Aspects of the present disclosure involve methods and systems for mapping network service paths between endpoint devices of a network. An aggregate network traffic database is used to store network traffic data retrieved from network devices of a network. A network service mapper then queries the database using endpoint device identifiers corresponding to endpoint devices to determine which network devices interacted with the endpoint devices during provisioning of previous network service instances. The set of network devices is then compared and analyzed to determine one or more network service paths between a pair of endpoint devices. In certain implementations, network architecture rules and/or network device configuration data is also analyzed to determine an order of the network devices along the one or more network service paths.