I have applications which use a persistant HTTP connections to talk to upstream services. These connections live for a really long time, thousands/tens of thousands of requests on a single tcp connection. I use bro to analyse http request and replies for these applications. I need the ability to run the analyser for these partial connections in the pcap file.
Sridhar