The present disclosure provides embodiments of a method, an arrangement and an entity adapted to provide a Law Enforcement Agency with payload data of an intercepted Internet Protocol flow. The payload data belongs to one or more target identities using a specific Internet service. An Mediation functionality MF3 comprises a receiver configured to receive from an Intercepting Control Element intercepted payload data belonging to one or more target identities using a specific Internet service. The mediation functionality MF3 further comprises classifying means for classifying the payload data by identifying the specific IP service to which the received payload data belongs, and marking means configured to mark each IP packet of the received payload data with a service identifier corresponding to classification of the specific IP service to which the received payload data belongs. The marked payload data offers real-time usage and analysis of the content of interest.