OmniPeek Product Family
AiroPeek SE & NX
AiroPeek VX
EtherPeek SE & NX
EtherPeek VX
Overview
Support FAQ
Tech Tips
Supported Hardware
Decodes
Hardware
Other Products

Support FAQ

Some things just go together. AiroPeek + EtherPeek = OmniPeek

EtherPeek VX

Return to top of page Are you going to release a patch for WildPackets Products in order to make them compatible with the new 2007 Daylight Savings Time changes?

Since all WildPackets products make use of the underlying Operating System for all time computations, no patch will be necessary for our products to operate correctly with the new Daylight Saving Time Change.

Important Vista Note:

Vista Operating System has a facility for dynamic Daylight Saving Time calculations that takes into account the fact that different years may have different DST dates. The next release of the OmniPeek Product Family (available end of Jan. 2007) will include the code to use this new operating system facility.

The end result is that everything will work correctly with Vista, but if a user has XP with the DST hotfix installed, the duration of captures that span the actual time change in past years may be incorrect since XP does not have the facility to understand that different years may have different DST dates.

Return to top of page Will EtherPeek run on 64 bit Operating Systems?

EtherPeek VX 2.1 will load and run on 64 bit operating systems in 32 bit compatibility mode and supports AMD and Intel x86 processors including the 64 bit capable Pentium and Xeon processors.

Return to top of page What CODECs are supported?

G.711 µ-law
G.711 µ-law with PLC
G.723.1 5.3K
G.723.1 6.3K
G.728
G.729
G.729A
GSM 6.10 full-rate
GSM 6.10 half-rate
GSM 6.10 enhanced full-rate
Lucent/elemedia SX7300/8300
Lucent/elemedia SX9600
G.711 A-law
G.711 A-law with PLC
G.722
G.726 ADPCM 16K
G.726 ADPCM 24K
G.726 ADPCM 32K
G.726 ADPCM 40K
GIPS enhanced G.711 µ-law
GIPS enhanced G.711 A-law
GIPS iLBC
GIPS iSAC
GIPS iPCM wideband
G.729E8k0
G.729E11k8
wideband linear PCM
wideband linear PCM with PLC
G.722 64K
G.722 56K
G.722 48K
G.722.1 32K
G.722.1 24K
G.722.2 23.85K
G.722.2 23.05K
G.722.2 19.85K
G.722.2 18.25K
G.722.2 15.85K
G.722.2 14.25K
G.722.2 12.85K
G.722.2 8.85K
G.722.2 6.6K
QCELP 8K
QCELP 13K
EVRC
SMV 8.12K
SMV 5.79K
SMV 4.44K
SMV 3.95K
AMR narrowband 12.2K
AMR narrowband 10.2K
AMR narrowband 7.95K
AMR narrowband 7.4K
AMR narrowband 6.7K
AMR narrowband 5.9K
AMR narrowband 5.15K
AMR narrowband 4.75K
iLBC 13.3K
iLBC 15.2K
MPEG Audio
MPEG4 Audio

Return to top of page Does EtherPeek VX support Windows Server 2003?

No, at this time Windows Server 2003 is not supported with EtherPeek VX.

Return to top of page Why am I not seeing the changes I made in the VoIP view?

Configuration changes in the VoIP view do not take effect unless packets are reprocessed. Packets are reprocessed by using the Edit->Reprocess All Packets menu item or by hiding and then unhiding packets via the Edit menu while the Packets view is active.

Return to top of page Can EtherPeek VX replay a call?

EtherPeek VX can only playback a single media channel and cannot playback an entire call which usually comprises of 2 or more media channels. Since VoIP quality will be different in each media channel, it is important to isolate these streams for troubleshooting.

The following audio compression formats are supported for playback: G.711, G.723, G.729, G.726, GSM-AMR, GSM-FR

For more information, please look in the online help (F1) for the Playback feature.

Return to top of page How many calls can EtherPeek VX analyze?

EtherPeek VX can analyze real time calls and saved traces files. For real time analysis, the limit is 100 simultaneous open calls. For trace file analysis, the limit is 5000 calls (packet details) and unlimited for statistics.

Return to top of page When I close the capture, all my calls are moved to closed calls. Is this correct?

Yes, open calls change to closed calls when you stop the capture. This is the way the product was designed; EtherPeek VXcloses all open calls when the capture stops. However, there is a color-code that indicates which calls closed normally and which were terminated due to capture stoppage.

Return to top of page Can I ignore signaling and only analyze media packets?

