Editing My 102 232-3 notes (section)

=== Result of interceptions § 4.3.2 ===

The network operator, access provider or service provider shall provide Intercept Related Information (IRI), in relation to each target service:
<ol type="a">
<li>When an attempt is made to access the access network.</li>
<li>When an access to the access network is permitted.</li>
<li>When an access to the access network is not permitted.</li>
<li>On change of status (e.g. in the access network).</li>
<li>On change of location (this can be related or unrelated to the communication or at all times when the apparatus is switched on).</li>
</ol>

The IRI shall contain:
<ol type="a">
<li>Identities used by or associated with the target identity (e.g. dial-in calling line number and called line number, access server identity, Ethernet addresses, access device identifier).</li>
<li>Details of services used and their associated parameters.</li>
<li>Information relating to status.</li>
<li>Timestamps.</li>
</ol>

Content of Communication (CC) shall be provided for every IP datagram sent through the IAP's network that:
<ol type="a">
<li>Has the target's IP address as the IP source address.</li>
<li>Has the target's IP address as the IP destination address.</li>
</ol>

The CC Content of communication shall contain:
<ol type="a">
<li>A stream of octets for every captured datagram, containing a copy of the datagram from layer 3 upwards.</li>
</ol>
:NOTE: Due to the possibility of IP source address spoofing, the fact that an intercepted packet has the target's IP address as the IP source address does not guarantee that the packet was transmitted by the target; i.e. an intercept in place at the interface connected to the target may not include packets originating from other users spoofing the target's IP address and will not include packets from the actual target that contain a spoofed IP address.