Skip to content
SecArsenal
Educational and ethical use only. Only test systems you own or are explicitly authorized to test. Full disclaimer.

tcpflow

TCP flow recorder

network-sniffingRed Team
Official docs ↗Download ↗Source repo ↗

Platforms: Linux · Last verified September 6, 2026

tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis or debugging. A program like ’tcpdump’ shows a summary of packets seen on the wire, but usually doesn’t store the data that’s actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis.

Only use this tool against systems you own or are explicitly authorized to test — see the disclaimer.

Getting started

See the official Kali tool page and upstream homepage linked above for installation and usage details.

Commonly preinstalled on

Kali Linux

Debian-based distribution built for penetration testing and security auditing