A computer-implemented method comprising: receiving, by a first Layer 3, L3, networking device of a network management system in a first L3 network, a first mapping of an L3 network address to a first Layer 2, L2, network address from a second L3 networking device in a second L3 network; querying, using the first L2 network address as a key or index for the query, at least one of a database including L2 network addresses for networking devices of the second L3 network or a database including L2 network addresses for endpoints of the second L3 network; based on the querying using the first L2 network address, determining, by the network management system, that the first L2 network address corresponds to a third L3 networking device; receiving, by the network management system, a second mapping of the L3 network address to a second L2 network address from the third networking device; querying, using the second L2 network address as a key or index for the query, at least one of the database including L2 network addresses for networking devices of the second L3 network or the database including L2 network addresses for endpoints of the second L3 network; based on the querying using the second L2 network address, determining, by the network management system, that the second L2 network address corresponds to an endpoint in the second L3 network; storing, by the network management system, the L3 network address and the second L2 network address as an identity of the endpoint; and presenting, by the network management system, network utilization information of the endpoint using network traffic to and from the L3 network address correlated to the endpoint based on the identity of the endpoint. receiving, by a first Layer 3, L3, networking device of a network management system in a first L3 network, a first mapping of an L3 network address to a first Layer 2, L2, network address from a second L3 networking device in a second L3 network; querying, using the first L2 network address as a key or index for the query, at least one of a database including L2 network addresses for networking devices of the second L3 network or a database including L2 network addresses for endpoints of the second L3 network; a database including L2 network addresses for networking devices of the second L3 network or a database including L2 network addresses for endpoints of the second L3 network; based on the querying using the first L2 network address, determining, by the network management system, that the first L2 network address corresponds to a third L3 networking device; receiving, by the network management system, a second mapping of the L3 network address to a second L2 network address from the third networking device; querying, using the second L2 network address as a key or index for the query, at least one of the database including L2 network addresses for networking devices of the second L3 network or the database including L2 network addresses for endpoints of the second L3 network; the database including L2 network addresses for networking devices of the second L3 network or the database including L2 network addresses for endpoints of the second L3 network; based on the querying using the second L2 network address, determining, by the network management system, that the second L2 network address corresponds to an endpoint in the second L3 network; storing, by the network management system, the L3 network address and the second L2 network address as an identity of the endpoint; and presenting, by the network management system, network utilization information of the endpoint using network traffic to and from the L3 network address correlated to the endpoint based on the identity of the endpoint.