Information about processes executing on a server together with network traffic and network state information such as ARP and routing tables is collected on each server in a network using a small piece of remote software running on the server. This information is sent to or gathered by a central collating and decoding program, which also obtains information from intervening network devices, such as routing tables, access control lists, load balancer maps and so on. This information is decoded to predict how the network traffic would look at all points in the network.