Data retention probes and related methods

A data retention probe for a packet-switched, mobile telecommunications network, the mobile network being arranged to forward packets between subscriber units and a gateway node, wherein the gateway node translates internal IP addresses used within the mobile network to global IP addresses and port numbers used outside the mobile network in the global internet, the probe comprising:

• a first interface arranged to connect to an interface carrying traffic on the mobile network side of the gateway node;
• a second interface arranged to connect to an interface carrying traffic on the global internet side of the gateway node;
• a FPGA arranged to process packets on the mobile network seen via the first interface and on the global internet side seen via the second interface to create for each packet at least one fingerprint of one or more fields in the packets that are unchanged as part of the address translation performed by the gateway node and to create metadata for those packets comprising addressing information for those packets;
• a processing unit in communication with the FPGA arranged to receive from the FPGA the fingerprints and metadata and to maintain flow records for each flow of packets seen on each side of the gateway node,
• the processing unit being further arranged to compare the fingerprints of said packets in the flow records for the mobile network and global internet respectively and, where a match is found, to determine those packets to be part of the same communication session, and, where packets are determined to be part of the same communication session, create a record correlating internal IP address or a subscriber identifier within the mobile network to external IP address and port number for those packets.