# Install tcpsplit with Homebrew

Break a packet trace into some number of sub-traces. Version 0.3 via Homebrew; verified from local package data.

## Install

```sh
sudo av install brew:tcpsplit
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install tcpsplit
```

  Evidence: local Homebrew formula metadata

## Package facts

- **Package key:** brew:tcpsplit
- **Package manager:** Homebrew
- **Version:** 0.3
- **Source summary:** Break a packet trace into some number of sub-traces
- **Homepage:** <https://www.icir.org/mallman/software/tcpsplit/>
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- tcpsplit (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 0.3
## Project history and usage

tcpsplit is a small libpcap trace utility from Mark Allman for splitting one packet trace into several smaller traces while keeping each TCP connection together. Its history is intentionally modest: it is a research-and-analysis helper rather than a broad platform.

### Project history

The official ICIR page presents tcpsplit as Mark Allman's utility for breaking large libpcap traces along TCP connection boundaries. The 0.3 README identifies the March 2025 release and says it was developed for MacOS and Linux, with libpcap as the required dependency.

### Adoption history

The supplied package metadata shows only a Homebrew package among the tracked package managers, which fits the tool's narrow role in packet-trace analysis. The author's homepage notes a new tcpsplit release in March 2025, so the project was still maintained for its niche even without broad packaging.

### How it is used

The package is used when a packet trace is too large for detailed work or when analysis should be developed against a subset without splitting individual TCP flows across output files. The README documents deterministic splitting, prefix-based IPv4 and IPv6 classification, and a validation script to check that splitting did not lose data.

### Why package nerds care

For package nerds, tcpsplit is the kind of single-purpose C utility that belongs near tcpdump and other pcap tools: it does one trace-management job and stays out of the way. Its value is less about popularity and more about preserving flow boundaries while making large captures tractable.

### Timeline

- March 2025: tcpsplit 0.3 released with refactoring, IPv6 support, Linux cooked SLL2 support, and prefix options.
- Package metadata: tracked as a Homebrew formula.

### Related projects

- libpcap is the required trace-file dependency; tcpdump-style pcap captures are the practical input; VLAN and Linux cooked capture formats appear in the official ChangeLog as supported trace concerns.

### Sources

- <https://www.icir.org/mallman/>
- <https://www.icir.org/mallman/software/tcpsplit/>
- <https://www.icir.org/mallman/software/tcpsplit/ChangeLog>
- input source_facts.package-manager


## Security Notes

narrow executable package without higher-risk signals.

- **Geiger risk:** green / low
- narrow executable package without higher-risk signals


## Combined YAML source

View the package source record on GitHub. [combined/tcpsplit.yml](https://github.com/mxcl/pkgdb/blob/main/combined/tcpsplit.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- cross-ecosystem install command graph