You haven't mentioned what kind of budget you have, but the first and third options are worth pursuing. If you don't like what the LI feature set can do on the ASR then it's really just the SPAN option, but you can use a product from a vendor like Gigamon to slim the traffic volume down to your data capture device.
Frank -----Original Message----- From: cisco-nsp [mailto:cisco-nsp-boun...@puck.nether.net] On Behalf Of Christian Schmit Sent: Tuesday, September 09, 2014 8:46 AM To: cisco-nsp@puck.nether.net Subject: [c-nsp] Tapping a PPPoVPDN and/or PPPoE subscriber session the ASR1000 Hi, Legal authorities require that upon request we provide them with pcap files of a PPPoVPDN or PPPoE subscriber session we terminate on ASR1000 devices. I need to limit the captured data to a specific subscriber/IP address. So far I looked into: - SPAN: on the ASR1000 SPAN does not seem to offer the possibility to apply an IP access list to the SPAN session - EPC: EPC can only collect data until the buffer is full which is by far to small if a session needs to be captured/monitored over weeks - LI feature: For using the lawful intercept (LI) feature of the ASR a mediation device is required which we do not have Any hints will be appreciated. thanks, Christian _______________________________________________ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list cisco-nsp@puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/