Passive methods analysing traffic that comes into a single system are unlikely to work for you unless you have a very small network topology. Using tools like P0f or OSSIM you will learn what other subnets exist, but only if they connect to your box. You won't learn where they are in relation to each other, or even necessarily get a full picture of all the subnets in a network.
What you want to capture is the routing protocol traffic. Routers use protocols such as OSPF, EIGRP, and the like to send routing updates to each other. If you can see those you could build at least a partial network topology, how complete depends on the protocol and where your collector is in it. If you are in an OSPF stub area it will be extremely limited, if you are closer to the core it would be much more complete. Your system won't get any of this information unless you are running a span off of a network device because your system isn't participating in the routing protocol's multicast groups.