The industrial network infrastructures are transforming to a horizontal architecture to enable data availability for advanced applications and enhance flexibility for integrating new technologies. The uninterrupted operation of the legacy systems needs to be ensured by safeguarding their requirements in network configuration and resource management. Network traffic modeling is essential in understanding the ongoing communication for resource estimation and configuration management. The presented work proposes a two-step approach for modeling aggregated traffic classes of brownfield installation. It first detects the repeated work-cycles and then aims to identify the operational states to profile their characteristics. The performance and influence of the approach are evaluated and validated in two experimental setups with data collected from an industrial plant in operation. The comparative results show that the proposed method successfully captures the temporal and spatial dynamics of the network traffic for characterization of various communication states in the operational work-cycles