Hello, while looking at the internet man page for tcpflow, -r switch means "Read packets from file, which was created using the -w option of tcpdump". Are you sure that you've got the right ones ? When you run "file" against the files, what does it say ?