Abstract: In a mobile network a packet interface (103) is monitored by a tap (160-163) in a non-intrusive manner. Captured transaction data is uploaded to a probe (155-158) linked to one or more taps. The probe acts as a slave to a server (159), activating and terminating data capture. A coordinator (601) of the probe (155) manages data capture and buffering according to the server. The server (150) filters the data according to a subscriber registry (203) and loads data until there are complete protocol descriptions. These provide real time subscriber-centered QoS metrics.