Split a packet stream?

[david_waugh]

Hello 

I have multiple emails in a tcp stream.

As a result when I view the session it can be difficult to identify which email relates to the particular meta that was generated.

Is it possible to split a packet stream so that each email would be in its own session.

i am aware that it is possible to split a tcp stream by size, but is there a lua function that would cut the session and start a related session when particular text was encountered ( such as at the start of a Email MIME header)

is is there another way this could be accomplished?

[WilliamMotley1]

By the time parsers see a session it has already been sessionized by Decoder.  Parsers can't influence that at all.

Meta is not associated with other meta - only with the session in which it appears.  So there isn't really a concept of intra-session transactionality.

In the event view, meta is displayed in the order in which it was created.  And most lua parsers attempt to create meta in a logical order.  Manually, an analyst can infer relationships by examining the order of meta.  Otherwise, there's currently no direct way for a parser to indicate any relationship between meta.