A network monitoring system comprising: a monitoring system server (112, 301) comprising a topology maintenance agent (307,405) designed to maintain current network topology information, characterized by one or more monitoring probes (110, 111, 302) coupled to network interfaces, wherein each probe (110, 111, 302) is designed to capture data packets from the network interfaces, the monitoring probes (110, 111, 302) further comprising one or more topology analyzers (303, 402), wherein each topology analyzer (303, 402) is designed to receive the captured data packets and compare the captured data packets to a known network element list and identify new network elements that are not on the known network element list, the monitoring probes (110, 111, 302) further comprising a probe topology agent (304, 403), wherein the topology agent (304, 403) is designed to receive data from the one or more topology analyzers (303, 402) regarding the new network elements and resolve overlapping detections of a same new network element from different topology analyzers (303, 402); and wherein the monitoring system server (112, 301) is coupled to the one or more probes (110, 111, 302), the monitoring system comprising a server topology agent (305, 404) coupled to each probe topology agent (304, 403) on the one or more probes (110, 111, 302), wherein the server topology agent (305, 404) is designed to receive data from each probe topology agent (304, 403) regarding the new network elements and resolve overlapping detections of the same new network element from different probe topology agents (304, 403), the topology maintenance agent (307, 405) of the monitoring system server (11, 301) further being designed to provide updated network element lists to the probe topology analyzers (303, 402). a monitoring system server (112, 301) comprising a topology maintenance agent (307,405) designed to maintain current network topology information, characterized by one or more monitoring probes (110, 111, 302) coupled to network interfaces, wherein each probe (110, 111, 302) is designed to capture data packets from the network interfaces, the monitoring probes (110, 111, 302) further comprising one or more topology analyzers (303, 402), wherein each topology analyzer (303, 402) is designed to receive the captured data packets and compare the captured data packets to a known network element list and identify new network elements that are not on the known network element list, the monitoring probes (110, 111, 302) further comprising a probe topology agent (304, 403), wherein the topology agent (304, 403) is designed to receive data from the one or more topology analyzers (303, 402) regarding the new network elements and resolve overlapping detections of a same new network element from different topology analyzers (303, 402); and wherein the monitoring system server (112, 301) is coupled to the one or more probes (110, 111, 302), the monitoring system comprising a server topology agent (305, 404) coupled to each probe topology agent (304, 403) on the one or more probes (110, 111, 302), wherein the server topology agent (305, 404) is designed to receive data from each probe topology agent (304, 403) regarding the new network elements and resolve overlapping detections of the same new network element from different probe topology agents (304, 403), the topology maintenance agent (307, 405) of the monitoring system server (11, 301) further being designed to provide updated network element lists to the probe topology analyzers (303, 402).