Nikolay Nikolaev wrote: <snip> > it's not SKYPE, i think .... it is normal? Yes. L7 relies on packet heuristics, so it may not always match the packets you're looking for. Some patterns are easier to discover and match than others.