Abstract: A system monitors packet data communications passing a network hub or port mirror, for example running on a network server or an appliance or as a set of distributed processes. A processor effects a programmed network probe method as a passive listener or sniffer. Packet data is selectively processed based on message protocol, content, addressing and similar criteria. Selected packets are re-assembled without packet formatting. Data servers temporarily store the content of selected data messages in a buffer for reference, and can index and permanently store data messages in an archive . A console and communication processes enable selection criteria to be set and revised, can be used to access stored messages, and provides alarms, logs and reports. The system enables monitoring of communications for compliance with policies, security watching and the like, without disrupting regular operations on the network.