What it detects
Application protocol differing from the port/direction expectation.
Why it fires
A signal of non-standard-port services or protocol tunneling (evasion).
Worst case
Port-bypass tunnel
Matching signatures
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.