Internet protocol (IP) networks were originally designed by universities and government research agencies, not by network operators with commercial objectives. As a result, while aggregate accounting is possible for network management, detailed accounting at the level of individual users is often not possible. In today's networks, this limitation hinders the effective introduction of a variety of new IP‐based services. Network operators lack the tools to monitor individual customers' use of network services, measure the type and quality of service that they receive, and ultimately establish service‐level agreements and bill for those services. This paper presents an approach to accounting in IP networks that meets these needs based on a special‐purpose network probe, which we term a NetCounter. The key functionality of a NetCounter is real‐time, in‐network correlation of network traffic with the individual users that generated it. This approach has several technical advantages over alternative approaches. Most importantly, the NetCounter achieves substantial in‐network aggregation, reducing the volume of usage data generated by between two and four orders of magnitude (when compared to flow‐logging systems). In addition, NetCounters capture usage data at the level of individual users and record detailed, user‐ and service‐specific performance metrics.