Monitoring communication is central to the development and ttming of parallel and distributed applications. Available tools for network monitoring typically capture the network traffic at TCP or IP layers, but a software developer is most interested in the message exchange sequence between pairs of nodes executing the application. However, capturing application level traffic requires instrumenting the application code, which is cumbersome and not even an option in most cases. We present a procedure that reconstructs the application layer message sequences by analyzing TCP layer traffic. The basic idea is that, since TCP traffic is constructed with a well defined procedure from application traffic, it should be possible to reconstruct application message exchanges from TCP segments. We demonstrate that the procedure is effective, although not perfect, by extensive experimentation with NASA's NAS parallel benchmarks.