Is SIP ever found on ports 5060? In other words, is it a service like
SMTP which is almost always found on the same port for the protocol to
work properly, or more like http which you find all over the place?
If it is almost always on 5060 (or a discrete set of ports we can
list), then boosting the rarity sounds like a reasonable option. I
think it is an important and growing protocol though, so we shouldn't
boost the rarity if it will cause a lot of misses.