Detecting connectivity disruptions by observing traffic flow patterns

Network connectivity disruptions impacting users of a network, can be detected based on patterns in user network traffic and network topology data, e.g., by a monitoring server computer. Logged network traffic data can be filtered to identify anomalous data flows. The anomalous data flows can be data flows indicating connection timeouts such as failed Secure Sockets Layer/Transport Layer Security (SSL/TLS) handshakes. Sources and destinations of the anomalous data flows can be mapped to corresponding physical locations using the network topology data, and the anomalous data flows can be grouped by source and destination, in order to determine an impact or scope of a network connectivity disruption. Users of the network can be notified regarding the network connectivity disruption, and optionally, actions can be taken to reduce the impact of the network connectivity disruption.