anonymisation of the sdp.phone parameter
• Show statistics at the end which fields were anonymized
• Siplog2pcap: Unify OpenScape Business: detect source and destination ip address for SIP messages

v23.11.02.00

Added some very unique features. Quite unique in the market:

Added “flexible anonymize”: anonymize ANY field at ANY protocol at ANY level. No limits. 
Just add the name of the “Wireshark display filter” of the field to be anonymize in our anonymize_display_filters.csv file.

The file is already pre-filled with almost 300 Wireshark display filters, but can easily be extended with additional Wireshark display filters which fields needs to be anonymized.
 

• remap all possible MAC addresses to anonymous MAC addresses (on any layer from)
• remap all possible IPv4 fields to anonymous IPv4 fields (on any layer)
• anonymize all possible hostnames conform presentation of Betty Dubois on SharkFest23EU in Brussels
• correct flexible anonymize processing after feedback on SharkFest23EU in Brussels

v23.10.20.00

Added some very unique features. Quite unique in the market:

• Support configurable CSV text file so that ANY field, ANY parameter, ANY protocol can be anonymized/obfuscated for ANY Wireshark PCAP file.
  • You only have to add the Wireshark display filter name in the new CSV text file.
• Several parameters inside following protocols are already by default anonymized:
  • Supported protocols in alphabetical order:
    • a11, arp, browser, capwap, cdp, cflow, dhcp, dhcpv6, diameter, dns,, dtp, e164, eap, eth, ftp, gsm, gtpv2, hsrp, hsrp2, http, icmpv6, imf, inap, ip, ipcp, ipx, isup, Kerberos, lacp, ldap, ldp, lldp, mgcp, nbdgm, nbns, netbios, ntp, ospf, pppoed, radius, rip, rtcp, rtp, sccp, sdp, sip, sll, smb,smb2, smtp, stp, syslog, telnet, tftp, tls, udid, uma, vrrp, vtp, whois, wlan
    • Additional protocols or fields can be added easily to be anonymized
• Support re-mapping of any IPv4 IP address in ANY Wireshark field of type IPv4.
  • Re-mapping is done to an anonymized IP Address.
  • Same IP address is consequent re-mapped to the same anonymized IPv4 address.
  • Currently following protocols trigger an IP address remapping:
    • arp, dhcp, dns, ip, sctp, uma vrrp.
    • Other protocols can be added easily.
  • new pcap is created with the re-mapped IP addresses
• Support re-mapping to anonymous values of ANY MSISDN phone number in ANY parameter in ANY protocol 
  • 3G/4G/5G protocols supported, as also following protocols: e164, gsm, isup, sccp
  • Other protocols can be added easily.
  • Same MSISDN phone number is consequent re-mapped to the same anonymized MSISDN phone number
  • new pcap is created with the re-mapped MSISDN phone numbers
• Support re-mapping to anonymous values of ANY IMSI number in ANY IMSI parameter in ANY protocol
  • Same IMSI number is consequent re-mapped to the same anonymized IMSI number
  • new pcap is created with the re-mapped IMSI numbers
• Support re-mapping to anonymous values of ANY IMEI number in ANY IMEI parameter in ANY protocol
  • Same IMEI number is consequent re-mapped to the same anonymized IMEI number
  • new pcap is created with the re-mapped IMEI

v23.09.16.00

• Optimize SharkEdit: Anonymize any field in any Wireshark pcap file based on the well known Wireshark display filters
  • also called “flexible anonymize” in the GUI 
• Optimize SharkExport/filter any field in any Wireshark pcap file based on the well known Wireshark display filters.
  • Export on HTML format and in Excel CSV format
  • also called “flexible filter” in the GUI 
• Support LinkLayers.Ppp
• text2pcap: add syslog remark when limit of 1000 packets is reached 
• text2pcap: better detection of date/time for unknown vendors
• Bug fixing

v23.06.10.00

• NEW: SharkEdit: Anonymize any field in any Wireshark pcap file based on the well known Wireshark display filters
  • also called “flexible anonymize” in the GUI 
• NEW: Export/filter any field in any Wireshark pcap file based on the well known Wireshark display filters.
  • Export on HTML format and in Excel CSV format
  • also called “flexible filter” in the GUI 
• Add live suggestion in GUI of any Wireshark display filter for anonymize or export/filter
• Bug fixing

v23.06.10.00

• NEW: SharkEdit: Anonymize any field in any Wireshark pcap file based on the well known Wireshark display filters
  • also called “flexible anonymize” in the GUI 
• NEW: Export/filter any field in any Wireshark pcap file based on the well known Wireshark display filters.
  • Export on HTML format and in Excel CSV format
  • also called “flexible filter” in the GUI 
• Add live suggestion in GUI of any Wireshark display filter for anonymize or export/filter
• Bug fixing