Yes. To ignore signaling:

  • On the VoIP view, click on the hammer. This will bring up the VoIP Settings window. (Note: These settings reset EVERY time. If you want to keep settings, save the Peek VX General Setup file using the Save As... button.)
  • Click the Detection tab.
  • Uncheck detect media and check verify payload.
  • Click OK.
  • Click Edit/Reprocess All Packets.

(Note: After this, you will not see signaling on the VoIP view.)

Return to top of page Why don't I see any signaling information for closed calls, even though I see the media analysis?

This is an expected result when you run EtherPeek VX after un-checking the "Detect media only according to signaling" option. Unselecting this option tells EtherPeek VX to ignore signaling and so will not have any information in the signaling section. Valid reasons to unselect this option are when the network is using encrypted and/or proprietary signaling methods.

Return to top of page Why are the closed call numbers not sequential?

The first column (No.) is only a row number and it has no other meaning. The color coding in this column does have meaning, corresponding to the color key at the top of the table. The call number is the sequence number of the call, assigned in the order in which the call was detected. The sequence always begins with call number zero (0). Calls retain their Call Number when they move from the Open Calls to the Closed Calls table.

For example, imagine there are 3 calls: call 0, call 1, and call 2. (Call 0 started first, call 1 started second, and call 2 started third.)

Call 2 closes first.
Call 0 closes second.
Call 1 closes third.

In the closed calls, the order of calls will be:
Call 2
Call 0
Call 1

Return to top of page When launching EtherPeek VX, why do I get an error that VoIP could not be initialized?

This error can sometimes point to the amount of memory in your computer. Please be sure that your system meets the required specifications.

Return to top of page How do I save my personal settings in the VoIP view?

You will need to create a VoIP Analysis Module .ini file.

  • Open EtherPeek VX
  • Start a New Capture
  • Go to the VoIP view
  • Click on the icon that has the Hammer w/ Disk
  • Choose the location to save the file and give the file a name
  • This will create a *.gst
  • Open the *.gst file in your favorite text editor

Example *.gst file

@WildPackets Setup
@Created time = Wednesday, October 26, 2005, 10:25:35.00000
@general configuration---------------------------------------
##GENERAL=
MaxRTPFrameCnt=5000
MaxRTCPFrameCnt=12
MaxOnlineSessionCnt=20
MaxOnlineSpace=512
WaitTimeout=30
Time=relative
HardwareFilter=Yes

Return to top of page How is jitter calculated?

The expert threshold is based on jitter as reported by RTCP packets. The expert converts the value in each RTCP packet to milliseconds, based on the codec (G.711, G.729. etc) being used by the RTP stream.

Return to top of page How do you calculate lost packets?

Packet Loss is calculated by looking at the RTP and RTCP headers generated by the endpoints on each side of a VoIP conversation and examining the sequence numbers in those headers. Any differences between the sequence numbers from packet to packet are counted as lost Audio packets. For instance, let’s say EtherPeek VXis examining a sequence of 200 RTP packets as part of a Voice call and the sequence number starts with 1001. If EtherPeek VXsees a gap in sequence numbers, such as 1020, 1021, 1026, 1027, 1028, it would be noted that 4 packets (1022, 1023, 1024, and 1025) were lost. If these were the only missing packets out of the 200, then the percentage of lost packets 4/200 * 100% = 2%.

Return to top of page Can EtherPeek capture error packets?

EtherPeek provides the ability to capture error packets only by installing one of the special drivers located in the "Driver" directory where you installed the program. To use these special drivers, you must have a compatible network adapter and a supported operating system configuration. Please refer to the "Readme.txt" file located in that directory. If you do not have a special driver installed, EtherPeek does not capture error packets but does provide the ability to report errors on your network if your NIC driver returns error statistics to EtherPeek. EtherPeek can provide statistics on these two error types: CRC error and Frame Alignment error (Runt and Oversize error packets are only available using the special driver). If your network adapter driver does not report error statistics, you may notice that error counts don't change in the Network Statistics window.

You will find a list of all recommended error capture cards here:

http://www.wildpackets.com/support/product_support/etherpeek/hardware_epc_other

Return to top of page Can you explain the Profiles, Configuration and Node Visibilities tabs in the Peer Map view

The Profile tab lets you save Peer Map configurations settings into a single profile that controls the appearance and layout of the Peer Map.

The Configuration tab lets you control what part of the traffic in the Capture window’s buffer is displayed in Peer Map.

The Node Visibilities tab displays node counts, and nodes that are both shown and hidden in the Peer Map. For example, if this option is set to Always Hide, then all nodes that have not had their visibility assigned by the user will be hidden. This is useful if, during a live capture, the user doesn’t want new nodes to appear on the Peer Map as they are discovered.

