Lawful intercept is an area that can benefit from FPGA-based SmartNICs such as the Xilinx Alveo and others. There are at least three key reasons why any high-speed (40G or higher) lawful intercept appliance should include a host CPU offload adapter or SmartNIC. 1) The appliance must not lose a single packet. Remember you are trying to find the proverbial “needle in a haystack” so you must have access to the entire haystack or the missing part might just contain the needle; 2) Lawful intercept traffic is tapped at aggregation points in a service provider network which today are either 40G or increasingly 100G links. This level of traffic can not be handled by traditional software techniques; and finally, 3) The appliance must have very precise and fine-grained packet filtering so you can key in on the exact packets that the law enforcement agency is trying to obtain. Trying to parse packets with software only is overly resource intensive and prone to errors.
For more details, please read this lawful intercept case study.