v23.04.21.00

• Bugfixing

v23.04.21.00

• Bugfixing

v22.12.02.00

• SIP
  • Siplog2Pcap: conversion from a SIP log to a pcap now supported for following SIP vendors:
    • 3CX
    • Alcatel
    • Anveo
    • Asterisk
    • AudioCodes Syslog
    • AudioCodes SIP ladder diagram files
    • Avaya
    • BroadWorks XS logs (BroadSoft)
    • Cisco or CUCM Sip Logs
    • Enovation UMO (UMO SIP Alarm devices)
    • Genesys
    • Lync
    • Mediatrix Syslog
    • Microsoft Teams -> see AudioCodes syslog
    • Mitel
    • OneAccess (Ekinops)
    • OpenScape Business (Atos/Unify)
    • OpenScape 4000 STMI SIP logs (Atos/Unify)
    • OpenScape Voice RTT traces (Atos/Unify)
    • RingCentral
    • Twilio
    • Yealink
  • Other SIP vendors can be supported on simple demand.

 

• • SipLog2Pcap: OpenScape voice RTT trace: optimize handling of SIP-Q message body
  • Show also SIP CANCEL after SIP RE-INVITE as incomplete SIP dialog
  • Show SIP Source IP and SIP Destination IP as summary in SIP Ladder diagram pop-ups
  • SIP Call duration is zero when there is no SIP BYE message

 

• Anonymize
  • anonymize the HTTP protocol
  • anonymize the SSDP protocol
  • anonymize the FTP protocol (USER and PASS only)
  • anonymize also SIPS (Secure SIP)
  • Text2Pcap
  • Text2Pcap: make detection of start of a new hex packet more defensive
  • Text2Pcap: support Cisco ASR 5000 / Cisco ASR 5500 hexdump file format (RawIP)
  • Text2Pcap: support Fortinet hex dumps
  • Text2Pcap: support "Cisco monitor capture" format
  • Text2Pcap: support Juniper Netscreen Snoop format hex dumps

 

• Other
  • Support CSTA III during pcap analysis: Show CSTA III messages in generated HTML page
  • optimize readability of the XML protocol in a SIP message body in the SIP ladder diagrams
  • support IP fragmentation for IP in a GRE tunnel (Generic Routing Encapsulation)
  • Optimize SEO
  • support TZSP encapsulation: TaZmen Sniffer Protocol
  • Generate wave files also for SRTP
  • Optimize RTCP logging
  • support of 802.3br packets

v22.06.01.00

• SIP
  • optimize creation of short SIP headers when there is a ";" sign in the SIP header display part
• RTP
  • RTP comfort noice not correct indicated for SRTP in RTP HTML table
• Anonymize
  • anonymize FTP password
  • anonymize HTTP GET string
  • always anonymize SIP TEL URI (also when they are not RFC conform formatted)
  • keep original IP addreses during anonymize when there are pre-defined documentation IP addresses (RFC5737)
• Automatic update
  • check version.txt and version.html at startup
  • detect download of update failure. Make timeout shorter.
  • optimize handling if HTTPS request to check latest version is blocked
• GPRS Tunneling Protocol (GTP)
  • optimize detection and unpacking of of GPRS Tunneling Protocol (GTP) when there are optional GTP parameters
• Other
  • show license request sting in the logging at startup when there is no license
  • adjust executable names for linux (all lower case now)
  • default path to c:\voipanalyzer in Windows install program 

v22.05.16.00

• SIP
  • anonymize RFC7315 private SIP headers
  • support RFC3262 RAck SIP header for ABNF check
  • SIP request line sometimes too long in the SVG diagram
• AudioCodes
  • Major performance optimalisation for AudioCodes SipLog2Pcap conversion
  • optimize AudioCodes SID filtered files
  • Detect CallID2 for Audiocodes sipLog2PCap. Show in HTML tables CallID2
  • Support multipart body for SipLog2Pcap (e.g. QISG, SIP-Q, ...) (e.g. for OpenScape Voice - OpenScape 4000 - OpenScape Business)
• RTP
  • anonymize RTP payload while volume is still detectable
  • detect ambiguous RTP sender timestamp
• MGCP
  • defensive reading of MGCP messages. allow <br> and \n
• updater
  • add automatic online updater
• ZIP
  • minor correction for unzipping with gzip
• SipLog2Pcap
  • add CONVERSIONS button in GUI
• General
  • optimize TCP reassemble when reassembled packet is larger than 64kB
  • Add counter in HTML tables simular as in CSV files

