tcpflow

tcpflow -i <if>

Reassembles TCP streams from a capture or interface and saves them as files, reconstructing complete communications.

Run it when you need to see the full content of connections: tcpflow reassembles each TCP stream (both directions) and saves it to separate files — the complete HTTP with its body, FTP with transferred files, SMTP with messages. Unlike tcpdump (packets) or ngrep (matches), tcpflow gives you the entire conversation: the exfiltrated document, the C2 response, the downloaded payload. In IR, it's the tool to recover what was transmitted: from pcap to real content in files, ready for analysis or attaching to the report.

Don't use it on encrypted traffic: TLS streams are reassembled as useless encrypted data without the session key. On busy interfaces, reassembly generates many files and consumes disk (each stream, two files): targeted capture (filter by host or port) is mandatory. And watch out: tcpflow reconstructs what it captures — if the pcap has losses or the stream wasn't fully captured, the file comes out truncated. For analyzing a specific stream, Wireshark (follow stream) is more visual; tcpflow shines when you need the files for processing (hashes, YARA, sandbox).