Ad hoc networks are exposed more than traditional networks to security threats due to their mobility and open architecture aspects. In addition, any dysfunction due to badly configured nodes can severely affect the network as all nodes participate in the routing task. For these reasons, it is important to check the validity of ad hoc protocols, to verify whether the running implementation is conform to its specification and to detect security flows in the network. In this paper, we propose a formal methodology to collect and analyze the network traffic trace. Observers running on a set of nodes collect local traces and send them later to a global observer that correlates them into a global trace thanks to an adapted time synchronization mechanism running in the network. The global trace is then analyzed to study the conformance and the security of the running routing protocol. This analysis is performed using dedicated algorithms that check the collected trace against a set of functional and security properties specified in an adapted formal language