The claimed subject matter provides a system and/or a method that facilitates managing a network by mining a communication rule. An analysis engine can employ a packet trace within a network in order to provide timing information, wherein the network includes at least one of a host, a protocol, or an application. A traffic evaluator can extract a communication rule for the network based upon an activity matrix generated from the timing information in which the activity matrix includes at least one of a row of a time window for the packet trace and a column for a flow in the packet trace.