tcpflow

tcpflow stores all captured data in files that have names of the form: [timestampT]sourceip.sourceport-destip.destport[--VLAN][cNNNN] where: timestamp is an optional timestamp of the time that the first packet was seen https://github.com/simsong/tcpflow/blob/master/doc/tcpflow.1... .B t Prepends each filename with a Unix timestamp (seconds since epoch). .B T Prepends each filename with an ISO-8601 timestamp.

Mentioning tcpflow here b/c it's one of the most useful networking related tools I know of that very few people even know about. What does it do? It can reassemble TCP packets back into the FULL body of the original message sent. e.g. if you make a HTTP GET request, it will show you the full text in a file stamped with the time, source and dest ips and port. Things I've found it REALLY useful for: - migrating a data center - for some reason, connection works fine on the old DC but seems to time out in weird ways in the new DC - No one can figure it out - I suggest using tcpflow - Turn out there was a setting in the new DC network hardware that was truncating larger packets and the authorization message was just over the threshold People always say "yeah, but Wireshark" which is true, that's a good tool too. That being said, there is just

There seems to be an issue open for this https://github.com/simsong/tcpflow/issues/58