A computer-implemented method comprising: receiving a plurality of requests, each request being a request to mirror network traffic traversing a virtual network interface associated with a respective virtual network of a plurality of virtual networks (102, 202A-202N, 302, 402A-402N, 860, 910) at a service provider network , each request identifying a destination for the mirrored network traffic , and each of the plurality of virtual networks (102, 202A-202N, 302, 402A-402N, 860, 910) including a logically isolated set of computing resources, each set associated with a different user of the service provider network ; and for each request: identifying a computing device (132A, 132B, 132C, 206A-206N) hosting a computing resource to which the virtual network interface identified in the request is attached; and sending configuration information to the computing device (132A, 132B, 132C206A-206N), the configuration information causing the computing device to send a mirrored copy of network traffic traversing the virtual network interface to a fleet of compute instances at the service provider network , the fleet of compute instances processing the mirrored copy of network traffic and converting the mirrored copy of network traffic into packet capture files (138A-138N), adding metadata to the packet capture files including a user account identifier associated with the network traffic, separate user accounts being associated with separate storage locations at the destination, and routing the packet capture files to the destination; wherein the fleet of compute instances receives network traffic mirrored from the plurality of virtual networks (102, 202A-202N, 302, 402A-402N, 860, 910) associated with the requests from the different users of the service provider network ; and wherein the destination is a storage service of the service provider network , and wherein the fleet of compute instances determines where to store the packet capture files (138A-138N) at the destination based on the user account identifier associated with the packet capture files (138A-138N), to store the packet capture files at separate storage locations (216A-216N) at the storage service associated with separate users of the service provider network . identifying a computing device (132A, 132B, 132C, 206A-206N) hosting a computing resource to which the virtual network interface identified in the request is attached; and sending configuration information to the computing device (132A, 132B, 132C206A-206N), the configuration information causing the computing device to send a mirrored copy of network traffic traversing the virtual network interface to a fleet of compute instances at the service provider network , the fleet of compute instances processing the mirrored copy of network traffic and converting the mirrored copy of network traffic into packet capture files (138A-138N), adding metadata to the packet capture files including a user account identifier associated with the network traffic, separate user accounts being associated with separate storage locations at the destination, and routing the packet capture files to the destination; wherein the fleet of compute instances receives network traffic mirrored from the plurality of virtual networks (102, 202A-202N, 302, 402A-402N, 860, 910) associated with the requests from the different users of the service provider network ; and wherein the destination is a storage service of the service provider network , and wherein the fleet of compute instances determines where to store the packet capture files (138A-138N) at the destination based on the user account identifier associated with the packet capture files (138A-138N), to store the packet capture files at separate storage locations (216A-216N) at the storage service associated with separate users of the service provider network . <EOS>