> > 3. Along the same lines as #2, is the assembled stream available for > > connections that are not http? > > It depends on the protocol and the analyzer. Note, there are also generic tcp_contents() and udp_contents() events. They likewise return the stream piecemeal. Vern