https://www.abnorm.org/projects/tcpextract/

Extract files from captured TCP sessions. Support live streams and pcap files.

Supported protocols are:

• HTTP (GET)

• Python 2.5 or Python 3 or later
• pynids (http://jon.oberheide.org/pynids/)

You should first enable the Abnorm Overlay then you can install it:

emerge tcpextract

pip install tcpextract

To manually install last stable release or older releases dowload the tarball and extract it:

$ tar xzvvf tcpextract-*.tar.gz
$ cd tcpextract-*
$ sudo python setup.py install

To install from git please run:

$ git clone https://github.com/faust/tcpextract.git
$ cd tcpextract
$ sudo python setup.py install

When you run tcpextract, by default, it will listen on any avaible interface and will put extracted files in './output'. Please remember that capturing live streams will require root privileges. Live sniffing is really slow. If you can, use tcpdump or something else to capture data.

If you want further information on how to change default behavior please run:

$ tcpextract --help

tcpextract is modular, so it is easy to extend.

If you are looking for further information about writing modules to support more protocols please read the Wiki

tcpextract is released under GPLv3 or later.

You can contact the Author using this form

• Kyle Creyts - http://twitter.com/hushedfeet