simsong/tcpflow

Health v2 · maintenance only

Adoption not part of the score

1774 stars · 246 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

tcpflow is a C++ command-line tool that captures TCP connection data and demultiplexes it into per-flow files, one per direction, for protocol analysis and debugging. It can also process stored tcpdump packet captures, making it useful for digital forensics.

Use cases

• capture and store TCP flow data to separate files
• reconstruct TCP streams from a pcap capture
• analyze network traffic for forensic investigations
• debug application protocols by inspecting raw TCP payloads
• extract transferred files or data from captured network sessions

When to choose

• you need per-connection TCP payload extraction rather than packet-level dumps like tcpdump
• you are doing network forensics and need flows reconstructed from pcap files
• you want a lightweight CLI tool available in most Linux package managers

When to avoid

• you need a GUI or interactive traffic analyzer like Wireshark
• you need deep application-layer protocol parsing (HTTP headers, TLS decryption) out of the box
• you need UDP or non-TCP traffic analysis

Facets

cli-tool · maturity active

networking security parser developer-tools security networking developer-tools windows cli cpp packet-capture tcp digital-forensics pcap-analysis network-debugging protocol-analysis command-line linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="simsong/tcpflow")