Network devices, systems, and methods are described that perform network service monitoring. One method includes examining a number of packets received by a first network device to determine whether a protocol of a packet corresponds to a given network service, forwarding packet service type information and packet address information to a second network device in response to a determination that the protocol of the packet corresponds to the network service, comparing the packet service type information and an associated service type address to a list of service types and addresses on the second network device, and executing a remedial action if, based on the comparing, it is determined that the network service is an unauthorized service and that a provider of the network service is an unauthorized provider.