Abstract: Authorized interception information from a warrant of a LEA is received for a target user using an LI network packet probe device connected to a network. A set of criteria for interception is created for the target user from the authorized interception information using the probe. The set of criteria is received from the probe using an LI network packet software application running on a different networked device or virtual machine, connected to the network or a different network, and in communication with the probe. Network traffic is monitored at the Ethernet-frame level to and from the different networked device or virtual machine for packets matching the set of criteria using the application. Copies of information from monitored packets that match the set of criteria for interception are sent to the probe using the application in order to provide intercepted information about the target user to the LEA.