It is software that will be used to find the anomaly packets in Voice over Internet Protocol (VoIP) devices, such as soft phones and VoIP gateways to the session initiation protocol specifications and to test the compliance and interoperability of VoIP equipment produced by different manufacturers. Network traffic is often "Different" from benign traffic in ways that can be distinguished without knowing the nature of the attack. The authors describe a two stage anomaly detection system for identifying suspicious traffic. First, they filter traffic to pass only the packets of most interest, e.g. the first few packets of incoming server requests.