In some implementations, a method is provided. The method includes receiving captured packet traffic, the captured packet traffic including a plurality of packets transmitted over a network. One or more communication patterns for each of one or more levels in a network stack are detected based on metadata of the captured packet traffic, each communication pattern indicating communication between two components in the network. The method further includes generating a topology of the network in view of the one or more communication patterns detected for each of the one or more levels in the network stack.