In some implementations, a method is provided. The method includes determining a physical topology of a network and monitoring network events based, at least in part, on control plane information received from one or more devices in the network. The method also includes monitoring the performance of each of a plurality of applications running on the network based, at least in part, on a set of application calls initiated by each application. When a drop in performance of an application is detected, the drop in performance is correlated with one or more of a plurality of detected network events to determine a cause of the drop in performance.