Amap

NMap now has a feature which allows it to figure out what service is running on a port. Amap is a predecessor and (at this point) is still more capable at identifying a specific service. SANS has a pretty decent paper on the proecess. Even the bibliography for the paper is a source of interesting reading.