tcpflow, like tcpdump, allows you to view the text contents of network packets in real time. Whereas tcpdump is more suited to capturing packets as well as protocol information, tcpflow is better suited for viewing the actual data flow between two hosts. One significant difference between tcpflow and tcpdump is that while tcpdump displays output to the console by default, tcpflow writes the output to a file by default. In order to display tcpflow's output on the console, you can use the –c option.
Much of the syntax of tcpflow is similar to that of tcpdump, for example:
tcpflow –i fxp0 –c host 172.16.1.2 and port 80
This would capture packets on the fxp0 interface with either a source or destination of 172.16.1.2 port 80. Here are some of the options available for tcpflow:
|
Option |
Description |
tcpdump equivalent |
|
-bmax_bytes |
Capture no more than max_bytes per flow |
-c |
|
-c |
Console print |
NA (default) |
|
-ddebug_level |
Debug level |
|
|
-iiface |
Capture packets from interface iface |
-i |
|
-p |
Do not put the interface in promiscuous mode |
-p |
|
-r file |
Read packets from file, when file was created using tcpdump's –w option |
-r |
|
-s |
Convert all non-printable characters to the . character before displaying or saving output |
NA |
|
-v |
Verbose operation (equivalent to –d 10) |
-v |