There is provided apparatus including at least one pre-capture filter, operative to receive at least some of a plurality of packets transmitted in a network, and to identify an application type of each of the received packets and a plurality of application-type specific post capture filters, each associated with at least one of a plurality of application-type specific monitoring stations, the plurality of application-type specific post capture filters being operative to receive from the at least one pre-capture filter packets of a specific application type and to transmit the packets of the specific application type to the at least one of the plurality of application type specific monitoring stations associated therewith.