A computer-implemented method comprising: receiving a plurality of requests, each request being a request to mirror network traffic traversing a virtual network interface (134A, 134B, 134C) associated with a respective virtual network of a plurality of virtual networks (102, 202A-202N, 302, 402A-402N, 860, 910) at a service provider network (100, 800), each request identifying a destination for the mirrored network traffic, and each of the plurality of virtual networks (102, 202A-202N, 302, 402A-402N, 860, 910) including a logically isolated set of computing resources, each set associated with a different user of the service provider network (100, 800); and for each request: identifying a computing device (132A, 132B, 132C, 206A-206N) hosting a computing resource to which the virtual network interface (134A, 134B, 134C) identified in the request is attached; and sending configuration information to the computing device (132A, 132B, 132C206A-206N), the configuration information causing the computing device to send a mirrored copy of network traffic traversing the virtual network interface (134A, 134B, 134C) to a fleet of compute instances at the service provider network (100, 800), the fleet of compute instances processing the mirrored copy of network traffic and converting the mirrored copy of network traffic into packet capture files (138A-138N), adding metadata to the packet capture files including a user account identifier associated with the network traffic, separate user accounts being associated with separate storage locations at the destination, and routing the packet capture files to the destination; wherein the fleet of compute instances receives network traffic mirrored from the plurality of virtual networks (102, 202A-202N, 302, 402A-402N, 860, 910) associated with the requests from the different users of the service provider network (100, 800); and wherein the destination is a storage service (104, 710) of the service provider network (100, 800), and wherein the fleet of compute instances determines where to store the packet capture files (138A-138N) at the destination based on the user account identifier associated with the packet capture files (138A-138N), to store the packet capture files at separate storage locations (216A-216N) at the storage service associated with separate users of the service provider network (100, 800). identifying a computing device (132A, 132B, 132C, 206A-206N) hosting a computing resource to which the virtual network interface (134A, 134B, 134C) identified in the request is attached; and sending configuration information to the computing device (132A, 132B, 132C206A-206N), the configuration information causing the computing device to send a mirrored copy of network traffic traversing the virtual network interface (134A, 134B, 134C) to a fleet of compute instances at the service provider network (100, 800), the fleet of compute instances processing the mirrored copy of network traffic and converting the mirrored copy of network traffic into packet capture files (138A-138N), adding metadata to the packet capture files including a user account identifier associated with the network traffic, separate user accounts being associated with separate storage locations at the destination, and routing the packet capture files to the destination; wherein the fleet of compute instances receives network traffic mirrored from the plurality of virtual networks (102, 202A-202N, 302, 402A-402N, 860, 910) associated with the requests from the different users of the service provider network (100, 800); and wherein the destination is a storage service (104, 710) of the service provider network (100, 800), and wherein the fleet of compute instances determines where to store the packet capture files (138A-138N) at the destination based on the user account identifier associated with the packet capture files (138A-138N), to store the packet capture files at separate storage locations (216A-216N) at the storage service associated with separate users of the service provider network (100, 800).