A method for distributing monitored network traffic, the method comprising: at a monitoring node load balancer implemented using at least one processor: monitoring S1-MME traffic and S6a traffic in a core network of a telecommunications network; wherein monitoring the S1-MME traffic and S6a traffic comprises extracting subscriber identifiers for subscribers to the telecommunications network and building a table with a record for each subscriber of a plurality of subscribers attaching to the telecommunications network and wherein building the table comprises correlating, in each record, a first subscriber identifier extracted from an attachment request in the S1-MME traffic with a second subscriber identifier extracted from an attachment response in the S1-MME traffic; decrypting encrypted S1-MME traffic using information extracted from the S6a traffic, including extracting, from at least one encrypted message, a respective second subscriber identifier from the encrypted message; and load balancing between a plurality of monitoring nodes (120a-c) using the decrypted S1-MME traffic, wherein load balancing comprises distributing tapped traffic from the core network across the plurality of monitoring nodes (120a-c) using the subscriber identifiers, and wherein distributing the tapped traffic includes distributing the encrypted S1-MME traffic by selecting a respective monitoring node (120a-c) that is bound to the respective second subscriber identifier in the table, wherein by storing both subscriber identifiers a load balancer distributes traffic regardless of whether the traffic is associated with an international mobile subscriber identity (IMSI) or a globally unique temporary UE identity (GUTI). monitoring S1-MME traffic and S6a traffic in a core network of a telecommunications network; wherein monitoring the S1-MME traffic and S6a traffic comprises extracting subscriber identifiers for subscribers to the telecommunications network and building a table with a record for each subscriber of a plurality of subscribers attaching to the telecommunications network and wherein building the table comprises correlating, in each record, a first subscriber identifier extracted from an attachment request in the S1-MME traffic with a second subscriber identifier extracted from an attachment response in the S1-MME traffic; decrypting encrypted S1-MME traffic using information extracted from the S6a traffic, including extracting, from at least one encrypted message, a respective second subscriber identifier from the encrypted message; and load balancing between a plurality of monitoring nodes (120a-c) using the decrypted S1-MME traffic, wherein load balancing comprises distributing tapped traffic from the core network across the plurality of monitoring nodes (120a-c) using the subscriber identifiers, and wherein distributing the tapped traffic includes distributing the encrypted S1-MME traffic by selecting a respective monitoring node (120a-c) that is bound to the respective second subscriber identifier in the table, wherein by storing both subscriber identifiers a load balancer distributes traffic regardless of whether the traffic is associated with an international mobile subscriber identity (IMSI) or a globally unique temporary UE identity (GUTI).