A method and apparatus for collecting session information from a packet routing device. The method includes the steps of detecting a header packet of a communication session within a communication stream passing through the packet routing device where the communication stream contains packets from a plurality of users, comparing a type of the detected header packet with a list of headers that are to be collected and storing a message header of the header packet and only the message header in a file indexed by an identifier of the session when the header matches an entry within the list of headers to be collected.