This is not so much an issue with the schema, as a immediate need, given that you can parse a PCAP file, one often wants to identify a specific TCP connection, and pull, from the XML Infoset, all the bytes of data on that stream.
Note that due to unordered delivery, sequence numbers, repeats, fragmentation and reassembly of packets, assembly of a TCP stream is complex, possibly too complex for a sensible XSLT, in which case some scala/java code may be needed instead-of, or in addition to the XSLT.
Also, a particular PCAP may not contain the initiation of the TCP stream. The PCAP may capture packets that are the middle of a TCP stream, and similarly, may not contain the end of the TCP stream.