We use Cisco 3560 switches and we use AVAYA 9630 IP Phones. The users PC is connectd to the IP Phone. The switch port is configured with both the LAN VLAN and the VOICE VLAN
switchport access vlan 26
switchport mode access
switchport voice vlan 206
When capturing traffic with Netflow I see a source traffic from a phone IP and it is using a high percentage of band width. We dont think it is the phone but the PC and we are trying to figure out how to better break that out so we see the true phone IP use and the true PC use that hangs off the phone.