Abstract: A method (300) and apparatus (200) are provided which automatically detects and locates network congestion and trouble in a network (102). Event notification(s) are generated (304) which alert the network to congestion or problems. Network flow information (312) and previously determined topology mapping information (302) is processed to identify the congested link (314) and an offending host (causing the problem) (318). Once identified, corrective action (or procedure) is automatically initiated and performed (322). Alternatively, an administrator may manually initiate the corrective action. Corrective action may include blocking traffic to the offending host, modifying network parameters, or otherwise restricting operation of the host within the network.