Signal 4: Protocol Pattern Changes — Feb 2026
Report date: 2026-03-11
Analysis period: Feb 2026 (2026-02-01 –
2026-02-28)
Baseline period: Aug 2025–Jan 2026 (2025-08-01 –
2026-01-31)
Scope: Top 30 revenue accounts
Revenue concentration: Top 30 = USD 2,883,129 of USD
3,393,629 total (85.0% of monthly revenue)
Signal Guide
Protocol pattern changes compare the set of application protocols observed for each account over the 6-month baseline against the current analysis month.
- Dropped protocols — a protocol was observed in the baseline but not in the current month. This could indicate fleet decommissioning, technology migration, or seasonal patterns.
- Gained protocols — a protocol appeared in the current month that was not in the baseline. This could indicate new deployments, firmware updates, or testing activity.
Protocol changes are informational — they surface shifts in how an account uses the network so account teams can evaluate them in context. Not all changes indicate risk.
| Indicator | Icon | Meaning |
|---|---|---|
| Noted | 🟠 | Protocol pattern changed — review in context of account relationship |
Executive Summary
🟠 29 of Top 30 accounts showed protocol changes in Feb 2026 compared to the Aug 2025–Jan 2026 baseline. — 28 accounts dropped protocols — 1 account gained protocols only — 1 account had stable protocol fingerprints. ℹ️ 2 protocols excluded as platform-wide changes (dropped by >50% of accounts with drops): HTTP, Secure MQTT.
Protocol Changes — Feb 2026
| Account | Revenue (Feb 2026) | Protocols Dropped | Protocols Gained | |
|---|---|---|---|---|
| 🟠 | PeopleNet Communications Corp | USD 1,083,518 | FTP, FTP Control, LDAP, RTSP, SLP, SMB, SMTP Receive, WHOIS | POP3 over TLS |
| 🟠 | Spiro Mobility Holdco DMCC | USD 296,468 | SSH, TFTP | IMAP over TLS, SMB Microsoft, rLogin |
| 🟠 | React Health, formerly 3B Medical, Inc. | USD 281,068 | IMAP over TLS, RTSP, SMB Microsoft | — |
| 🟠 | WQ Technologies | USD 187,038 | FTP, FTP Control, IMAP over TLS, MQTT, RPC, SSH, Telnet | IPP |
| 🟠 | Visiontrack | USD 110,077 | FTP, MQTT over TLS, POP3 over TLS, SMTP Send, SNMP, WINS, rExec | SSH |
| 🟠 | SolarEdge | USD 107,514 | FTP, IMAP, Kerberos, MQTT, POP2, POP3, RPCoHTTP, SMB Microsoft, SMTP, SSH, Telnet over TLS | SMTP Receive, SMTP Send |
| 🟠 | LiveFree Emergency Response, Inc. | USD 89,415 | FTP | — |
| 🟠 | IND Technology Inc. | USD 58,208 | MQTT | — |
| 🟠 | Prospera_Valmont_AgSense | USD 57,917 | Bonjour, DHCP, MQTT, MQTT over QUIC, NETBIOS, RTP/R6, RTSP, WINS, mCast DNS | — |
| 🟠 | AddSecure Group Services AB (formerly Verilocation Tracking Solutions) | USD 55,485 | FTP, MQTT, NFS, SNMP | FTP Data, SMTP, SSH, Telnet, WHOIS |
| 🟠 | Greenlight Planet Inc (SunKing) | USD 45,971 | FTP Control | MQTT, RTP/R6 |
| 🟠 | Engie Mobisol GmbH (Formerly Fenix International) | USD 36,314 | FTP, IMAP over TLS, Kerberos, SMTP Receive, TFTP | — |
| 🟠 | Deltatrak, Inc | USD 35,153 | MQTT over QUIC | MQTT, NFS |
| 🟠 | Bboxx | USD 34,235 | FTP Control, Kerberos, MQTT, MQTT over TLS, mCast DNS | IPP |
| 🟠 | LB Technology Inc (dba LB Telematics) | USD 32,184 | FTP, ModBus | IMAP over TLS, SNMP |
