doubt Flow Monitor

Gerardo, do you see any blocks of SIP (5060) in your Firewall log at the time that appeared in the Flow Monitor?

Cheers - Bob

hii !!

I do not have any block to sip

Phones and chat clients may have code that uses the protocol.  Are you sure you don't have any of that on your network?

Good idea, Darrell.  In 'Logging & Reporting >> Network Usage', on the 'Bandwidth Usage' tab, you can see which users had SIP traffic.

Cheers - Bob

Hi !!!

My laptop is the only device connected to the utm and I do not use sip.

Thanks !! 

It is possible the flow monitor is simply matching the port with a service rather than protocol inspection (I honestly don't know how it works), so if a service just happened to use the same port as SIP it might be inaccurately reported as SIP traffic.  Hopefully someone (Bob and lots of others) more knowledgeable than me will chime in.

Hii !

What kind of chat do you mean? I only use skype, facebook, etc.

I was thinking things like skype (older microsoft clients used SIP - not sure if skype does or not) or even some phone carriers will allow cell phones to use WiFi for making calls rather than cellular calls in areas where cellular service signals are not very good (some carriers even offer hardware that will enable this function when you are at home, work, etc.).

I am sorry I did not notice this before, but you are monitoring all interfaces.  Thus, you are likely seeing SIP scanning being performed on your IP from the internet.  Change your flow monitor to only your internal interface and see if it goes away.  Or, check your logs if you are logging drops and you should find several attempts to connect to SIP ports on your public IP.

In which cases should I select the interface of my WAN?

Thanks !!