An apparatus and a method for processing a received data packet are provided. The method involves determining whether the received data packet is to be recorded and applying to the packet a virtual LAN identification tag from a first group of one or more predetermined virtual LAN identification tags if it is determined that the packet is to be recorded. A recording management system is also provided, including an apparatus and a forwarding network element. The forwarding network element is arranged to inspect as received data packet and determine a virtual LAN identification tag of the packet. The forwarding network element is further arranged to cops the data packet if the virtual LAN identification tag of the packet is in the first group and to send the copy of the data packet to a recording element.