A system and method of tracking high-level network transactions. At least one switching node on a network may collect low-level data packets, the low-level data packets forming collectively a corresponding stream of high-level messages as parts of high-level transactions involving network resources of the network. Identifiers of the network resources in the network serving the high-level transactions may be identified from the low-level data packets. The data content of the high-level messages may be determined. The high-level messages may be grouped into groups of high-level messages having similar data content. Commonalities in the occurrences of high-level messages having different data content may then be identified.