Using traffic data to determine network topology

One or more non-transitory machine-readable media comprising program code for generating a network topology with network traffic data, the program code to:

• retrieve first network traffic data which indicates traffic occurring in a first time period;
• and
• in response to identifying a first indication of traffic between a first device and a second device in the first network traffic data,
• identify a third device which captured the first indication of traffic;
• determine that a network connection between the first device and the second device is facilitated by at least the third device;
• determine a device type for the first device and a device type for the second device based, at least in part, on a communication protocol identified in the first indication of traffic;
• and
• indicate the first device and the second device in a topology in accordance with the device types and indicate the third device and the network connection in the topology.

An apparatus comprising:

• a processor;
• and
• a machine-readable medium having program code executable by the processor to cause the apparatus to:
• retrieve first network traffic data which indicates traffic occurring in a first time period;
• and
• in response to identifying a first indication of traffic between a first device and a second device in the first network traffic data, identify a third device which captured the first indication of traffic;
• determine that a network connection between the first device and the second device is facilitated by at least the third device;
• determine a device type for the first device and a device type for the second device based, at least in part, on a communication protocol identified in the first indication of traffic;
• and
• indicate the first device and the second device in a first topology in accordance with the device types and indicate the third device and the network connection in the first topology.