NetHero

Overview

NetHero is a Windows-native VoIP and network diagnostics platform. Download a scanner, press Scan, and get a plain-English report of every problem found — in about two minutes, with no technical knowledge required.

Every scan automatically saves a detailed report and a diagnostic log file to your computer. If you connect the scanner to the web dashboard, both files upload automatically so your team can view results, history, and logs from any browser.

What NetHero includes

Quick Start

The fastest way to get a diagnosis is to download and run the Portable Scanner. It takes about 30 seconds to set up and about 2 minutes to complete a scan.

Run your first scan in 3 steps

NetHero Scanner

The NetHero Scanner (nethero.exe) is a self-contained Windows command-line application. It is a single file — nothing is installed, nothing is left behind. Download it, run it from any folder, and take it with you on a USB drive.

The interface

The application has two panels. The left panel is where you enter scan settings. The right panel displays results after the scan completes.

• Target host — the IP address or hostname to scan. Leave blank to use Quick Scan, which auto-detects your network’s default gateway.
• Profiles — optionally select a device or deployment profile to compare results against a known-good baseline (e.g., Cisco CUCM, Zoom Phone).
• Probe toggles — enable or disable individual checks (SIP ALG detection, DHCP monitoring, RTP port probing, network discovery).
• Evidence box — paste in log snippets, SIP traces, or any other text from the affected system. NetHero extracts facts from it automatically.

What gets checked

Assessment and health score

After all checks complete, the scanner runs an assessment engine that produces:

• Health Score (0–100) — an overall score for the phone system environment
• Grade (A–F) — a letter grade matching the health score
• MOS Estimate — a predicted Mean Opinion Score for call quality (1.0–5.0)
• Top Fix — the single most impactful action to improve the score

Dashboard connection

The Portable Scanner can connect to the web dashboard to automatically upload scan results and diagnostic logs after every scan. Connection is set up once using a one-time authorization code:

1. Open NetHero. A short code appears in the top-right corner (e.g., BXKP-QZRM).
2. Your browser opens automatically to the dashboard authorization page. Sign in and enter the code.
3. Click Authorize. The scanner shows “Connected” in green.
4. From this point, every scan uploads automatically — no further action needed.

Understanding Results

Every scan produces a list of findings — specific conditions the scanner observed that are problems, risks, or deviations from the expected baseline for your phone system.

Severity levels

What each finding contains

• Summary — one sentence describing what was found
• What was found — the specific measured value, response, or condition that triggered the finding
• Why it matters — plain-English explanation of how this affects call quality or reliability
• Evidence — the raw probe data, packet result, or device observation that supports the finding
• Fix steps — a numbered list of exactly what to do to resolve the issue

Report & Log Files

Both scanners automatically write two files to the same folder as the .exe after every scan. No configuration is needed.

Web Dashboard

The web dashboard is a browser-based portal that aggregates scan results from your scanners, shows trends over time, and provides access to all advanced features. It requires an approved account to access.

Signing in

Access requires a Google account. Click Sign In with Google on the login page. New accounts are placed in a pending state and must be approved by an administrator before access is granted.

API access

PCAP Analyzer

The PCAP Analyzer reconstructs VoIP call flows from packet capture files. Upload one or two .pcap or .pcapng files, optionally describe a specific call that had problems, and NetHero identifies the exact failure point and explains what happened.

What gets detected

• SIP failure codes — 401 (auth), 403 (policy block), 404 (not found), 486 (busy), 488 (codec mismatch), 503 (server unavailable)
• One-way audio — RTP flowing only in one direction, typically caused by NAT or a firewall asymmetry
• RTP dropout — audio stream stops mid-call or never starts after the call is answered
• Codec mismatch — the offered codecs and accepted codecs have no overlap
• SIP ALG corruption — SIP headers that have been rewritten by a router in a way that breaks the call

Templates

Templates define what a healthy deployment looks like for a specific type of phone system or device. Each template ships with a set of Checks — rules that tell the scanner what to test and what conditions count as a problem. Templates and checks are version-controlled YAML files stored in the profiles/ directory.

Template structure

profile_id: cisco_spa504g
name: Cisco SPA504G
vendor: Cisco
category: sip_phone
recommended_settings:
  sip_port: 5060
  dtmf_mode: rfc2833
compatibility_notes: >
  SIP ALG must be disabled on the router.
  Requires G.711 codec support on the trunk.

Checks

Checks are detection rules attached to a template. Each check specifies the field to test, the comparison operator, and the threshold value. When a scan result matches all conditions in a check, the finding is surfaced in the report with the check's severity and recommended action.

- id: sig_sip_auth_fail
  name: SIP Auth Failure
  severity: error
  confidence: high
  conditions:
    - field: sip_auth_failure
      operator: "=="
      value: true
  plain_english: The phone could not log into the SIP server.
  action: Verify the SIP username, password, and server address.

PCAP Analysis

Upload a packet capture on the PCAP page to get an AI-assisted root cause analysis. The PCAP analyzer inspects SIP dialog flow and RTP streams and classifies every finding as VERIFIED, INFERRED, or UNCONFIRMED so you always know how certain the conclusion is.

• VERIFIED — confirmed directly from packet evidence (e.g., 401 Unauthorized with no retry)
• INFERRED — strongly implied by the evidence (e.g., one-way audio with NAT mismatch in SDP)
• UNCONFIRMED — possible based on symptoms but not directly observable in the capture
• NOT_OBSERVABLE — would require evidence not present in this capture to confirm

Common VoIP Problems

FAQ