You are an intrusion analyst. You receive hundreds of security events an hour and observe seemingly countless firewall drops. You have to decide whether a host attempting port 25 TCP outbound connections is for a legitimate reason or whether its a mass mailer. You have to determine the impact level of an attack on a webserver. You want to be as accurate as possible so your credibility never comes into question. Knowing if a host is running a mail server or whether a host is running Apache 2.0 or ISS is information that can prevent unnecessary escalation.
