How to Install and Use tcpflow in Linux to Reconstruct and Demultiplex Raw TCP Data Streams

When debugging network protocols, analyzing malware communications, or reverse-engineering proprietary client-server APIs in Linux, standard packet capture utilities like tcpdump display raw packet headers and fragmented hex dumps. While powerful for analyzing layer-3 routing, extracting actual transmitted files—such as reconstructed HTML documents, images, JSON REST payloads, or binary downloads—requires tedious packet reassembly and TCP sequence number defragmentation.

tcpflow is an open-source network traffic capture and stream reconstruction tool designed to solve this problem. Unlike tcpdump which stores packets as discrete frames, tcpflow understands TCP sequence numbers and reassembles fragmented network packets into continuous, bidirectional data streams. Each TCP connection is automatically demultiplexed and stored as two discrete files on disk (one for inbound traffic and one for outbound traffic), allowing instant analysis with standard Linux text utilities like grep, cat, or jq.

Installing tcpflow on Linux

tcpflow is available in the package repositories of all major Linux distributions:

On Ubuntu / Debian

sudo apt update && sudo apt install tcpflow -y

On Fedora / RHEL

sudo dnf install tcpflow -y

On Arch Linux

sudo pacman -S tcpflow

Core Stream Reconstruction Workflows

1. Capturing and Splitting Traffic on a Network Interface

To capture traffic on interface eth0 and reconstruct all HTTP/API traffic flowing over port 8080:

# Create clean output directory
mkdir -p /tmp/flows && cd /tmp/flows

# Reconstruct TCP flows live
sudo tcpflow -i eth0 port 8080

As connections occur, tcpflow creates structured files named using the IP:port convention:

• 192.168.001.050.45230-010.000.000.001.08080: The client’s request stream.
• 010.000.000.001.08080-192.168.001.050.45230: The server’s response stream.

2. Printing Clean Reconstructed Payloads to Terminal

To view unencrypted HTTP requests in real time without writing hundreds of files to disk, use the console output flag (-c):

sudo tcpflow -c -i eth0 port 80

tcpflow reassembles the TCP packets in memory and streams clean HTTP headers and body payloads directly to standard output.

3. Parsing Offline PCAP Capture Files

Reconstruct streams from an existing Wireshark or tcpdump .pcap capture file:

tcpflow -r /path/to/capture.pcap -o /tmp/extracted_streams/

tcpflow Command Flags Reference Table

Flag	Function	Recommended Context
-i <interface>	Selects network interface	Live network monitoring
-c	Outputs reassembled stream to console	Live terminal debugging
-r <file.pcap>	Reads offline pcap dump file	Forensic analysis of saved captures
-o <directory>	Specifies output folder	Organising batch stream extractions