You can get a text-ified version of TCP logs with standard tools: http://windump.polito.it/docs/manual.htm windump -r -x -n http://www.bogus.net/~codex/ tcpdump -x -l As the "tcpdump2ascii" example shows above, you can parse this readily. Some example scripts which do exactly this: http://packetstorm.linuxsecurity.com/Exploit_Code_Archive/dumptcplink http://www.net.princeton.edu/software/etdc/ http://www.nosneros.net/hso/code/snifob/download/snifob-current On the other hand, a few people directly unpack the binary data. Code that does this are: http://chaosreader.sourceforge.net/ http://search.cpan.org/dist/Net-TcpDumpLog/