Given a .pcap (or similar) file, I'd like to select one TCP connection and dump both application data streams (the one from the other peer and the one two the other peer) into two separate files on disk.
Let's assume that I have a .pcap file that amongst other things I know contains a full TCP stream (from SYN to final FIN+ACK/RST) of a HTTP/1.1 plaintext connection. I would like to have two resulting files with the content. Ie. one file has
GET / HTTP/1.1\r\n
host: foobar.com\r\n
\r\n
and the other file has
HTTP/1.1 200 ok\r\n
content-length: ...\r\n
... \r\n
\r\n
<html>...</html>
And I want this to be precisely the application data traffic that would've been seen/sent in user space (from read/write/send/recv`/...). What I want to do with this is dump some traffic and use that to test my parsers for a certain some network protocol. The parser should just be able to read one of those files and attempt to parse the data stream.
How could such a command line tool look? I'm not sure if this is super helpful but I thought it might make it clearer what I'm looking for if I also gave a usage example of an imaginary tool which can do this.
Let's call the imaginary tool (this is what I'm looking for) tcp-stream-extract. I'd like to call it with something like
### imaginary usage example of the tool that I'd like to find :)
# dump from 12345 to 23456
tcp-stream-extract \
-i my-captured-packets.pcap
-s 127.0.0.1:12345 \ # source address 127.0.0.1:12345
-d 127.0.0.1:23456 \ # destination address 127.0.0.1:23456
-t '2021-01-28 09:12:00Z' \ # the TCP conn was alive at that time
-w from-port-12345-to-port-23456
# dump from 23456 to 12345
tcp-stream-extract \
-i my-captured-packets.pcap
-s 127.0.0.1:23456 \ # source address 127.0.0.1:12345
-d 127.0.0.1:12345 \ # destination address 127.0.0.1:23456
-t '2021-01-28 09:12:00Z' \ # the TCP conn was at that time
-w from-port-23456-to-port-12345