A system and method of classifying a set of internet protocol network data traffic as likely or unlikely to contain constant-packet-rate data or VoIP traffic using frequency spectrum analysis of data packet arrival times. The method is performed with an apparatus connected in-line on the network link from which the set of network data traffic is obtained. The network data traffic is presorted by packet size, source IP address, destination IP address, source port number, destination port number, or transport-layer protocol to limit the required analysis. A sliding window function is used to provide the time-domain input data to the frequency spectrum analysis. A threshold function is used to detect peaks in the calculated frequency spectrum that indicate constant-packet-rate traffic. An automated system preferably captures the network data traffic from one or more network links, immediately performs the frequency spectrum analysis on the data traffic and stores the results in memory for later access.