> Is there an existing bro script that sessionizes the incoming packet > flow but keeps all of the original packets associated with each > recognized session? I'm not following - what do you mean by "sessionizes"? Vern