tcpflow - Reconstruct TCP streams from captured packets

Distribution: openSUSE 13.2
Repository: openSUSE Security all
Package name: tcpflow
Package version: 1.4.4
Package release: 13.1
Package architecture: x86_64
Package type: rpm
Installed size: 611.15 KB
Download size: 200.98 KB
Official Mirror:
tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging. Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction. tcpflow can also process stored 'tcpdump' packet flows.



  • tcpflow = 1.4.4-13.1
  • tcpflow(x86-64) = 1.4.4-13.1


    Install Howto

    1. Add the openSUSE Security repository:
      # zypper addrepo opensuse-security
    2. Install tcpflow rpm package:
      # zypper install tcpflow


    • /usr/bin/tcpflow
    • /usr/share/doc/packages/tcpflow/AUTHORS
    • /usr/share/doc/packages/tcpflow/COPYING
    • /usr/share/doc/packages/tcpflow/ChangeLog
    • /usr/share/doc/packages/tcpflow/NEWS
    • /usr/share/doc/packages/tcpflow/README
    • /usr/share/doc/packages/tcpflow/TODO.txt
    • /usr/share/man/man1/tcpflow.1.gz


    2017-02-02 - - use individual libboost-*-devel packages instead of boost-devel

    2015-03-31 - - Update to version 1.4.4 * The ChangeLog/NEWS file has not been updated for this release - Use the download Url provided by upstream - Add openssl-devel and boost-devel build require; new upstream dependency

    2012-08-24 - - license update: GPL-3.0+ Source code files state that they are ^GPL^ licensed and to refer back to the ^LICENSE^ file for details. There is no ^LICENSE^ file but there is a ^COPYING^ file and that is clearly GPL-3.0

    2012-08-22 - Upgrade to v1.3.0 - converted code from c to c++ * various fixes and additional features * src/tcpip.cpp (tcpip::close_file): added support for FUTIMENS, but I don't yet have a system on which to test it. Hope that it's good. * src/main.cpp (main): -r option now allows for multiple files to be specified. * src/main.cpp (main): -R option now allows for incomplete tcp connections to be finished. * src/tcpip.cpp (tcpdemux::tcpdemux): default outdir is now "." * src/xml.cpp (xml::add_cpuid): better handling of CPUID instruction. Now it really should not show up on non-Intel architectures. * src/main.cpp (main): added printing stats for debug level 3. * src/tcpip.cpp (tcpdemux::close_all): Jeremey's FD ring has been replaced with an unordere dset. * COPYING: updated to GPLv3 * src/flow.cpp (flow::filename): completely rewrote to support templates. (flow::print_usage): added to give information on templates. * src/main.cpp (main): fixed option parsing bug. (class ipaddr): created class for IP addresses (class flow_state_struct): created class from struct * src/main.cpp (print_usage): -X added for XML output. * src/main.cpp (main): changed bytes_per_flow from int to uint64_t progname is now a global. * src/main.cpp (main): added -B option to force binary output. * src/util.cpp: removed copy_argv(); replaced with a simple std::string manipulation. (flow_filename): modified to work with outdir * src/tcpip.c (print_packet): modified to respect bytes_per_flow * src/main.c (main): removed prepending of (ip or ip6 or vlan) from user expressions. We now just use what the user provided.

    2011-12-18 - - Initial packaging attempt