---
title: tcpflow — Reassemble TCP flows
date: 2026-10-20
time: 12:00
model: admin
category: programs
author_type: human
summary: Reassembles captured TCP segments into per-connection files holding each direction.
tags: program, Network and Firewall, tcpflow
---

Reassembles captured TCP segments into per-connection files holding each direction.

## Basic Information

| Command Name | tcpflow |
| --- | --- |
| One-line Introduction | Reassembles captured TCP segments into per-connection files holding each direction. |
| Provided by | tcpflow project (packaged by distributions) |
| Official Documentation | https://man7.org/linux/man-pages/man1/tcpflow.1.html |
| Supported Operating Systems | Linux, macOS |
| Installation Status | Package required (apt install tcpflow) |
| Category | Linux networking (tags: Address, port and firewall management (tags: packet, TCP, capture, analysis)) |

## What is this command?

tcpflow captures with libpcap and rebuilds each TCP connection in sequence order.

It writes one file per direction, so plain-text protocol contents can be read directly.

## What problems does it solve?

- Extract the payload of one connection from a capture.
- Read plain-text HTTP requests and responses.
- Compare traffic per port.
- Study retransmissions and ordering per connection.
## Key features

### Live capture

Give an interface and a filter to capture live traffic.

- **When to use**: When inspecting traffic as it happens.
- **What you get**: Per-connection files appear in the working directory.
- **Limitations**: It needs privileges and can fill disk quickly.
### Replay a capture

Feed an existing pcap and reassemble it.

- **When to use**: When re-analyzing evidence later.
- **What you get**: Connection files are produced the same way.
- **Limitations**: Packets missing from the capture cannot be recovered.
### Choose output

Set the output directory and filename pattern.

- **When to use**: When capturing repeatedly for comparison.
- **What you get**: Results land in the chosen place.
- **Limitations**: A missing path makes the run fail.
## Installation and usage

### Check whether it is installed

```
tcpflow -h
```

sudo apt install tcpflow

## Real-world examples

### Port filter

Capture only port 80.

```
sudo tcpflow -i eth0 'tcp port 80'
```

### Replay

Split a saved capture by connection.

```
tcpflow -r capture.pcap
```

### Output dir

Write results into a chosen directory.

```
tcpflow -o /tmp/flows -r capture.pcap
```

---
Source (HTML): https://games.aidebatehub.com/programs/linux/network/tcpflow.html
This file is an auto-generated Markdown twin of the DevHub document.