PAGES
← all tools
◆ Network Analysis & Monitoring

tcpflow

2012-10-26 Simson Garfinkel <simsong@npsair.local> open-source

tcpflow captures data transmitted as part of TCP connections and stores each flow in its own file for protocol analysis and debugging.

source ↗ website ↗ rss ↗ What is a cyber toolchain? last repo push Jan 29, 2026

Summary

tcpflow is an open-source command-line tool that captures and reconstructs TCP connection data streams from live traffic or pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files, writing each flow to its own file for later inspection. It costs nothing to use and installs from standard Debian, Ubuntu, Fedora and RedHat package repositories, or builds from source on Linux, Windows via mingw, or Amazon AMI. It suits incident responders and forensic analysts who need to reassemble sessions from captured traffic rather than watch them live, and its console output can color-code client-to-server, server-to-client and undecided flows for quick review. It sits in the packet-capture and traffic-forensics space alongside tools built on libpcap. First committed in 2012 and maintained by 59 contributors, it has seen only 3 commits in the past year, suggesting slow but ongoing upkeep rather than active development.

tcpflow captures data transmitted as part of TCP connections and stores each flow in its own file for protocol analysis and debugging.

How tcpflow helps

What did the two ends of this connection actually send each other?

reassembles each TCP stream from the capture into its own file with client and server payloads in order, so the conversation can be read as a whole rather than as individual packets

Which conversation in a large capture is the one worth looking at first?

splits every flow into its own separate file, so an analyst can scan file sizes and names instead of scrolling through one giant packet trace

Was this exchange initiated by the server or the client, and did the direction ever become ambiguous?

color-codes console output by direction, marking client-to-server, server-to-client, and flows where the direction could not be determined

What actually happened during an incident that was only captured to a file, not watched live?

works directly against saved pcap files after the fact, rebuilding the sessions inside them exactly as it would from live traffic

What passed between two hosts before the capture was reviewed?

writes the full reconstructed payload of each flow to disk, so the content can be read, searched, or handed to another tool well after the traffic occurred

all 4 features, with the evidence for each →

Languages

Not documented

Features

4 capabilities · 1 backed by code, an API document or a real run

Built from tcpflow's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • tcpflow covers 1 of the 34 network analysis capabilities we track.
  • tcpflow covers 1 of the 5 network observation capabilities we track.

What tcpflow offers you

  • Command-line interface1
All capabilities 4 capabilities
Flow data reconstruction shipped Captures and reconstructs TCP connection data streams from live traffic or pcap files, storing each flow in a separate file for protocol analysis. 3 releases · 2 other sources · first seen Feb 2001

Shared capability: TCP reassembly

release

  • Added src/tcpip.cpp (insert) function to handle missing SYNs and out-of-order packets. 2012-10-26 Simson Garfinkel <simsong@npsair.local> · Oct 2012 · source · release history
  • Adds -R option to finish incomplete TCP connections in tcpflow 1.2.7 · May 2012 · source · release history
  • Adds graceful shutdown handling for SIGTERM, SIGINT, and SIGHUP signals to allow libpcap interface reset 0.20 · Feb 2001 · source · release history

docs

  • Captures and reconstructs TCP connection data streams from live traffic or pcap files, storing each flow in a separate file for protocol analysis.

example

  • Reconstruct full streams even if the capture ended before the TCP handshake or teardown completed. tcpflow -R captured_traffic.pcap 1.2.7 · May 2012 · source
Color-coded flow output verified Displays captured flow data in the console using distinct colors to indicate traffic direction between client and server. 1 release · 2 other sources · first seen May 2012

Shared capability: Network traffic analysis

Also counts toward: Command-line interface

release

  • Adds support for multiple files with the -r flag in tcpflow 1.2.7 · May 2012 · source · release history

command line

  • -g — Output flow information to console in multiple colors. (Blue for client to server flows, red for server to client flows, green for undecided flows.) Note: This option was different from tcpflow 1.3 (-e) and 1.4.4 (-J). tcpflow-1.5.0 · Aug 2018 · command-line history

example

  • Process multiple pcap files in a single invocation for faster bulk analysis. tcpflow -r file1.pcap file2.pcap 1.2.7 · May 2012 · source
XML flow metadata output shipped suggested Provides XML-based output containing information about captured flows and processing results, including tags for flow identification and data collection. 1 release · 1 other source · first seen Jan 2012

Suggested capability: Flow record export (NetFlow, IPFIX). This is our guess, not confirmed.

release

  • Adds -X CLI flag to produce XML output 2012-01-01 Simson Garfinkel <simsong@Mucha.local> · Jan 2012 · source · release history

docs

  • file inside the XML tag \fB ... \fP. . bla bla bla The first XML tag \fB \fP provide information about the captured flow. This tag should be renamed \fB \fP in a future version The second XML tag \fB \fP collects processing results. seen Sep 2026 · source
Concurrent execution safety shipped Prevents data corruption by locking output files when multiple instances of the tool run simultaneously. 1 release · first seen Dec 2011

release

  • Supports named semaphores to lock output files between concurrent tcpflow invocations. 2011-12-29 Simson Garfinkel <simsong@Mucha.local> · Dec 2011 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for tcpflow, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail tcpflow puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

6 entries

  1. January 20261
  3. October 20121
  5. May 20121
  7. January 20121
  9. December 20111
  11. February 20011

    6 entries

    1. advisory CVE-2026-25061 Jan 29, 2026 · issue 128
      • CVE-2026-25061: TIM Element OOB Write in wifipcap (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.5, affects <= 1.61)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    2. 2012-10-26 Simson Garfinkel <simsong@npsair.local> Oct 26, 2012 · release notes

      tcpflow now handles flows with missing SYNs and out-of-order packets via new insert function.

    3. 1.2.7 May 24, 2012 · release notes

      tcpflow 1.2.7 adds multi-file support to -r and handles incomplete TCP connections with -R.

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.2.7 https://github.com/simsong/tcpflow.git
# already have the repo? check out this version:
$ git checkout 1.2.7
      └──▷ TRY IT
      Process multiple pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files in a single invocation for faster bulk analysis.
      $ tcpflow -r file1.pcap file2.pcap
      Reconstruct full streams even if the capture ended before the TCP handshake or teardown completed.
      $ tcpflow -R captured_traffic.pcap
      • Adds support for multiple files with the -r flag in tcpflow
      • Adds -R option to finish incomplete TCP connections in tcpflow

      2 details in Everything

    4. 2012-01-01 Simson Garfinkel <simsong@Mucha.local> Jan 1, 2012 · release notes

      tcpflow adds -X flag for XML output format

    5. 2011-12-29 Simson Garfinkel <simsong@Mucha.local> Dec 29, 2011 · release notes

      tcpflow 2011-12-29 adds -B flag for binary output and named semaphore locking

      • Supports named semaphores to lock output files between concurrent tcpflow invocations.

      1 detail in Everything

    6. 0.20 Feb 26, 2001 · release notes

      tcpflow 0.20 adds support for reading pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic./tcpdump capture files via a new CLI path and improves signal handling.

      └──▷ GET THIS VERSION 
      $ git clone --branch 0.20 https://github.com/simsong/tcpflow.git
# already have the repo? check out this version:
$ git checkout 0.20
      • Adds graceful shutdown handling for SIGTERM, SIGINT, and SIGHUP signals to allow libpcap interface reset

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in simsong/tcpflow, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 1 −1 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 72 of 185 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 72
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 1,777
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback