was it from the client to the server or the other way around? 4172 is the pcoip protocol so it sounds like regular View trafic
you can control the PCOIP traffic by:
1- AD template of "View PCoIP General Session Variables"
View PCoIP Session Variables – pcoip.adm – Contains policy settings related to the PCoIP display protocol.
View PCoIP Client Session Variables – pcoip.client.adm – Contains policy settings related to the PCoIP display protocol that affect Horizon Client for Windows.
2- minimize the Scanning , printing and Multimedia (HD multimedia , YouTube )
use printer , USB and scanner redirection as it will compress the files
3-disable Audio, Analog audio, HD audio in Wyse thin/Zero client which is enabled by default
The Traffic is from a WYSE client to the server. However there is no one at the site during that time
usually I see that kind of traffic when someone is burning a DVD or something. did the customer upload large files from a thumb drive or DVD to his Virtual desktop?
be sure to minimize timer to logoff the session after disconnect
then in Wyse config file add below
If the user is inactive for 10 minutes the terminal shuts down. If no user ever logs into a session the terminal shuts down after 1 minute.