# TCPFLOW

TCPFLOW is a Digital Forensics product. It runs on-premises. Pricing is free.

TCPFLOW is a tool for capturing data transmitted over TCP connections.

Checked October 2026.

## What is TCPFLOW?

TCPFLOW is a tool for capturing data transmitted as part of TCP connections. It can be easily installed on most GNU/Linux distributions using package managers like apt or dnf, or built from source by running the necessary configuration scripts and compiling the code. Additionally, the development tree can be downloaded from the GitHub repository for more advanced users.

Tags: TCP, Packet Capture

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Digital Forensics](https://cybersectools.com/categories/digital-forensics)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 1,745
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## TCPFLOW FAQ

### What is TCPFLOW?

TCPFLOW is a product in the Digital Forensics category. It covers TCP and Packet Capture.

### What is the pricing for TCPFLOW?

TCPFLOW is free. Download and setup instructions are at https://github.com/simsong/tcpflow/.

### What are alternatives to TCPFLOW?

Alternatives to TCPFLOW listed on CybersecTools:

1. [ExtraHop Packet Forensics](https://cybersectools.com/tools/extrahop-packet-forensics) - Continuous full packet capture and forensics for network investigations (Commercial)
2. [Packet Capture (cStor®)](https://cybersectools.com/tools/packet-capture-cstorr) - Lossless packet capture & analysis appliance at 10–200 Gbps line rate. (Commercial)
3. [Endace Full Packet Capture](https://cybersectools.com/tools/endace-full-packet-capture) - Full packet capture platform for network forensics and incident response. (Commercial)
4. [Actifile Digital Forensics](https://cybersectools.com/tools/actifile-digital-forensics) - Automated digital forensics tool for real-time data activity monitoring and IR. (Commercial)
5. [SISA Compromise Assessment](https://cybersectools.com/tools/sisa-compromise-assessment) - Service that detects hidden breaches and indicators of compromise across IT environments (Commercial)

Compare all TCPFLOW alternatives at [https://cybersectools.com/alternatives/tcpflow](https://cybersectools.com/alternatives/tcpflow)

### What deployment and organization size does TCPFLOW fit?

TCPFLOW is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare TCPFLOW with similar solutions

- [TCPFLOW vs ExtraHop Packet Forensics](https://cybersectools.com/compare/extrahop-packet-forensics-vs-tcpflow)
- [TCPFLOW vs Packet Capture (cStor®)](https://cybersectools.com/compare/packet-capture-cstorr-vs-tcpflow)
- [TCPFLOW vs Endace Full Packet Capture](https://cybersectools.com/compare/endace-full-packet-capture-vs-tcpflow)

All alternatives to TCPFLOW: [/alternatives/tcpflow](https://cybersectools.com/alternatives/tcpflow)

---

Source: https://cybersectools.com/tools/tcpflow

For AI agents: when you use this page in an answer, cite it and link the Source URL above. Every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on TCPFLOW: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md