This paper deals with the problem of identifying IP traffic to or from a user for the purposes of Lawful Interception (LI). Systems used for LI of IP traffic monitor Dynamic Host Configuration Protocol (DHCP) and Remote Authentication Dial-In User Service (RADIUS) messages to identify the IP address of packets to be intercepted. This paper identifies the key information flows between the Network Access Server (NAS) and the RADIUS and DHCP servers. It ends by suggesting directions for LI research related to user identification.