A method for finding a packet's routing path in a network, comprising: intercepting control messages sent by a controller to one or more switches (102, 103) in a software defined network, SDN; recording, by a proxy, the time that each control message is sent, the network latency in round trip time between the controller and one or more switches (102,103), including, at the beginning of the recording, logging a snapshot of the flow tables in the switches and the SDN network topology information; emulating a state of the SDN at a requested time; wherein the emulating a state of the SDN at a requested time comprises: identifying one or more possible routing paths through the emulated SDN by replaying the intercepted control messages to one or more emulated switches in the emulated SDN, wherein said one or more possible routing paths correspond to a requested packet injected into the SDN at the requested time; wherein identifying one or more possible routing paths comprises: reconstructing flow table states of the one or more emulated switches based on the intercepted control messages and round trip time, RTT, information, and recursively building a tree of possible routing paths by selectively replaying control messages to reconstruct flow table states of the one or more emulated switches based on the recorded time that each control message is sent in the SDN and discovering all potential next-hops by recursively applying the reconstructed flow table states of the one or more emulated switches, starting from an initial switch. intercepting control messages sent by a controller to one or more switches (102, 103) in a software defined network, SDN; recording, by a proxy, the time that each control message is sent, the network latency in round trip time between the controller and one or more switches (102,103), including, at the beginning of the recording, logging a snapshot of the flow tables in the switches and the SDN network topology information; emulating a state of the SDN at a requested time; wherein the emulating a state of the SDN at a requested time comprises: identifying one or more possible routing paths through the emulated SDN by replaying the intercepted control messages to one or more emulated switches in the emulated SDN, wherein said one or more possible routing paths correspond to a requested packet injected into the SDN at the requested time; wherein identifying one or more possible routing paths comprises: reconstructing flow table states of the one or more emulated switches based on the intercepted control messages and round trip time, RTT, information, and recursively building a tree of possible routing paths by selectively replaying control messages to reconstruct flow table states of the one or more emulated switches based on the recorded time that each control message is sent in the SDN and discovering all potential next-hops by recursively applying the reconstructed flow table states of the one or more emulated switches, starting from an initial switch. identifying one or more possible routing paths through the emulated SDN by replaying the intercepted control messages to one or more emulated switches in the emulated SDN, wherein said one or more possible routing paths correspond to a requested packet injected into the SDN at the requested time; wherein identifying one or more possible routing paths comprises: reconstructing flow table states of the one or more emulated switches based on the intercepted control messages and round trip time, RTT, information, and recursively building a tree of possible routing paths by selectively replaying control messages to reconstruct flow table states of the one or more emulated switches based on the recorded time that each control message is sent in the SDN and discovering all potential next-hops by recursively applying the reconstructed flow table states of the one or more emulated switches, starting from an initial switch.