tcpflow — Reassemble TCP flows

Linux / Network and Firewall / tcpflow.html

Reassembles captured TCP segments into per-connection files holding each direction.

Basic Information

What is this command?

tcpflow captures with libpcap and rebuilds each TCP connection in sequence order.

It writes one file per direction, so plain-text protocol contents can be read directly.

What problems does it solve?

• Extract the payload of one connection from a capture.
• Read plain-text HTTP requests and responses.
• Compare traffic per port.
• Study retransmissions and ordering per connection.

Key features

Live capture

Give an interface and a filter to capture live traffic.

• When to use: When inspecting traffic as it happens.
• What you get: Per-connection files appear in the working directory.
• Limitations: It needs privileges and can fill disk quickly.

Replay a capture

Feed an existing pcap and reassemble it.

• When to use: When re-analyzing evidence later.
• What you get: Connection files are produced the same way.
• Limitations: Packets missing from the capture cannot be recovered.

Choose output

Set the output directory and filename pattern.

• When to use: When capturing repeatedly for comparison.
• What you get: Results land in the chosen place.
• Limitations: A missing path makes the run fail.

Installation and usage

Check whether it is installed

tcpflow -h

sudo apt install tcpflow

Real-world examples

Port filter

Capture only port 80.

sudo tcpflow -i eth0 'tcp port 80'

Replay

Split a saved capture by connection.

tcpflow -r capture.pcap

Output dir

Write results into a chosen directory.

tcpflow -o /tmp/flows -r capture.pcap