tcpflow, like tcpdump, allows you to view the text contents of network packets in real time. Whereas tcpdump is more suited to capturing packets as well as protocol information, tcpflow is better suited for viewing the actual data flow between two hosts. One significant difference between tcpflow and tcpdump is that while tcpdump displays output to the console by default, tcpflow writes the output to a file by default. In order to display tcpflow's output on the console, you can use the –c option.
Much of the syntax of tcpflow is similar to that of tcpdump, for example:
tcpflow –i fxp0 –c host 172.16.1.2 and port 80
This would capture packets on the fxp0 interface with either a source or destination of 172.16.1.2 port 80. Here are ...
