1. A method for determining an application-level protocol of a signaling message, the method comprising: at a site collector including at least one application embodied in a non-transitory computer readable medium for: (a) receiving a signaling message copied by a network monitoring system; (b) examining a service indicator of a message signaling unit (MSU) in the signaling message; (c) determining, based on the service indicator, whether more than one application-level protocol for the signaling message is possible; (d) in response to determining that the service indicator does not indicate that more than one application-level protocol is possible, identifying the application-level protocol based on the service indicator; and (e) in response to determining that the service indicator indicates that more than one application-level protocol is possible: (i) individually examining at least one additional attribute or group of attributes of the signaling message, wherein the at least one additional attribute or group of attributes of the signaling message to be examined is selected based on distinguishing features of application-level protocols; (ii) determining whether the application-level protocol is identifiable based on the at least one additional attribute or group of attributes; (iii) in response to determining that the application-level protocol is identifiable based on the additional attribute or group of attributes, identifying the application-level protocol; and (iv) in response to determining that the application-level protocol is not identifiable based on the additional attribute or group of attributes, selecting another attribute or group of attributes and repeating steps (e)(i)-(e)(iv) for the selected attribute or group of attributes.