Are you looking specifically for the waterfall protocol? I actually figured it out before I received the updated protocol list. The updated protocol list confirmed what I knew already. How I did it was by sending AAA to ZZZ to the scanner and watching the returned data.
You effectively built a fuzzer for the protocol list. Brilliant.