doubt Flow Monitor

Gerardo, do you see any blocks of SIP (5060) in your Firewall log at the time that appeared in the Flow Monitor?

Cheers - Bob

hii !!

I do not have any block to sip

Phones and chat clients may have code that uses the protocol.  Are you sure you don't have any of that on your network?

Good idea, Darrell.  In 'Logging & Reporting >> Network Usage', on the 'Bandwidth Usage' tab, you can see which users had SIP traffic.

Cheers - Bob

Hi !!!

My laptop is the only device connected to the utm and I do not use sip.

Thanks !! 

It is possible the flow monitor is simply matching the port with a service rather than protocol inspection (I honestly don't know how it works), so if a service just happened to use the same port as SIP it might be inaccurately reported as SIP traffic.  Hopefully someone (Bob and lots of others) more knowledgeable than me will chime in.

It is possible the flow monitor is simply matching the port with a service rather than protocol inspection (I honestly don't know how it works), so if a service just happened to use the same port as SIP it might be inaccurately reported as SIP traffic.  Hopefully someone (Bob and lots of others) more knowledgeable than me will chime in.