Which routers carry the traffic? Do different paths share a bottleneck? Can we estimate those relationships from the traffic we observe?

Packet timings, flow records, and communication patterns provide clues. Data science helps extract those clues, while graph machine learning helps turn them into candidate network relationships.

What Does the Traffic Actually Reveal?

When a laptop communicates with a server, we can observe the conversation without seeing the complete infrastructure carrying it. Three different network views help explain this gap.

Physical topology describes actual connections between devices—such as an Ethernet cable joining two routers.

Routing topology describes the paths packets follow through intermediate devices to reach their destination.

A communication graph describes which endpoints exchange traffic. Its edges represent conversations, even when the endpoints are several network hops apart.

An observed conversation does not prove a direct physical connection.

The reconstruction task must specify which of these relationships it aims to recover. Predicting endpoint communication and discovering hidden routers require different evidence.

Figure 1. Endpoint communication is observable, while intermediate routers and paths may remain hidden.

Reading the Clues in Network Traffic

The first step is measurement. A monitoring point captures only the traffic visible at its location, so the quality and coverage of observations determine what we can infer.

Useful clues include:

• Addresses and ports: identify visible endpoints and transport-layer conversations.

• Packet sizes and counts: describe traffic volume and bursts.

• Arrival timings: reveal spacing between packets and changes in activity.

• Acknowledgement patterns: help associate transmissions with responses.

• Path delays: when measurable, help investigate shared congestion.

Packet captures provide detailed observations. Flow records summarize communication more compactly. IPFIX standardizes the export of flow information for analysis.

A Shared Bottleneck—or a Coincidence?

Imagine one source communicating with destinations A, B, and C.

Paths to A and B repeatedly slow down together, while the path to C behaves differently. A possible explanation is that A and B share a congested segment.

However, background traffic or coordinated application activity could produce similar patterns. The observation supports a hypothesis; it does not establish the exact internal topology.

Network tomography studies how end-to-end measurements can reveal internal network properties. Its central challenge is deciding whether the measurements distinguish one explanation from competing alternatives.

Correlated delays can suggest a shared path segment. They do not prove a direct connection between destinations.

From Traffic Clues to a Graph

Data science turns observations into features, such as packet rates, burst patterns, and timing summaries over selected time windows.

We then represent visible devices as nodes and observed or candidate relationships as edges. Each edge must have a clear meaning: communication, statistical similarity, or a hypothesized connection.

A graph neural network (GNN) combines these features with relational information through message passing. It learns numerical representations called embeddings, which can support predictions about missing relationships.

One possible approach is a graph autoencoder:

1. Encode: Learn embeddings from a candidate graph and its features.

2. Decode: Score possible connections using those embeddings.

3. Validate: Compare predictions with known relationships in a controlled network.

The original variational graph autoencoder demonstrated link prediction on citation networks. Applying it to network traffic requires suitable observations, networking assumptions, and separate validation.

The starting graph matters. A model can begin with observed communication or statistical relationships, but those edges cannot automatically be interpreted as physical connections.

Figure 2. Graph learning transforms observed relationships and traffic features into embeddings, then scores candidate links for validation. Conceptual illustration.

How Do We Know the Map Is Reliable?

A convincing diagram is not enough. Predictions must be compared with a known topology in a laboratory or simulation.

For link prediction, three measures help:

• Precision: How many predicted links are correct?

• Recall: How many actual links did the system discover?

• F1-score: How well does it balance precision and recall?

The model should also be tested on unseen topologies and compared with simpler statistical methods. Otherwise, it may memorize one network rather than learn transferable relationships.

The Limits of Seeing Through Traffic

Incomplete monitoring, packet loss, and routing changes can weaken the evidence. Different internal networks may also produce similar observations, leaving more than one plausible explanation.

Research such as RouteNet demonstrates graph learning for predicting network delay and loss, but supplies topology as an input. That is different from reconstructing an unknown network.

A useful inferred map could help engineers investigate shared bottlenecks and dependencies. Its value depends on clearly defined relationships, reliable measurements, and validation.

Computer networking supplies the problem and constraints. Data science extracts the evidence. Graph ML helps estimate relationships—but uncertainty remains part of the result.

References

• Network Topology Monitoring and Identifiability

• Network Topology Inference Based on Timing Meta-Data

• Variational Graph Auto-Encoders

• RouteNet: Graph Neural Networks for Network Modeling

• IPFIX Protocol — RFC 7011

Authored by Team Beyonders — Third-year B.Tech students in Computer Engineering, Vidyalankar Institute of Technology.

Trunal Patil
Varad Tardekar
Krishna Topale
Om Rokade

Under The Guidance of Dr Amit K. Nerurkar (Associate Professor, Vidyalankar Institute of Technology) And Shivani Herlekar (Assistant Professor, Vidyalankar Institute of Technology)