A procedure for evaluating a network, and a system, apparatus, and computer program that operate in accordance with the procedure. The procedure includes aggregating packet information from one or more sources in a network, and executing a correlation algorithm to determine traffic flow information based on the packet information. The aggregating includes obtaining information from a header of a packet being communicated in the network, in one example embodiment. In another example, the executing includes tracing a traffic flow from a source node to a destination node, and the tracing includes determining, based on the packet information, each link by which the traffic flow is communicated from the source node to the destination node.