Advertise
MCP.so
Sign In
W

Wireshark MCP Server

@bx33661

Repository

Basic information

Category

Other

Transports

stdio

Author

bx33661

Submitted by

bx king

About Wireshark MCP Server

Give your AI assistant a packet analyzer.

#mcp#wireshark#tshark#packet-analysis#network-security#pcap

Wireshark MCP Server config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "wireshark": {
      "command": "uv",
      "args": [
        "tool",
        "run",
        "wireshark-mcp"
      ]
    }
  }
}

Wireshark MCP Server tools

26

List available network interfaces for capture. Returns: List of interfaces with index, name, and status Example: wireshark_list_interfaces()

Capture live network traffic. Args: interface: Interface index or name (from list_interfaces) output_file: Absolute path for output .pcap file duration_seconds: Capture duration (0 = unlimited) packet_count: Stop after N packets (0 = unlimited) capture_filter: BPF filter (e.g. "host 192.168.1.1 and port 80") ring_buffer: Ring buffer config (e.g. "filesize:1024,files:5") Returns: Success message with file path or error JSON Errors: ExecutionError: Capture failed Example: wireshark_capture("eth0", "/tmp/capture.pcap", duration_seconds=30, capture_filter="port 80")

Filter packets from a pcap and save to a new file. Args: input_file: Source pcap file output_file: Destination pcap file display_filter: Wireshark display filter (e.g. "http.request.method == POST") Returns: Success message or error JSON Errors: FileNotFound: input_file does not exist ExecutionError: Filter failed Example: wireshark_filter_save("big.pcap", "http_only.pcap", "http")

[PHS] Get Protocol Hierarchy Statistics. Shows distribution of protocols in the capture. Returns: Tree-structured protocol statistics or JSON error Errors: FileNotFound: pcap_file does not exist Example: wireshark_stats_protocol_hierarchy("traffic.pcap")

[Endpoints] List all endpoints and their traffic stats. Args: type: Protocol type - 'eth', 'ip', 'ipv6', 'tcp', 'udp', 'sctp', 'wlan' Returns: Endpoint statistics table or JSON error Errors: FileNotFound: pcap_file does not exist InvalidParameter: Invalid protocol type Example: wireshark_stats_endpoints("traffic.pcap", type="tcp")

[Conversations] Show communication pairs and their stats. Args: type: Protocol type - 'eth', 'ip', 'ipv6', 'tcp', 'udp', 'sctp', 'wlan' Returns: Conversation statistics table or JSON error Errors: FileNotFound: pcap_file does not exist InvalidParameter: Invalid protocol type Example: wireshark_stats_conversations("traffic.pcap", type="tcp")

[I/O Graph] Traffic volume over time. Args: interval: Time interval in seconds (default: 1) Returns: Time-series traffic statistics or JSON error Errors: FileNotFound: pcap_file does not exist Example: wireshark_stats_io_graph("traffic.pcap", interval=5)

[Expert Info] Automatic anomaly detection. Detects: retransmissions, errors, warnings, protocol issues. Returns: Expert analysis results or JSON error Errors: FileNotFound: pcap_file does not exist Example: wireshark_stats_expert_info("traffic.pcap")

[SRT] Service Response Time statistics. Args: protocol: Application protocol - 'http', 'dns', 'smb', etc. Returns: Response time statistics or JSON error Errors: FileNotFound: pcap_file does not exist Example: wireshark_stats_service_response_time("web.pcap", protocol="http")

[Summary] Get a summary list of packets (like Wireshark's top pane). Use this first to scan traffic before drilling down. Args: pcap_file: Path to capture file limit: Rows to return (default: 20) offset: Skip first N rows display_filter: Wireshark display filter (e.g. "tcp.port == 80") custom_columns: Comma-separated list of fields (e.g. "ip.src,http.host") If provided, replaces default columns. Returns: Tabular list with columns: No, Time, Source, Destination, Protocol, Length, Info (Or your custom columns if specified) Example: wireshark_get_packet_list("traffic.pcap", display_filter="http", custom_columns="ip.src,http.host,http.request.uri")

[Detail] Get full details for a SINGLE packet (like Wireshark's bottom pane). Args: pcap_file: Path to capture file frame_number: The packet number (from wireshark_get_packet_list) layers: Comma-separated list of layers/protocols to include (e.g. "ip,tcp,http"). Reduces output size significantly. Returns: Complete JSON structure of the packet Example: wireshark_get_packet_details("traffic.pcap", frame_number=42, layers="http")

[Bytes] Get raw Hex/ASCII dump (like Wireshark's 'Packet Bytes' pane). Args: pcap_file: Path to capture file frame_number: The packet number Returns: Standard Wireshark Hex/ASCII dump. Example: wireshark_get_packet_bytes("traffic.pcap", 42)

[Context] View packets surrounding a specific frame (before and after). Useful for understanding what led to an error or what happened immediately after. Args: pcap_file: Path to capture file frame_number: The center packet number count: Number of packets to show before and after (default: 5) Returns: Tabular packet list centering on the target frame.

