net.tcp.service simple checks are poorly documented, especially for the service parameter.

The manual just says (section 6.2.2.5.2 as for 2.0.10):

• service - one of ssh, ntp, ldap, smtp, ftp, http, pop, nntp, imap, tcp, https, telnet

But there is no indication whether a higher level protocol has been implemented, what it would do, expect, or how it would handle protocol violations.

This leads to wrong expectations and assumptions, i.e. one could assume that "http" actually does some HTTP, i.e. sending out a HEAD or GET request and check for a HTTP xxx reply - but it doesn't. HTTP is a bare TCP connection. In contrast, ssh seems to do a real handshake.

simple.c in src/libs/zbxsysinfo/simple is the basic workhorse and might be a good starting point for reverse engineering how stuff is implemented.