AI Knowledge Hubtcpflow — Reassemble TCP flows
Reassembles captured TCP segments into per-connection files holding each direction.
Reassembles captured TCP segments into per-connection files holding each direction.
Basic Information
| Command Name | tcpflow |
|---|---|
| One-line Introduction | Reassembles captured TCP segments into per-connection files holding each direction. |
| Provided by | tcpflow project (packaged by distributions) |
| Official Documentation | https://man7.org/linux/man-pages/man1/tcpflow.1.html |
| Supported Operating Systems | Linux, macOS |
| Installation Status | Package required (apt install tcpflow) |
| Category | Linux networking (tags: Address, port and firewall management (tags: packet, TCP, capture, analysis)) |
What is this command?
tcpflow captures with libpcap and rebuilds each TCP connection in sequence order.
It writes one file per direction, so plain-text protocol contents can be read directly.
What problems does it solve?
- Extract the payload of one connection from a capture.
- Read plain-text HTTP requests and responses.
- Compare traffic per port.
- Study retransmissions and ordering per connection.
Key features
Live capture
Give an interface and a filter to capture live traffic.
- When to use: When inspecting traffic as it happens.
- What you get: Per-connection files appear in the working directory.
- Limitations: It needs privileges and can fill disk quickly.
Replay a capture
Feed an existing pcap and reassemble it.
- When to use: When re-analyzing evidence later.
- What you get: Connection files are produced the same way.
- Limitations: Packets missing from the capture cannot be recovered.
Choose output
Set the output directory and filename pattern.
- When to use: When capturing repeatedly for comparison.
- What you get: Results land in the chosen place.
- Limitations: A missing path makes the run fail.
Installation and usage
Check whether it is installed
tcpflow -h
sudo apt install tcpflow
Real-world examples
Port filter
Capture only port 80.
sudo tcpflow -i eth0 'tcp port 80'
Replay
Split a saved capture by connection.
tcpflow -r capture.pcap
Output dir
Write results into a chosen directory.
tcpflow -o /tmp/flows -r capture.pcap
Source (HTML): https://games.aidebatehub.com/programs/linux/network/tcpflow.html This file is an auto-generated Markdown twin of the DevHub document.
Visitor Comments