A method, a device arrangement and a computer program product for examining and analyzing the functioning of a communication network. In one or more taps of the examined communication network there is a network probe which examines communication packets flowing in the communication network via a tap and searches for identities and their relations from their header information. Identities and relations between them are used to create an identity flow which is used to create an identity graph for describing the operation of the communication network. A network probe(s) sends all or a part of the data of the traffic of the communication network it has collected or analyzed to a supervisor unit. The data is sent according to previously given instructions or by a request sent by the supervisor unit. The identities and relations between them to be included in the identity graph are chosen according to predetermined modifiers.