| 🟠 | SUZOHAPP (formerly known as Coin Acceptors) | USD 28,110 | FTP, MQTT | — |
| 🟠 | Trakm8 Ltd | USD 24,624 | FTP, FTP Control, Telnet, WHOIS | — |
| 🟠 | IONX LLC | USD 24,307 | FTP, FTP Control, HTTPS, MQTT over QUIC, rLogin | — |
| 🟠 | BDLogix | USD 23,818 | DHCP, FTP, IPP, MQTT over QUIC, RPC, WINS | — |
| 🟠 | Trimble Hosting Services | USD 21,989 | HTTP/3 over QUIC | — |
| 🟠 | Engie Mobisol GmbH | USD 21,821 | FTP, IMAP over TLS, Kerberos, MQTT, MQTT over TLS, NETBIOS, TFTP | WINS |
| 🟠 | Graco Inc. (Applied Fluid Technology) | USD 21,322 | NFS | — |
| 🟠 | Transpoco | USD 21,203 | DHCP, DNS over QUIC, DNS over TLS, FTP, IMAP, IRC, Kerberos, Kerberos5, MQTT, ModBus, NFS, POP2, PTP, RPCoHTTP, RTSP, SMTP Receive, SNMP, SQL-Net, SSH, WINS, rLogin | — |
| 🟠 | Tenovi Health | USD 20,821 | HTTPS, Telnet, rLogin | — |
| 🟠 | Axon Telematics (Ireland) Ltd. | USD 20,312 | HTTP/3 over QUIC | Kerberos, MQTT over TLS |
| 🟠 | AVAS | USD 16,124 | HTTP/HTTP2 | Kerberos4 |
| 🟠 | Bobcat | USD 16,100 | DHCP | — |
| 🟠 | Hello Tractor | USD 15,535 | HTTPS, RTP/R6 | mCast DNS |
| 🟠 | Vivint Solar | USD 19,703 | — | NFS |
Full protocol sets (baseline and current) are available in the Excel output.
How to read this table: Dropped protocols were observed during the 6-month baseline but not in the current month. Gained protocols appeared in the current month but were not seen in the baseline. Review changes in context — a dropped protocol may reflect a planned migration, seasonal pattern, or fleet change.
Platform-Wide Protocol Changes (Excluded from Account Flagging)
The following protocols were dropped by more than 50% of accounts with protocol drops. These likely reflect platform-level changes (reclassification, infrastructure updates, or protocol deprecation) rather than individual account behavior, and are excluded from account-level flagging:
- HTTP — dropped by 26 of 30 accounts
- Secure MQTT — dropped by 19 of 30 accounts
Note: A widespread “drop” often indicates that traffic previously classified under one protocol name is now classified differently (e.g. HTTP → HTTP/HTTP2), not that the underlying communication ceased.
Methodology Notes
- Network source:
aeriscom-acpcmn-prod-202006.cmp_sec.daily_account_network_summary—application_protocolsfield (comma-separated) - Revenue source:
sawg-summit-2019-240716.direct_customers_analytics.fact_revenue— Feb 2026 invoice amount (used for Top 30 ranking) - Analysis period: Feb 2026 (2026-02-01 – 2026-02-28)
- Baseline period: Aug 2025–Jan 2026 (2025-08-01 – 2026-01-31, 6 calendar months)
- Scope: Top 30 revenue accounts (85.0% of total monthly revenue)
- Platform-wide filter: Protocols dropped by >50% of accounts with drops are excluded from account-level flagging
- Protocol parsing: The
application_protocolsfield is split on,(comma-space). Each distinct value observed in the date range is included in the protocol set. - Baseline accumulation: The 6-month baseline includes any protocol observed at least once. This generous window reduces false positives from intermittently-used protocols.
- Full methodology: See
s4_protocol_changes/methodology.md
Generated: 2026-03-11 | Signal 4 v1.0