# Install tcpsplit with Homebrew Break a packet trace into some number of sub-traces. Version 0.3 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:tcpsplit ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install tcpsplit ``` Evidence: local Homebrew formula metadata ## Package facts - **Package key:** brew:tcpsplit - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.3 - **Source summary:** Break a packet trace into some number of sub-traces - **Homepage:** - **Upstream docs:** - **License:** LicenseRef-Homebrew-cannot-represent - **Source archive:** - **Generated:** 2026-07-08T18:08:21+00:00 ## Executables - tcpsplit (cli) - tcpsplit (alias) ## Uses from macOS - libpcap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, sonoma, ventura, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.3 - Local data: ok - Upstream repository: https://www.icir.org/mallman/software/tcpsplit/ - info: No package-manager update timestamp was available. - info: Release/tag comparison is only available for GitHub repositories. ## Project history and usage tcpsplit is a small libpcap trace utility from Mark Allman for splitting one packet trace into several smaller traces while keeping each TCP connection together. Its history is intentionally modest: it is a research-and-analysis helper rather than a broad platform. ### Project history The official ICIR page presents tcpsplit as Mark Allman's utility for breaking large libpcap traces along TCP connection boundaries. The 0.3 README identifies the March 2025 release and says it was developed for MacOS and Linux, with libpcap as the required dependency. ### Adoption history The supplied package metadata shows only a Homebrew package among the tracked package managers, which fits the tool's narrow role in packet-trace analysis. The author's homepage notes a new tcpsplit release in March 2025, so the project was still maintained for its niche even without broad packaging. ### How it is used The package is used when a packet trace is too large for detailed work or when analysis should be developed against a subset without splitting individual TCP flows across output files. The README documents deterministic splitting, prefix-based IPv4 and IPv6 classification, and a validation script to check that splitting did not lose data. ### Why package nerds care For package nerds, tcpsplit is the kind of single-purpose C utility that belongs near tcpdump and other pcap tools: it does one trace-management job and stays out of the way. Its value is less about popularity and more about preserving flow boundaries while making large captures tractable. ### Timeline - March 2025: tcpsplit 0.3 released with refactoring, IPv6 support, Linux cooked SLL2 support, and prefix options. - Package metadata: tracked as a Homebrew formula. ### Related projects - libpcap is the required trace-file dependency; tcpdump-style pcap captures are the practical input; VLAN and Linux cooked capture formats appear in the official ChangeLog as supported trace concerns. ### Sources - - - - input source_facts.package-manager ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** tcpsplit - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Related links - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Homebrew utility packages](https://www.automicvault.com/pkg/brew-utility-packages/) - Matched Homebrew package provider. - [miruo](https://www.automicvault.com/pkg/brew/miruo/) - Shares av.db curated category or tags: cli, networking, packet-analysis, pcap, tcp. - [httpflow](https://www.automicvault.com/pkg/brew/httpflow/) - Shares av.db curated category or tags: cli, networking, packet-analysis, pcap. - [ipsumdump](https://www.automicvault.com/pkg/brew/ipsumdump/) - Shares av.db curated category or tags: cli, networking, packet-analysis, pcap. - [packetq](https://www.automicvault.com/pkg/brew/packetq/) - Shares av.db curated category or tags: cli, networking, packet-analysis, pcap. - [sngrep](https://www.automicvault.com/pkg/brew/sngrep/) - Shares av.db curated category or tags: cli, networking, packet-analysis, pcap. - [tcpdump](https://www.automicvault.com/pkg/brew/tcpdump/) - Shares av.db curated category or tags: cli, networking, packet-analysis, pcap. - [tcpflow](https://www.automicvault.com/pkg/brew/tcpflow/) - Shares av.db curated category or tags: cli, networking, packet-analysis, tcp. - [httpry](https://www.automicvault.com/pkg/brew/httpry/) - Shares av.db curated category or tags: cli, networking, packet-analysis. ## Combined YAML source View the package source record on GitHub. [combined/tcpsplit.yml](https://github.com/automic-vault/db/blob/main/combined/tcpsplit.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - cross-ecosystem install command graph