Return to top of page Does EtherPeek VX support Hyper-threading?

EtherPeek VX does not support Hyper-Threading. If Hyper-Threading is enabled on your computer's processors, you may encounter program errors when capturing with EtherPeek VX.

Return to top of page Why does some activity in the Peer Map contain spaces?

The space shows you where protocol segments start and stop within conversations. This option is configurable by clicking the Options button. (Different from going to Tools -> Options).

Return to top of page When I click on certain tabs within EtherPeek some text is not legible, is there a setting to adjust this?

This may be caused by a display DPI setting that is larger than 96 DPI. Confirm that the display's DPI setting is set to 96 DPI by checking the configuration for this setting in the Advanced Settings portion of the Display Control Panel.

Return to top of page How secure is EtherPeek?

Network analysis tools are powerful and must be protected from misuse. Data captured and sent across the network may be sensitive, so EtherPeek has been designed from the ground up to adhere to strict IT security requirements.

Return to top of page When I use EtherPeek to monitor my high speed network, the application tends to slow down. Are there any tips to optimize performance?

EtherPeek VX performance may degrade noticeably when more than one capture or packet file window is open. Additional captures may be performed if Voice Analysis is disabled in the Performance section of the Capture Options dialog.

In the Capture/Monitor Options, select Performance. For peak performance, right click on one of the features and choose Disable All. This way, EtherPeek will function at peak performance, but the features are still available when needed. When you need a particular feature, you can always enable it. As you enable/disable individual features, the performance bar at the bottom of the Performance Options dialog will move to show you an estimate of the impact of each feature.

Here are a few more tips to improve the performance of EtherPeek:

  • Disable the Monitor adapter (Monitor/Select Monitor Adapter/None)
  • Turn off scroll during capture. Control + K will start/stop scroll.
  • Disable passive name resolution. Under Tools/Options/Name Resolution, uncheck enable passive name resolution.
  • Turn off any automatic report production for monitor and/or capture. Under Monitor or Capture options, select Statistics Output. Uncheck Save statistics report.
  • The following component is an additional module (not included in the standard package):
  • Disable RMONGrabber (Tools/Options/Analysis Modules)

If you need one of the other features, you can enable it when you are actually viewing the capture file. Also if you're on a switched network, you can try using the switch's mirroring or monitoring capability to zero-in on the traffic you're looking for. Try only mirroring ports one by one to avoid overloading the analyzer with traffic. For more information, please see our White Paper: Applying EtherPeek to Switched and Gigabit Ethernet Network Management.

Return to top of page Does EtherPeek VX support simultaneous voice playback for both directions?

At this time, simultaneous voice playback for both directions is not supported.

Return to top of page How do I add custom VoIP ports?

To add custom ports to Peek VX, click on the VoIP tab.
In the top left, click on the hammer icon. This will launch the VoIP Settings window.
Click the Ports tab.
Click Add and enter your additional ports.
Click the >> button, then click OK on the Additional Ports window.
Click OK on the VoIP Settings window.
Click Edit/Reprocess All Packets.

Return to top of page How is one-way delay calculated?

Here is a snippet from RFC3611 that defines one-way delay:

end system delay: 16 bits

The most recently estimated end system delay, expressed in milliseconds. End system delay is defined as the sum of the total sample accumulation and encoding delay associated with the sending direction and the jitter buffer, decoding, and playout buffer delay associated with the receiving direction. This delay MAY be estimated or measured. This value SHOULD be provided in all VoIP metrics reports. If an implementation is unable to provide the data, the value 0 MUST be used. Note that the one way symmetric VoIP segment delay may be calculated from the round trip and end system delays is as follows; if the round trip delay is denoted, RTD and the end system delays associated with the two endpoints are ESD(A) and ESD(B) then:

one way symmetric voice path delay = ( RTD + ESD(A) + ESD(B) ) / 2 "

RT Delay is calculated in a couple of ways: 1) It can be calculated using RTCP SR/RR (if available) or 2) external means such as ping.

Since RT delay is a component of one-way delay and if not available, then one-way delay may not be available also.

Return to top of page Does EtherPeek with the Enhanced Voice option support playback of both sides of a phone conversation?

Although dual-direction playback is not supported within the application at this time, this can be accomplished by using one of the popular shareware audio programs available such as Awave or Audacity. The individual media steams can then be exported as .wav files into one of these programs for merging and adjacent playback.

Download a demo of OmniPeek

OmniPeek Product Family

The OmniPeek Product Family gives network engineers real-time visibility into every part of the network – simultaneously from a single interface – including Gigabit, Ethernet, 802.11 wireless, VoIP, and WAN links to remote offices.

Get Started Today