A method and apparatus for surveillance of voice over Internet protocol (VoIP) communications is provided. A server (112) associated with a network provider receives information to identify communications associated with a party under surveillance (200). The server uses the information to direct communications associated with the party under surveillance to a surveillance server (130) (202). The communications are analyzed to identify any initial VoIP data (204). If initial VoIP data is detected, identifiers for subsequent related VoIP communications are determined from the initial VoIP data (206). The identifiers for subsequent VoIP communications are used to identify subsequent VoIP packets. Those subsequent VoIP packets are then stored and analyzed as needed by an agency conducting surveillance.