One way around that limitation could be real-time analysis with some data buffering. In that way, the timing attack could be done and only those packets saved.

One way around that limitation could be real-time analysis with some data buffering. In that way, the timing attack could be done and only those packets saved. I don't really have a feel for what kind of processing this would require, though. Presumably one would also need a low-latency link to the nodes of interest.