We found, and users also need to keep in mind, that VoIP analysis tools are oriented toward particular VoIP protocol environments such as SIP, H.323, Cisco's SCCP (also known as "Skinny"). Interpreting different call-control protocol sequences is difficult for any one VoIP analysis tool in general, because the messages vary considerably with the particular protocol used.

Additionally, there are two main ways of providing VoIP analysis - through real-time monitoring in which data is viewed on the fly or through data-capture processes where data is analyzed after the fact. Real-time monitoring shows current and/or summarized statistics on active VoIP systems and best serves as a sort of security guard, watching over VoIP traffic as it moves across the wire.

Data-capture and analysis methods record network statistics on VoIP traffic and save them for future, detailed review through the use of tools designed to enhance the analysis process. Filters - the selection criteria for catching and storing VoIP data for subsequent analysis - have often provided focus for the examination of the statistics. Most of the products tested here offer a mixture of real-time monitoring and data-capture processes.