v22.03.14.00

• SipLog2Pcap
  • add CONVERSIONS button in GUI
  • SipLog2Pcap: convert SIP logs to Wireshark pcap files.
  • SIP log conversions supported from following vendors:
    • ▪ Anveo
      ▪ Asterisk
      ▪ AudioCodes Syslog
      ▪ AudioCodes SIP ladder diagram files
      ▪ Broadsoft
      ▪ Genesys
      ▪ Lync
      ▪ Mediatrix Syslog
      ▪ Mitel
      ▪ OneAccess (Ekinops)
      ▪ OpenScape Business (Atos/Unify)
      ▪ OpenScape 4000 STMI SIP logs (Atos/Unify)
      ▪ OpenScape Voice RTT traces (Atos/Unify)
      ▪ Twilio
• AudioCodes
  • convert AudioCodes syslog files to an audit with a filtered AudioCodes syslog file for each unique SIP call [SID=xxx:xxx:xxx]
    o Add unique AudioCodes Log as table entry in all the HTML pages after audit
    o Support Audit of AudioCodes Debug Recording (ACDR) capture inclusive AudioCodes logs (SIP + RTP + RTCP)
    o Convert AudioCodes debug recording capture to a normal Wireshark capture during the Merge functionality (SIP + RTP + RTCP)
  • Hex2Pcap: convert Wireshark HEX files to Wireshark pcap files
    - Tunneled QSIG in SIP message body
    o more exact processing of tunneled QSIG in SIP (or SIP-Q): process as HEX
    o detect false hits on \r in multipart/mixed body
    o Support "Content-Disposition:" as body header for multipart/mixed
  • Still show the tool GUI when the license is expired
  • Optimize handling of captures on the Null/loopback device
  • add VoIPAnalyzerUpdater: check at startup if online any update is available
  • Use "frame.number==" in loggings (not WP== anymore)
  • Correct gzip issue during merge on Linux
• Anonymize
  • o also anonymize optional parameters in the SIP FROM header
    o support anonymize of IGMP multicast packets
    o do not process DHCP packets during anonymize
• RTP
  • o Show Max RTP delay, max RTP Jitter and Max RTP Skew in RTP HTML table
    o correct influence between RTP and DTMF on RTP statistics

v22.02.14.00

• correct influence between RTP and DTMF on RTP statistics
• detect IPv6 For Raw captures
• add extra hints in syslog for anonymize
• anonymize ICE candidates in SDP
• SipLog2Pcap: paste DateTime also when year is not available (e.g. for AudioCodes syslog)
• support AVPF and SAVPF in SDP
• clean addition struct memory at the end of an audit/anonymize/merge
• make anonymized DNS names iso mapped IP addresses
• use more natural filename after anonymize (xxx_ANON)
• correct rewriting of SDP length after anonymize
• optimize TCP re-assembly mechanism
• optimize cleanup of leftovers after TCP assembly
• give warning when zip fle is opened
• correct processing of abbreviated headers
• TCP reassembly rework + hexdump in hex2pcap format
• gzip for pcapng
• cleanup/optimize IP fragmentation
• SipLog2Pcap generates incorrect "application/csta+xml" body
• optimize handling of pcapng capture with both ethernet packets as also sll packets
• Only last RTP codec is shown in the HTML RTP overview
• Update logging for abbreviated SIP headers
• Support the SIP NEGOTIATE method
• optimize logging of sip.Call-ID=="xxx"
• Update SipLog2Pcap help file
• SipLog2Pcap: support Mitel Sip log conversion to pcap
• SipLog2Pcap: add Mitel and OpenScape Voice RTT log conversion to pcap
• Correct PCAP with wrong TCP flags (e.g. push flag)
• solve progress bar > 100% issue
• Support detection of IEEE802.3br preemption
• Add proprietary X-RTP-Stat headers
• LinkLayerType as short
• update on IEEE 802.3br detection
• Add proprietar Siemens SIP headers
• Add proprietar ThigSbc SIP "X-" headers
• SipLog2Pcap: add vendor OneAccess for SIP log conversion to pcap
• SipLog2Pcap: also detect abbreviated content-type SIP header "c:"
• Read QSIG in body as bytes, not as chars
• SipLog2Pcap code optimalisation: make separate classes
• support ^M
• SipLog2Pcap: detect splitted SIP headers and combine them
• Add also "SIP Reason header" in HTML table for Register, Options etc
• Show SIP 403 Forbidden in the HTML ERROR tables
• SipLog2Pcap: detect SDP splitted on 2 lines for AudioCodes syslog logs.
• SipLog2Pcap: optimize splitted SIP messages
• SipLog2Pcap: support SIP messages on one line with numerous \n
• SipLog2Pcap: only search for \n if also SIP/2.0 can be found in the string
• add icons to Web projects and put header on index page
• SVG corrupted for "var protmessage0" when \r leftover occurs
• first detection SIP Common Log Format (CLF)
• error in cleanup tcp stream
• siplog2pcap html corrections (header)
• web: correct clear page for Firefox + make buttons
• Show errors/warnings when SIP RFC errors occur 

