A method of analysing a network having a plurality of computing and infrastructure elements, some of which run agents that monitor one or more network phenomenon, the method comprising the steps of: disabling a selected infrastructure element on which it is not possible to run a monitoring agent; acquiring data from an element adjacent a disabled element; and generating, from the acquired data, a signature representative of the selected element being inoperative.