Hi,
did you update the l7 protocol definitions to the latest version? It helped me to make zeroshell identifying SIP packets…
You can download the latest definitions at sourceforge.net
http://sourceforge.net/projects/l7-filter/files/
latest files are from: 28.05.2009
Download the file, rename it to l7-protocols.tgz and place it in the following directory on your zeroshell box
/var/register/system/net/L7/
After that, you need to reboot the system.
cheers
PS: You can verify the update by checking the top left corner of the “L7 Filter Manager” window… Now it should show something like “l7-protocols-2008-XXX”, after the update it should show “l7-protocols-2009-05-28”