1. A method for determining an application-level protocol of a signaling message, the method comprising: (a) receiving a signaling message copied by a network monitoring system; (b) examining a service indicator of the signaling message; (c) determining, based on the service indicator, whether more than one application-level protocol is possible; (d) in response to determining that the service indicator does not indicate that more than one application-level protocol is possible, identifying the application-level protocol based on the service indicator; and (e) in response to determining that the service indicator indicates that more than one application-level protocol is possible: (i) individually examining at least one additional attribute or group of attributes of the signaling message; (ii) determining whether the application-level protocol can be identified based on the at least one additional attribute or group of attributes; (iii) in response to determining that the application-level protocol can be identified based on the additional attribute or group of attributes, identifying the application-level protocol; and (iv) in response to determining that the application-level protocol cannot be identified based on the additional attribute or group of attributes, selecting another attribute or group of attributes and repeating steps (e)(i)-(e)(iv) for the selected attribute or group of attributes.