one of the nice way to network map a site would be to use a tool like etherape and view the actual protocal transversing across the network, since you know that only specific port and protocol would run from the server. even this is still a long shot since many honeynets could spoof this as well.

w0rm3y