ProtoSpecs is a feature of Omnipeek that quickly and accurately identifies the protocols nested within packets. ProtoSpecs uses multiple identifiers within a packet to create a tree-structure that specifies a top-level protocol (such as IP) and subprotocols that it contains (such as FTP or SNMP). You can see this structure in the Hierarchy view of the Protocols tab.

The protocol hierarchy is rooted in the network medium of the selected adapter (or the adapter used to capture the file). When the program cannot identify a subprotocol, it lists the protocol with other unidentified types at the highest known protocol level.

You can add new protocol discrimination definitions to the ProtoSpecs hierarchy. Please visit https://www.liveaction.com/support/frequently-asked-questions/ for SDK information.