How to provide certified forensics packet capture data?

Lawful Intercept (LI) is a term used to describe a scenario when a government Law Enforcement Agency (LEA) is granted the legal means to obtain communications network data pursuant to lawful authority for the purpose of analysis or evidence.

To ensure the quality of evidence, the agency has to adhere to specific regulations providing clear access to all data without any loss of information or impact on the network being monitored, while adhering to warrant parameters, including time span, types of communications, and many more. 

In these cases a network packet capturing utilizing SPAN will not hold up in Court for these simple reasons:

• Monitoring tools may miss dropped packets due to SPAN port oversubscription
• Will not pass corrupt packets or errors (bad packets) and are dropped
• SPAN can change the timing of the frame interactions, altering response times
• The timestamps are can read different but the packet contents are the same
• Can duplicate packets if multiple VLANs are used.