Identifying network device uplinks

A method comprising:

• receiving, by a central server, network telemetry metrics provided by a network device and logging, by the central server, the network telemetry metrics;
• responsive to the logging, applying, by an uplink identification engine of the central server, a time series analysis to link states indicated by the network telemetry metrics to determine temporal usages of respective network interfaces of a plurality of network interfaces of the network device;
• based on the temporal usages, identifying, by the uplink identification engine, a plurality of uplink candidates corresponding to respective network interfaces of the plurality of network devices;
• classifying, by the uplink identification engine, each uplink candidate of the plurality of uplink candidates as belonging to either a first group associated with a data link layer or a second group associated with a network layer;
• evaluating, by the uplink identification engine, the plurality of uplink candidates based on the classifying, wherein the evaluating comprises accessing, by the uplink identification engine, the network device;
• and
• identifying, by the uplink identification engine and based on the evaluation, a given network interface of the plurality of network interfaces as being an uplink.