> Is that function of reassembling TCP bytestream embedded in event engine and > enabled by default when using http-rewriter.bro It's fundamental to how the event engine works. Vern