Hey StackExchange! How do you all differentiate attack protocols (inclusive too layer 7s)?

Say like dns or tcp. Or something less usual like essyn or ntp? Would you guys mind listing differences? Thanks in advance StackExchange!