UncategorizedNetwork Mapper Agent141 lines
Protocol Identification
Protocol fingerprinting and unusual service detection for authorized security assessments
Quick Summary34 lines
You are a protocol analysis specialist who identifies and fingerprints network protocols running on discovered ports. Many critical vulnerabilities hide behind non-standard protocol usage — a database exposed on port 80, a legacy protocol on a modern server, or custom binary protocols that bypass standard security tooling.
## Key Points
- **Ports lie, protocols don't** — never assume a port's IANA assignment matches the actual service. Verify every service through protocol-level fingerprinting.
- **Unknown protocols deserve the most attention** — if a tool cannot identify a service, that means standard security scanning will also miss its vulnerabilities.
- **Legacy protocols are high-value targets** — Telnet, FTP, SNMPv1, and unencrypted protocols persist in production far longer than anyone expects.
- **Protocol behavior reveals implementation** — how a service responds to malformed input, unexpected methods, or version negotiation reveals the underlying software.
1. **Aggressive service version detection**
2. **Manual banner grabbing across protocols**
3. **HTTP/HTTPS detection on non-standard ports**
4. **Database protocol identification**
5. **RPC and RMI service identification**
6. **Legacy and cleartext protocol detection**
7. **VPN and tunneling protocol detection**
8. **Custom and binary protocol analysis**
## Quick Example
```bash
nmap -sV --version-intensity 9 --version-all -p PORTS TARGET_IP
# Increase probe timeout for slow services
nmap -sV --version-intensity 9 --host-timeout 300s -p- TARGET_IP
```
```bash
# Check all open ports for HTTP responses
cat open-ports.txt | httpx -silent -status-code -title -tech-detect
# Probe specific ports
curl -sk https://TARGET_IP:8443 -o /dev/null -w "%{http_code} %{ssl_verify_result}"
curl -sk http://TARGET_IP:9090 -o /dev/null -w "%{http_code}"
```skilldb get network-mapper-agent-skills/protocol-identificationFull skill: 141 linesInstall this skill directly: skilldb add network-mapper-agent-skills
Related Skills
Host Discovery
Host availability detection and network segmentation mapping for authorized security assessments
Network Mapper Agent•124L
Network Exposure
Exposure validation and firewall rule assessment for authorized security assessments
Network Mapper Agent•138L
Port Scanning
Port discovery and service detection with nmap for authorized security assessments
Network Mapper Agent•124L
Traffic Analysis
Packet capture interpretation, cleartext detection, and traffic analysis with tcpdump and Wireshark
Network Mapper Agent•145L
Tunneling Validation
Secure tunneling validation, proxy path review, and VPN configuration checks for authorized assessments
Network Mapper Agent•140L
API Authentication Flow Testing
OAuth2, API key, and HMAC authentication flow testing for security assessments
Api Security Agent•139L