I want to write an application layer sniffer (SMTP/ftp/http).

Based on my searchs, first (and perhaps hardest!) step is to reassemble the tcp stream of the sniffed connections. 

Indeed, what I need is something like the "follow TCP stream" option of wireshark, but I need a tool which do it on live interface and automatically. As I know, Tshark can extract TCP streams data from the saved pcap files automatically ([link](http://ask.wireshark.org/questions/17903/how-do-i-view-all-streams-in-follow-tcp-streams)) but not from live interfaces. Can Tshark do it on live interfaces???

As I know, TCPflow can do exactly what I want, however, it can not handle IP defragmentation and SSL connections (I want to analyse the SSL content in the case I have the server private key).

Finally, I also try bro network monitor. Although it provides the list of TCP connections (conn.log), I was not able to get TCP connections contents.

Any suggestion about mentioned tools or any other useful tool is welcome.

Thanks in advance, Dan.