A method of tracing data on a network that detects receive and send events in a protocol stack is provided. The method provides key information for capacity planners for correctly charging network traffic to the individual services and applications. The TCP/IP stack is instrumented at the transport layer, so that Input/Output Request packets (IRP) representing sends and receives can be detected as they pass through the stack. When such packets are detected an appropriate send or receive event is recorded in a trace log.