A method, article of manufacture, and system for indicating underutilized network devices that provide services in a data communications network. The method includes: receiving network traffic data; filtering the network traffic data to eliminate data for predefined connections; producing, from the filtered network traffic data, a graph representing a connection between a first device and a second device within the data communications network; analyzing the graph to identify a set of interconnected nodes that is outside the data communications network; and indicating an underutilized network device by producing an output dependent on traffic rate data associated with a link to the identified set of interconnected nodes that is outside the data communications network.