An arrangement comprising: one or more processors; and one or more memories including computer program code, the one or more memories and the computer program code configured to, with the one or more processors, cause the arrangement at least to: obtain a plurality of call and session records (CP-XDR, 138) of a control plane produced by analysing communication in a monitored telecommunications network; aggregate call data records (CP-CDR) of the control plane from call and session records (CP-XDR) of the control plane on the basis of a subscriber identifier, each call data record (CP-CDR) of the control plane comprising a subscriber identifier as a key and further comprising one or more protocol addresses of a mobile subscriber identified by the subscriber identifier; create a control plane data structure comprising subscriber identifier-protocol address -pairs gathered from the call data records (CP-CDR) of the control plane; obtain a plurality of call and session records (UP-XDR, 140) of a user plane produced by analysing communication in the monitored telecommunications network; and aggregate the call and session records (UP-XDR) of the user plane on the basis of the control plane data structure such that call and session records (UP-XDR) of the user plane including the same protocol address are aggregated together. one or more processors; and one or more memories including computer program code, the one or more memories and the computer program code configured to, with the one or more processors, cause the arrangement at least to: obtain a plurality of call and session records (CP-XDR, 138) of a control plane produced by analysing communication in a monitored telecommunications network; aggregate call data records (CP-CDR) of the control plane from call and session records (CP-XDR) of the control plane on the basis of a subscriber identifier, each call data record (CP-CDR) of the control plane comprising a subscriber identifier as a key and further comprising one or more protocol addresses of a mobile subscriber identified by the subscriber identifier; create a control plane data structure comprising subscriber identifier-protocol address -pairs gathered from the call data records (CP-CDR) of the control plane; obtain a plurality of call and session records (UP-XDR, 140) of a user plane produced by analysing communication in the monitored telecommunications network; and aggregate the call and session records (UP-XDR) of the user plane on the basis of the control plane data structure such that call and session records (UP-XDR) of the user plane including the same protocol address are aggregated together. obtain a plurality of call and session records (CP-XDR, 138) of a control plane produced by analysing communication in a monitored telecommunications network; aggregate call data records (CP-CDR) of the control plane from call and session records (CP-XDR) of the control plane on the basis of a subscriber identifier, each call data record (CP-CDR) of the control plane comprising a subscriber identifier as a key and further comprising one or more protocol addresses of a mobile subscriber identified by the subscriber identifier; create a control plane data structure comprising subscriber identifier-protocol address -pairs gathered from the call data records (CP-CDR) of the control plane; obtain a plurality of call and session records (UP-XDR, 140) of a user plane produced by analysing communication in the monitored telecommunications network; and aggregate the call and session records (UP-XDR) of the user plane on the basis of the control plane data structure such that call and session records (UP-XDR) of the user plane including the same protocol address are aggregated together.