[andreas.sikkema@xxxxxxxxxxx]

> SSH traffic is likely to look like random bytes; I suspect the
> heuristics for Q.931 aren't strong enough to filter out that random
> traffic.

Probably yes, the current Q.931 heuristics are very basic.

It might help if the heuristics should also check if source or 
destination port is 1720.

-- 
Andreas Sikkema
andreas.sikkema@xxxxxxxxxxx
"Standing barefoot in a river of clues, most people would 
         not get their toes wet." - Brian Kantor in a.s.r.