Detecting connectivity disruptions by observing traffic flow patterns

A method, comprising:

• mapping sources and destinations of anomalous data flows through a network to corresponding physical locations, wherein the anomalous data flows are identified failed Secure Sockets Layer/Transport Layer Security (SSL/TLS) handshakes, and wherein the anomalous data flows comprise data flows indicating a failure to receive an acknowledgement signal from their respective destinations;
• grouping the anomalous data flows by source and destination;
• associating the anomalous data flows with a service associated with a compute service provider;
• determining an impact of a network anomaly on the service based on the mapping;
• and
• transmitting a signal indicating the determined impact.

A system, comprising:

• a network;
• a monitoring server communicatively coupled to the network, the monitoring server operable to:
• receive network traffic data, the network traffic data comprising a plurality of data flows associated with users of the network;
• receive network topology data;
• filter the plurality of data flows to identify data flows indicating failed Secure Sockets Layer/Transport Layer Security (SSL/TLS) handshakes;
• map sources and destinations of the identified data flows to corresponding physical locations based on the network topology data;
• group the identified data flows by source and destination;
• and
• identify a service associated with a compute service provider experiencing connectivity degradation based on the mapping and grouping,
• wherein the failed SSL/TLS handshakes indicate failures of the sources of the data flows to obtain acknowledgement signals from their respective destinations.