As a passive observer of the traffic I wonder if it is possible to correlate all the requests to a single page load given that the same client could be loading multiple copies of the same page. I was thinking that you could possibly correlate a group of transactions based on the client ip, UserAgent, Referer and some time window.