If you get the alert "ET INFO Session Traversal Utilities for NAT (STUN Binding Request)"

As well as the alert “ET INFO Session Traversal Utilities for NAT (STUN Binding Request On Non-Standard High Port)” on the ports 19302​–19309 it is most likely triggered by somebody using Google Meet.

See also:

Update your firewalls to allow media traffic to flow to and from your organization:
For audio and video, set up outbound UDP ports 3478 and 19302​–19309.

6 Likes

If you see the target IP as “ISP: Microsoft Azure” and the target port as UDP 3478 and 3480 it is most likely a Microsoft Teams video conference.

Check the IP with: https://geoiplookup.net/

1 Like