## 5 Discussion and Use Cases
### Blocking List of Servers  
While performing all the above-mentioned activities, certain results are deduced. For example, during multiple activities, we observed a group of Signal servers that are found in the response of the DNS query. While monitoring the network packets during the Signal app opening and connection times, it was noted that the app always connects to one of the servers mentioned in the DNS query, i.e., textsecureservice.whispersystems.org. During the experimentation, a group of eight type A servers were discovered in most DNS queries as shown in Figure 17. It was also observed that an application establishes a connection \begin{table}
\begin{tabular}{c c c c c c c c c c c} \hline \hline  & & & & \multicolumn{8}{c}{**Network Forensics**} \\ \cline{4-10}
**Year** & **Authors** & **Title** & **Apps** & & \multicolumn{2}{c}{**Detecting User Activities from the Packets**} & \multicolumn{2}{c}{**IP addresses of Involved Parties**} & \multicolumn{2}{c}{**Identifified No. Server**} \\ \cline{4-10}  & & & & **Accessing the App** & **Video** & **Mes-Calling** & **Sages** & **Typing** & & \\ \hline
2015 & [PERSON] et al. [10] &
\begin{tabular}{c} _Forensic Analysis of_ \\ _WhatsApp Messenger on_ \\ _Android Smartphone_ \\ \end{tabular} & WhatsApp & No & No & No & No & No & No & No \\ \hline
2015 & [PERSON] et al. [8] & \
\begin{tabular}{c} _Network and device_ \\ _fornsic analysis of_ \\ _Android social_ \\ _messaging applications_ \\ \end{tabular} &
\begin{tabular}{c} SnapChat, \\ Wickr, BBM, \\ Tinder, and \\ 16 other apps \\ \end{tabular} & Yes & Yes & Yes & Yes & No & No \\ \hline
2015 & [PERSON] et al. [19] &
\begin{tabular}{c} _Forensics: Decrupting and_ \\ _Understanding the_ \\ _WhatsApp Call Signaling_ \\ \end{tabular} & WhatsApp & No & Yes & Yes & No & Yes & Yes \\ \hline
2016 & [PERSON] et al. [9] &
\begin{tabular}{c} _Forensic analysis of_ \\ _WeChat an Android_ \\ _smartphones_ \\ \end{tabular} & WeChat & No & No & No & No & No & No \\ \hline
2018 & [PERSON] et al. [18] &
\begin{tabular}{c} _Forensics study of IMO_ \\ _call and chat app_ \\ \end{tabular} & IMO & Yes & Yes & Yes & Yes & Yes & Yes \\ \hline
2018 & [PERSON] et al. [12] & \
\begin{tabular}{c} _Forensic Analysis of_ \\ _Encrypted Instant_ \\ _Messaging Applications_ \\ _on Android_ \\ \end{tabular} &
\begin{tabular}{c} WeChat, \\ WhatsApp, \\ Telegram, \\ Viber \\ \end{tabular} & No & No & No & No & No & No & No \\ \hline
2020 & [PERSON] et al. [29] &
\begin{tabular}{c} _What is really_ \\ _\"Happing\"? A forensic_ \\ _analysis of Android and_ _iOS Happn dating apps_ \\ \end{tabular} & Happn & No & No & No & No & No & No \\ \hline
2021 &
\begin{tabular}{c} _Encrypted Network_ \\ _Traffic Analysis of_ \\ _Stevage Application:_ \\ _A Case Study of Signal_ \\ _Messenger App_ \\ \end{tabular} & **Signal App** & **Yes** & **Yes** & **Yes** & **Yes** & **Yes** & **Yes** \\ \hline \hline \end{tabular}
\end{table} 
Table 5: A comparison of identified artifacts from encrypted network packets of the proposed and existing strategies. with one of these servers using two random ports. The details of all those servers can be found in packets details in the Wireshark as shown in Figure 18.  
The Signal app attempts to connect either with the first server using one of the two ports or with the first two servers using any of the two ports mentioned in the list of the servers. It was also noticed that one port was used to establish a connection for indicating the typing patterns while the other port was used to send the actual data in the context of text messages. There are almost 10 servers that are used to connect with clients. Chat servers found during the study are already shown in Table 3. It is also worth mentioning that server's addresses are common in each list. However, the order of these addresses may be changed.