Abstract: A device, system and method is provided for tracking network communication in a multi-protocol network. During the offline phase, a linkage graph may be generated representing network communication pathways of recorded messages comprising nodes representing network communication devices and edges representing direct communication paths pairwise connecting parent-child nodes over which the messages are transmitted. The linkage graph may be optimized by eliminating or reducing branching nodes. During a real-time online phase, for each new recorded message associated with a device node, tracing a communication pathway along edges of the optimized linkage graph by linking a sequence of nodes that connect sequential pairs of child-parent nodes extending from the device node to a root node. Simultaneous to linking each node to the device node, a network traffic metric for the linked node(s) may be accumulated to quickly and efficiently track the network traffic metric for the new recorded message.