did you update the l7 protocol definitions to the latest version? It helped me to make zeroshell identifying SIP packets…
You can download the latest definitions at sourceforge.net
latest files are from: 28.05.2009
Download the file, rename it to l7-protocols.tgz and place it in the following directory on your zeroshell box
After that, you need to reboot the system.
PS: You can verify the update by checking the top left corner of the “L7 Filter Manager” window… Now it should show something like “l7-protocols-2008-XXX”, after the update it should show “l7-protocols-2009-05-28”