An exemplary system and method for generating a network diagram. The system includes a first interface for receiving one or more first datasets of network data. A processor configured to generate a first network diagram and identify changes in a network by overlaying one or more network diagram layers or a second network diagram on the first network diagram. The one or more network diagram layers corresponding to captured packets of the first datasets or of second datasets and the second network diagram corresponding to captured packets of the second datasets. A second interface for graphically displaying the network diagram by highlighting and/or animating one or more nodes and/or node connections based on at least one of the identified changes from the overlay.