A method comprising: collecting (501, 502), by a network analysis system, flow data for a network having a plurality of network devices and a plurality of virtual networks established within the network, wherein the flow data includes underlay flow data comprising a plurality of underlay data flows and overlay flow data comprising a plurality of overlay data flows, wherein the underlay flow data and the overlay flow data are collected during the same time period, wherein the underlay flow data identifies, for each underlay data flow included within the underlay flow data, the network devices that have processed network packets associated with the underlay data flow including one or more intermediary network devices between source and destination of the underlay data flow, and wherein the overlay flow data identifies, for each overlay data flow included within the overlay flow data, one or more of the virtual networks associated with the overlay data flow; storing, by the network analysis system, the flow data in a data store; receiving, by the network analysis system, a request for information about a data flow, wherein the request for information specifies a source virtual address for the data flow, the source virtual address identifying a source virtual network, and further specifies a destination virtual address for the data flow, the destination virtual address identifying a destination virtual network; and querying, by the network analysis system, the data store with the specified source virtual address and the specified destination virtual address to identify, based on correlations between the underlay flow data and the overlay flow data, one or more network devices of the plurality of network devices that have processed at least one packet in the data flow and one or more likely underlay data paths from the source virtual network to the destination virtual network taken by the at least one packet in the data flow. collecting (501, 502), by a network analysis system, flow data for a network having a plurality of network devices and a plurality of virtual networks established within the network, wherein the flow data includes underlay flow data comprising a plurality of underlay data flows and overlay flow data comprising a plurality of overlay data flows, wherein the underlay flow data and the overlay flow data are collected during the same time period, wherein the underlay flow data identifies, for each underlay data flow included within the underlay flow data, the network devices that have processed network packets associated with the underlay data flow including one or more intermediary network devices between source and destination of the underlay data flow, and wherein the overlay flow data identifies, for each overlay data flow included within the overlay flow data, one or more of the virtual networks associated with the overlay data flow; storing, by the network analysis system, the flow data in a data store; receiving, by the network analysis system, a request for information about a data flow, wherein the request for information specifies a source virtual address for the data flow, the source virtual address identifying a source virtual network, and further specifies a destination virtual address for the data flow, the destination virtual address identifying a destination virtual network; and querying, by the network analysis system, the data store with the specified source virtual address and the specified destination virtual address to identify, based on correlations between the underlay flow data and the overlay flow data, one or more network devices of the plurality of network devices that have processed at least one packet in the data flow and one or more likely underlay data paths from the source virtual network to the destination virtual network taken by the at least one packet in the data flow.