A method for correlating media streams and signaling sessions of services in a passive monitoring system of a packet-switched network, a service comprising at least two media streams of different directions and a signaling session, wherein a given direction of the service is equivalent to a media data path of a media stream belonging to the respective service, the method comprising: generating, by a signaling plane probe, at least one correlation key for each direction of a service based on the information of the signaling session of the respective service monitored at the signaling plane probe, wherein each of the correlation keys for a respective service is generated using a timestamp indicative of the point in time at which the end of the respective signaling session of the respective service has been detected by the signaling plane probe and using information on a respective direction of the respective service, storing, by the signaling plane probe, a signaling session report for each signaling session in a database, wherein each signaling session report comprises the at least two correlation keys generated for the respective directions of the service, generating, by a media plane probe, a correlation key for each media stream monitored by the media plane probe, wherein the correlation key is generated using a timestamp indicative of the point in time at which the end of the respective media stream has been detected by the media plane probe and using information on the media data path of the respective media stream, storing, by the media plane probe, a media stream report for each media stream in a database, wherein each media stream report comprises at least the correlation key generated for the respective media stream, and identifying, by a correlation unit, identical correlation keys comprised within the media stream reports and the signaling session reports to thereby identify the media stream reports and signaling session report belonging to a respective one of said one or more services. generating, by a signaling plane probe, at least one correlation key for each direction of a service based on the information of the signaling session of the respective service monitored at the signaling plane probe, wherein each of the correlation keys for a respective service is generated using a timestamp indicative of the point in time at which the end of the respective signaling session of the respective service has been detected by the signaling plane probe and using information on a respective direction of the respective service, storing, by the signaling plane probe, a signaling session report for each signaling session in a database, wherein each signaling session report comprises the at least two correlation keys generated for the respective directions of the service, generating, by a media plane probe, a correlation key for each media stream monitored by the media plane probe, wherein the correlation key is generated using a timestamp indicative of the point in time at which the end of the respective media stream has been detected by the media plane probe and using information on the media data path of the respective media stream, storing, by the media plane probe, a media stream report for each media stream in a database, wherein each media stream report comprises at least the correlation key generated for the respective media stream, and identifying, by a correlation unit, identical correlation keys comprised within the media stream reports and the signaling session reports to thereby identify the media stream reports and signaling session report belonging to a respective one of said one or more services.