Abstract: A method, a computer program product and a device, the method may include: receiving a first signature and first control metadata; the first control metadata is indicative of at least one control plane message that was exchanged between a RAN and a core network and was intercepted by a probe; the at least one control plane message relates to a first entity that belongs to or is coupled to the RAN; processing information packets received by a policy enforcer to provide information packet signatures, the information packets undergone an address translation process before being received by the policy enforcer; and enforcing a policy associated with the first entity, the enforcing affects an information packet that is associated with an information packet signature that equals the first signature; wherein the address translation process does no corrupt the first signature.