TCP flow extraction

Question

I need to extract TCP Flows with their content from dump file and then save their flow into other file each flow separately

Answer 1

You definitely want to use Bro, more specifically, its contents.bro policy. For example, given a trace that contains HTTP requests, running the following ...

bro -r http.trace -f 'tcp and port 80' contents

... produces files

contents.[senderIP].[senderPort]-[destIP].[destPort]
contents.[destIP].[destPort]-[senderIP].[senderPort] 

for each connection, each containing the unidirectional content of the flow.

The flow reassembly is highly robust, the process scales to very large files, and everything is customizable to your needs.