A method for monitoring tunneled Internet Protocol, IP, traffic in a communications network, the method comprising steps of: monitoring tunnel signaling flows to determine relationships between tunnels and subscriber sessions for each established tunnel; analyzing GTP, GPRS - General Packet Radio Service - Tunneling Protocol, packets in a GTP session to determine whether Fully Qualified Tunnel Endpoint Identifiers, F-TEIDs, of packets transmitted through the tunnel are created, modified and dropped for subscriber sessions wherein each F-TEID represents a combination of a destination IP address and a tunnel endpoint identifier, TEID, for a GTP packet; storing first tunnel signaling state in a data repository for each established tunnel, the first tunnel signaling state is indicative of the determined relationship between the tunnel and corresponding subscriber sessions; and validating second tunnel signaling state based on the stored first tunnel signaling state to identify incorrect association between a monitored tunnel and corresponding subscriber session, in response to detecting a monitoring gap such that validation of tunnel flow states is performed by selectively examining tunneled protocol IP addresses in comparison with an address monitored early during a lifetime of the subscriber session, wherein the first tunnel signaling state is associated with a first tunnel monitored before the monitoring gap and the second tunnel signaling state is associated with a second tunnel monitored after the monitoring gap, wherein the validation of tunnel flow states is performed prior to establishing monitoring of the second tunnel by retrieving a last assigned IP address associated with the first tunnel and stored subscriber addresses associated with the subscriber sessions to determine that the destination IP address of user plane traffic flowing through the second tunnel does not correlate with the last assigned IP associated with the first tunnel. monitoring tunnel signaling flows to determine relationships between tunnels and subscriber sessions for each established tunnel; analyzing GTP, GPRS - General Packet Radio Service - Tunneling Protocol, packets in a GTP session to determine whether Fully Qualified Tunnel Endpoint Identifiers, F-TEIDs, of packets transmitted through the tunnel are created, modified and dropped for subscriber sessions wherein each F-TEID represents a combination of a destination IP address and a tunnel endpoint identifier, TEID, for a GTP packet; storing first tunnel signaling state in a data repository for each established tunnel, the first tunnel signaling state is indicative of the determined relationship between the tunnel and corresponding subscriber sessions; and validating second tunnel signaling state based on the stored first tunnel signaling state to identify incorrect association between a monitored tunnel and corresponding subscriber session, in response to detecting a monitoring gap such that validation of tunnel flow states is performed by selectively examining tunneled protocol IP addresses in comparison with an address monitored early during a lifetime of the subscriber session, wherein the first tunnel signaling state is associated with a first tunnel monitored before the monitoring gap and the second tunnel signaling state is associated with a second tunnel monitored after the monitoring gap, wherein the validation of tunnel flow states is performed prior to establishing monitoring of the second tunnel by retrieving a last assigned IP address associated with the first tunnel and stored subscriber addresses associated with the subscriber sessions to determine that the destination IP address of user plane traffic flowing through the second tunnel does not correlate with the last assigned IP associated with the first tunnel.