A computer-implemented method for determining a location of a network error in a network of servers, comprising: receiving and storing in a database transmission control protocol, TCP, telemetry data including associated geo-tags for a plurality of servers (18, 50) in the network; upon determining that a network error is encountered at a source server of the plurality of servers: retrieving the TCP telemetry data and associated geo-tags during a first period before the network error began and during a second period after the network error began or ended for the source server; and identifying comparison servers of the plurality of servers communicating with the source server and retrieving the TCP telemetry data and associated geo-tags during the first period before the error began and during the second period after the error began or ended for the comparison servers; performing at least one function on the TCP telemetry data and associated geo-tags for at least one of the source server and the comparison servers, including normalizing the TCP telemetry data and associated geo-tags for the source server and the comparison servers; generating, by a differential data analyzing application, a table including normalized metrics for the source server arranged adjacent to normalized metrics for the comparison server; comparing, by a trend analysis application, the normalized metrics for the source server and the comparison servers to predetermined values; and generating, by the trend analysis application, a proposed diagnosis for the network error based on the comparison of the normalized metrics, including determining a location of the network error. receiving and storing in a database transmission control protocol, TCP, telemetry data including associated geo-tags for a plurality of servers (18, 50) in the network; upon determining that a network error is encountered at a source server of the plurality of servers: retrieving the TCP telemetry data and associated geo-tags during a first period before the network error began and during a second period after the network error began or ended for the source server; and identifying comparison servers of the plurality of servers communicating with the source server and retrieving the TCP telemetry data and associated geo-tags during the first period before the error began and during the second period after the error began or ended for the comparison servers; retrieving the TCP telemetry data and associated geo-tags during a first period before the network error began and during a second period after the network error began or ended for the source server; and identifying comparison servers of the plurality of servers communicating with the source server and retrieving the TCP telemetry data and associated geo-tags during the first period before the error began and during the second period after the error began or ended for the comparison servers; performing at least one function on the TCP telemetry data and associated geo-tags for at least one of the source server and the comparison servers, including normalizing the TCP telemetry data and associated geo-tags for the source server and the comparison servers; generating, by a differential data analyzing application, a table including normalized metrics for the source server arranged adjacent to normalized metrics for the comparison server; comparing, by a trend analysis application, the normalized metrics for the source server and the comparison servers to predetermined values; and generating, by the trend analysis application, a proposed diagnosis for the network error based on the comparison of the normalized metrics, including determining a location of the network error.