tcpextract For Linux

tcpextract is a tool to extract files from captured TCP sessions. Support live streams and pcap files.

Supported protocols are:

- HTTP (GET)

Gentoo users:

You should first enable the Abnorm Overlay then you can install it:

emerge tcpextract

Using pip:

pip install tcpextract

Manual installation and git installation:

To manually install last stable release or older releases dowload the tarball and extract it:

 tar xzvvf tcpextract-*.tar.gz  cd tcpextract-*  sudo python setup.py install

To install from git please run:

git clone https://github.com/faust/tcpextract.git  cd tcpextract  sudo python setup.py install

When you run tcpextract, by default, it will listen on any avaible interface and will put extracted files in './output'. Please remember that capturing live streams will require root privileges. Live sniffing is really slow. If you can, use tcpdump or something else to capture data.

If you want further information on how to change default behavior please run:

 tcpextract --help

tcpextract is modular, so it is easy to extend.

If you are looking for further information about writing modules to support more protocols please read the Wiki