tcpflow

Reassemble TCP streams to per-connection files.

$ sudo tcpflow -i any port 80
$ sudo tcpflow -r capture.pcap -o out/
$ sudo tcpflow -i eth0 -c 'port 25'