A method and apparatus for reconstructing a session using a first analyzer coupled to a second analyzer is provided. Session reconstruction is performed on packets received at the first analyzer. Moreover, responsive to unsuccessful session reconstruction on the first analyzer, one or more messages are sent to the second analyzer. The one or more messages from the first analyzer to the second analyzer comprise packets received by the first analyzer which are unrecognized, and the second analyzer recognizes the unrecognized packets to successfully reconstruct the session.