tcpflow

tcpflow is a handy program that helps capture data sent through TCP connections. It organizes this data in a way that's super useful for analyzing protocols or debugging issues. Unlike tools like tcpdump, which only give you a quick summary of packets flying around, tcpflow actually reconstructs the real data streams and saves each one in its own file for later review.

How tcpflow Works

This software gets the whole picture by understanding sequence numbers, so it can put together the data streams correctly, even if some packets are retried or come out of order. However, it's worth noting that it doesn't handle IP fragments yet; if your flows have those, they won't be recorded properly.

A Powerful Tool for Analysis

Built on the LBL Packet Capture Library (which you can find at Softpas), tcpflow supports all those fancy filtering options that tools like tcpdump offer. When it captures data, it stores everything in files named something like this:

128.129.130.131.02345-010.011.012.013.45103

The content of this file would show you the data sent from host 128.129.130.131 on port 2345 to host 10.11.12.13 on port 45103.

The Origins of tcpflow

I initially created this program to grab data from various apps that use hidden network protocols so I could reverse engineer them—think RealPlayer and popular messaging apps like ICQ and AOL IM.

A Versatile Tool Beyond Its Initial Purpose

While working with tcpflow, I discovered it's also great for checking what cookies my browser sends to different sites, examining HTTP request MIME headers hitting my web server, and making sure that connections I thought were secure really are encrypted.

If you're looking to dive deeper into network traffic analysis or just curious about how your apps communicate over the internet, download tcpflow here!