Netflix developed a real-time service dependency map to aid engineers in troubleshooting and understanding their distributed architecture. The system combines eBPF network flows, IPC metrics, and distributed tracing into independent graph layers. While the initial version worked locally, production revealed significant scaling challenges, including Kafka consumer lag and memory issues.The core architectural decision was a streaming-first approach, providing near real-time topology updates instead of hourly batch processing. This was crucial for incident response and live event monitoring. To handle millions of flow records per second without data loss, the system employs reactive streams with backpressure, signaling upstream components to slow down when downstream systems are overwhelmed. This ensures graceful degradation rather than crashes or data loss.The architecture uses a multi-layer design with physical storage isolation for network, IPC, and tracing layers, allowing independent optimization. The network layer's ingestion relies on a three-stage distributed aggregation pipeline. Stage 1 performs initial aggregation from Kafka, Stage 2 resolves network intermediaries (like load balancers) into direct application-level dependencies, and Stage 3 handles final aggregation, enrichment with external data, and persistence to the graph database.The three-stage pipeline was a critical evolution from an initial two-stage design, which suffered from "hot nodes" due to data concentration during intermediary resolution and enrichment. Splitting these responsibilities across three stages distributes the workload, preventing bottlenecks. Server-Sent Events (SSE) replaced gRPC for inter-stage communication due to gRPC's performance overhead, which consumed excessive CPU and memory at scale.