Data collection device for monitoring streams in a data network using a packet transmission mode, the device comprising: • an extractor of data contained in packets belonging to a stream defined by a transmitter, a receiver and a protocol; • a syntax analyzer arranged for: - receiving the data from the extractor in real time; - breaking down the data received into elements according to syntactic rules of said protocol, the syntactic rules making it possible to represent said elements as a tree structure, said tree structure being a data structure comprising a root data item and child data such that a child data item is only linked to a single higher-level parent data item, a data item having links to child data items being called a node and a data item with no child data item being called a leaf; and - associating respective tree state indicators with at least some of said elements, where the tree state indicator associated with an element labels said element in the tree structure and contains an identifier of a parent node of the tree structure to which is attached a site receiving said element in the tree structure representation; and • an interface for transmitting the tree state indicators to a stream analyzer, together with elements with which they have been associated. • an extractor of data contained in packets belonging to a stream defined by a transmitter, a receiver and a protocol; • a syntax analyzer arranged for: - receiving the data from the extractor in real time; - breaking down the data received into elements according to syntactic rules of said protocol, the syntactic rules making it possible to represent said elements as a tree structure, said tree structure being a data structure comprising a root data item and child data such that a child data item is only linked to a single higher-level parent data item, a data item having links to child data items being called a node and a data item with no child data item being called a leaf; and - associating respective tree state indicators with at least some of said elements, where the tree state indicator associated with an element labels said element in the tree structure and contains an identifier of a parent node of the tree structure to which is attached a site receiving said element in the tree structure representation; and - receiving the data from the extractor in real time; - breaking down the data received into elements according to syntactic rules of said protocol, the syntactic rules making it possible to represent said elements as a tree structure, said tree structure being a data structure comprising a root data item and child data such that a child data item is only linked to a single higher-level parent data item, a data item having links to child data items being called a node and a data item with no child data item being called a leaf; and - associating respective tree state indicators with at least some of said elements, where the tree state indicator associated with an element labels said element in the tree structure and contains an identifier of a parent node of the tree structure to which is attached a site receiving said element in the tree structure representation; and • an interface for transmitting the tree state indicators to a stream analyzer, together with elements with which they have been associated.