Network interaction analysis is disclosed. Traffic is monitored including a network interaction. Monitoring includes monitoring at least one of TCP, HTTP, or IP layer information. The network interaction is analyzed based at least in part on a source of a transaction determined from the layer information.