A method, comprising: receiving, by a network device, a request to install a filter, wherein the request includes information identifying: a first source address, wherein the first source address is set as the source address of the filter, a first destination address, wherein the first destination address is set as the destination address of the filter, a content destination device to receive packets that match the filter, and a tapping level indicator associated with the filter, wherein the tapping level indicator indicates the degree of separation from the first source address that is to be filtered; creating, by the network device, at least one additional filter, based on the tapping level indicator, by setting the first destination address as a second source address for the at least one additional filter, determining one or more third destination addresses that are destinations for packets with the second source address, and setting the one or more third destination addresses as one or more third source addresses for the at least one additional filter; adding, by the network device, information identifying the filter and the at least one additional filter to a list of filters associated with the network device; receiving, by the network device and originating from a plurality of source devices, a plurality of packets destined for a plurality of destination devices; generating, by the network device, a copy of a packet of the plurality of packets; determining, by the network device, that the copy of the packet matches the filter or the at least one additional filter; and causing, by the network device, the copy of the packet to be forwarded to the content destination device based on the copy of the packet matching the filter or the at least one additional filter. receiving, by a network device, a request to install a filter, wherein the request includes information identifying: a first source address, wherein the first source address is set as the source address of the filter, a first destination address, wherein the first destination address is set as the destination address of the filter, a content destination device to receive packets that match the filter, and a tapping level indicator associated with the filter, wherein the tapping level indicator indicates the degree of separation from the first source address that is to be filtered; a first source address, wherein the first source address is set as the source address of the filter, a first destination address, wherein the first destination address is set as the destination address of the filter, a content destination device to receive packets that match the filter, and a tapping level indicator associated with the filter, wherein the tapping level indicator indicates the degree of separation from the first source address that is to be filtered; creating, by the network device, at least one additional filter, based on the tapping level indicator, by setting the first destination address as a second source address for the at least one additional filter, determining one or more third destination addresses that are destinations for packets with the second source address, and setting the one or more third destination addresses as one or more third source addresses for the at least one additional filter; adding, by the network device, information identifying the filter and the at least one additional filter to a list of filters associated with the network device; receiving, by the network device and originating from a plurality of source devices, a plurality of packets destined for a plurality of destination devices; generating, by the network device, a copy of a packet of the plurality of packets; determining, by the network device, that the copy of the packet matches the filter or the at least one additional filter; and causing, by the network device, the copy of the packet to be forwarded to the content destination device based on the copy of the packet matching the filter or the at least one additional filter.