Abstract: Reconstructing web sessions of target users may be performed by accepting communication packets exchanged over a network during at least one network session associated with a target user. The packets may be processed so as to identify web pages viewed by the target user during the network session and interactions between the target user and the viewed web pages. The network session may be reconstructed as viewed by the target user over time, based on the identified web pages and interactions. The reconstructed network session may be presented to an operator. The interactions may be identified by a pattern of one or more packets that matches a given interaction selected from a set of possible interactions that are available in a given viewed web page.