Forensic

Uses tshark to identify TCP connections

tshark -nlr FILENAME -Y tcp.flags.syn==1 -T fields -e tcp.stream

tshark looks for TCP connections and gives them an ID: 0, 1,...

Dump the contents of each stream by replacing ID with the stream ID: 0, 1,...

tshark -nlr FILENAME -qz "follow,tcp,ascii,ID"