If the device is doing NAT, it already keeps track of whether a TCP connection is new or not. It feels like it should be easy enough to check that state when ap

If the device is doing NAT, it already keeps track of whether a TCP connection is new or not. It feels like it should be easy enough to check that state when applying the ALG rule. Or can a SIP REGISTER happen in a packet after the first?