Suricata

As Snort does :) It will be nice to have a possiblity to extract a pcap file containing the session for a matching rule.

Of course it could be possible by after to extract the desired session with any tools from a full pcap. But on high loaded line this solution is unusable (Adding to this, murphy tells you that you are always in the middle of two pcap files.

On Snort this feature is activated on a rule by the syntax : "tag:" http://manual.snort.org/node34.html#SECTION00475000000000000000

It's usefull also to see all the flow from a malware to a CC with only a rule matching on the malware heartbeat. Even simply see the full request headers part in a big matching http post.