A monitoring system comprises a first network probe coupled to a first point in a communications link and a second network probe coupled to a second point in the communications link. Each of the first and second network probes is arranged to sample packets from a predetermined flow of packets and store timestamps associated with packet samples. The timestamps stored by the probes are subsequently correlated.