Determining network topology based on packet traffic

A system comprising:

• a memory to store metadata;
• and
• a processing device to:
• receive captured packet traffic from a network device, the captured packet traffic including a plurality of packets transmitted over a network;
• detect, using metadata of the captured packet traffic, one or more communication patterns within each of one or more levels in a network stack, each communication pattern defined by characteristics of a network conversation between two components in the network, wherein the metadata of the captured packet traffic includes a source address, a destination address, and a protocol name for each packet of the captured packet traffic;
• and
• generate a topology of the network in view of the one or more communication patterns detected within each of the one or more levels in the network stack, wherein the topology of the network indicates for each component in the network:
• a type of the component, a connection between the component and one or more other components in the network, a probability that the type of the component is correct, and a probability that each connection to the one or more other components in the network is correct.

A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:

• receive captured packet traffic, the captured packet traffic including a plurality of packets transmitted over a network;
• detect, using metadata of the captured packet traffic, one or more communication patterns within each of one or more levels in a network stack, each communication pattern defined by characteristics of a network conversation between two components in the network, wherein the metadata of the captured packet traffic includes a source address, a destination address, and a protocol name for each packet of the captured packet traffic;
• and
• generate, by the processing device, a topology of the network in view of the one or more communication patterns detected within each of the one or more levels in the network stack, wherein the topology of the network indicates for each component in the network:
• a type of the component, a connection between the component and one or more other components in the network, a probability that the type of the component is correct, and a probability that each connection to the one or more other components in the network is correct.