A system, method, and apparatus for collecting data streams, such as data packets, on a network, such as the Internet, are disclosed. A metadata portion of at least one of the data streams is analyzed on the network and evaluated using a metadata processing engine to identify a relationship between at least two of the plurality of data streams, e.g., a relationship between multiple users of a network, regardless of whether the users are currently of interest or if they are not of interest. An interface manager can receive an information of a new user of interest, evaluate the new user of interest for redundancy against existing known users of interest of the NMS; then communicate the information of the new user of interest to at least one access device to collect data streams associated with the new user of interest.