v21.12.27.00

• Support "RAck" SIP header (RFC3262)
• support IP fragmentation with duplicate packets
• adjust handling of fragmented packets
• Adjust default OpenScape SBC ports from 50000-50019 to 50000-50039
• check maximum framesize of 64K after IP or TCP assembly
• do not use duplicate RTP packets for wave files
• cleanup at the end of IP fragments and TCP segments
• hex2pcap for online tool on website https://hex2pcap.voipanalyzertool.com/
• hex2pcap: detect de-chunked data and skip it
• allow a tab character for Hex2Pcap splitting
• allow maximal merged filesize of 4 Gb
• optimize link layer detection
• detect RTP packets when they use well known SIP ports
• allow any SIP response code in the range 100-699
• add remark in HTML when RTP delay is highter than 60ms
• check if the 5 mandatory SIP headers are available during audit
• prevent false hits on RTP and RTCP after SIP BYE
• SipLog2Pcap for online tool on website https://siplog2pcap.voipanalyzertool.com/
• online web tool: make specific page for wrong cases (e.g. wrong input)
• Wireshark OSPF packet not always correct parsed
• support radius and diagram protocol (not in GUI yet)
• adjust parsing of MGCP request line
• adjust parsing of CSeq SIP header
• do not allow SVG drawing with negative x position
• add help file for relevant commands for tshark to text
• culture dependency for DateTime
• use minimal HTML table height when table is empty
• show short names for wave files in HTML tables
• Add SIP reason header in generated HTML tables
• optimize splitting of long strings (e.g. SIP From/To/CallID) in HTML tables

v21.10.02.00

• now supported as Date format: day/month/year or month/day/year or year/month/day
• Support RawIP for Hex to Pcap conversions
• also anonymize SRTP
• give warning for zero duration parameter for DTMF via RFC2833/RFC4733
• use only destination IP and destination port for RTCP filenames
• check if SDP content length value header is consistent with SDP body length
• minor correction for new SDP content length after anonymize
• major performance optimalisation during writing of syslog entries from Pcap to syslog text files
• correction regarding detection of multiple SIP messages in one single Wireshark packet
• support P-RTP-Stat header for RTP statistics
• ignore X-Siemens-RTP-Stats: stats not available

v21.09.16.00

• major performance optimalisation during audit
• - finetune anonymize of MGCP messages
• - minor updates in help files
• - create new CHM help file
• - minor bug fixes

v21.05.12.00

• New code signing certificate
• Detect ZRTP magic cookie in RTP header
• SIP port range extended to 5060-5080 and 5090
• Time processing : Local or UTC (also in GUI)
• Merge folder selection instead of one file selection in the merge folder
• MGCP csv file
• Support nested 802.1Q
• Useragent text added to message flow diagrams

v21.03.31.00

• support of the MGCP protocol
• Handling SVG message graphs more generic (also for MGCP)
• Correction on script error popup for .chm help file
• Correction with multiple linktypes in pcapng
• Filter column buttons in HTML tables
• issue solving

v21.02.22.00

• support Raw IP header
• use colors in RTP HTML pages to highlight issues with packet drop, jitter, skew etc
• support abbreviated SIP headers
• use always TTL value 64 after anonymize to hide network topology
• support detection of GRE tunnel will NULL encryption
• add “clear logging window” button in GUI
• TCP segmentation finetuning
• Detect SIP BYE immediate after SIP RE-INVITE (incomplete SIP dialog)
• Make ethernet address anonymous during anonymize
• Add dropzone on website
• Added free online demo on our https://www.voipanalyzertool.com website
• Optimize performance

v20.11.14.00

• performance optimalisation during merge action
• update of online help files
• update of offline CHM help files
• update tool icon
• bug fixes

v20.10.27.00

• support merging of Ethernet packets + Linux SLL packets at the same time to one wireshark capture

v20.10.26.00

• support the Wireshark snoop format
• use UTC time for Wireshark captures
• make also RTP stats in CSV format
• also anonymize data TCP packets with data length zero (e.g. TCP SYN)
• support VoIPAnalyzer tool on Linux
• support VoIPAnalyzer tool on macOS
• bugfixes

v20.10.04.00

• Support of PCAPNG (pcap next generation) Wireshark format
• Add also a split button next to the merge button
• Improved performance in some area’s
• Add progressbar in GUI
• bugfixes

v20.07.13.00

• Initial version released for any 64 bit Windows Operating system