[DEPRECATED] Read packet data in structured JSON format. WARNING: This tool can return very large, complex JSON. Prefer `wireshark_get_packet_list` and `wireshark_get_packet_details` for efficient analysis. Args: pcap_file: Path to capture file limit: Maximum packets to return (default: 100) offset: Skip first N packets (pagination) display_filter: Wireshark display filter (e.g. "tcp.port == 80") Returns: JSON array of packets with full layer details on success JSON error object on failure: {"success": false, "error": {...}} Errors: FileNotFound: pcap_file does not exist ExecutionError: tshark JSON parsing failed Example: wireshark_read_packets("traffic.pcap", limit=10, display_filter="http")

[Tabular] Extract specific fields as comma/tab-separated data. Args: fields: Comma-separated field names (e.g. "ip.src,tcp.port,http.host") display_filter: Optional filter (e.g. "http.request.method == POST") limit: Max rows to return (default: 100) offset: Skip first N rows (pagination) Returns: Tabular text output or JSON error Errors: FileNotFound: pcap_file does not exist ExecutionError: Field extraction failed Example: wireshark_extract_fields("file.pcap", "ip.src,ip.dst,tcp.port", display_filter="tcp")

[Convenience] List all unique IP addresses in capture. Args: type: IP type to extract - 'src', 'dst', or 'both' Returns: Newline-separated list of unique IPs or JSON error Example: wireshark_list_ips("traffic.pcap", type="src")

[Search] Find packets containing specific data. Args: pcap_file: Path to capture file match_pattern: Pattern to search for search_type: Search method - 'string', 'hex', 'regex' limit: Maximum matches to return (default: 50) scope: Search scope - 'bytes' (default), 'details', or 'filter' - 'bytes': Searches raw packet payload (frame contains) - 'details': Searches decoded text layer (frame matches) - 'filter': Uses standard Wireshark display filter syntax (e.g. "http.response.code == 200") Returns: List of matching packets (summary view) or JSON error Errors: FileNotFound: pcap_file does not exist Example: wireshark_search_packets("traffic.pcap", "password", scope="bytes") wireshark_search_packets("traffic.pcap", "http.response.code == 200", scope="filter")

[Stream] Reassemble and view complete stream content. Supports pagination to avoid token limits. Args: stream_index: Stream ID from conversations/stats protocol: Stream protocol - 'tcp', 'udp', 'tls', 'http', 'http2' output_mode: Output format - 'ascii', 'hex', 'raw' limit_lines: Max lines to return (default: 500) offset_lines: Skip first N lines (for pagination) search_content: Optional string to grep/search within the stream Returns: Reconstructed stream data or JSON error Errors: FileNotFound: pcap_file does not exist InvalidParameter: Invalid protocol Example: wireshark_follow_stream("traffic.pcap", stream_index=0, search_content="password")

Get detailed metadata about a capture file. Uses capinfos to show: file type, packet count, duration, size, etc. Returns: Detailed file metadata or JSON error Errors: FileNotFound: pcap_file does not exist ToolNotFound: capinfos not available Example: wireshark_get_file_info("traffic.pcap")

Merge multiple capture files into one. Args: output_file: Path for merged output file input_files: Comma-separated list of input file paths Returns: Success message or JSON error Errors: FileNotFound: One or more input files not found ToolNotFound: mergecap not available Example: wireshark_merge_pcaps("merged.pcap", "file1.pcap,file2.pcap,file3.pcap")

[Utils] Decode common encodings (Base64, Hex, URL, Gzip, etc.). Args: data: The string to decode. encoding: Target encoding. Supported: 'base64', 'hex', 'url', 'rot13', 'gzip', 'deflate', 'html', 'unicode', 'quopri', 'ascii85'. Use 'auto' to try all and sort by readability. Returns: Decoded string (or JSON in 'auto' mode).

[Visualization] Generate an ASCII bar chart of traffic volume (I/O Graph). Useful for identifying traffic spikes, DDoS start times, or silence patterns. Args: pcap_file: Path to pcap file interval: Time interval bucket in seconds (default: 1) Returns: String containing the ASCII chart

[Visualization] Generate an ASCII tree of protocol hierarchy. Shows the distribution of protocols (e.g., how much is HTTP vs DNS). Args: pcap_file: Path to pcap file Returns: String containing the ASCII tree

[Agent] One-call comprehensive security audit. Automatically runs 8 analysis phases internally and returns a structured security report with risk scoring. No manual tool-chaining needed. Phases: File summary → Protocol overview → Threat intelligence (URLhaus) → Credential exposure → Port scan detection → DNS anomaly detection → Cleartext protocol usage → Protocol anomalies (Expert Info) Args: pcap_file: Path to capture file Returns: Complete security audit report with risk level, findings, and recommendations. Example: wireshark_security_audit("suspicious_traffic.pcap")

[Agent] One-call traffic overview and analysis. Automatically gathers file info, protocol distribution, top talkers, conversations, hostnames, and anomalies into a single comprehensive report. Phases: File info → Protocol distribution → Top talkers → Top conversations → Key hostnames (HTTP + DNS) → Anomaly summary (Expert Info) Args: pcap_file: Path to capture file Returns: Complete traffic analysis report with suggested next steps. Example: wireshark_quick_analysis("capture.pcap")

[Entry Point] Open a pcap file and activate relevant analysis tools. This is the recommended FIRST tool to call. It analyzes the capture file, detects what protocols are present, and dynamically enables the most relevant tools for your analysis. This keeps the tool list focused and efficient. After calling this tool, new protocol-specific tools will become available (e.g., HTTP extraction, DNS tunnel detection, TLS handshake analysis). Args: pcap_file: Path to the capture file (.pcap, .pcapng, etc.) Returns: File overview, protocol summary, and list of newly activated tools. Example: wireshark_open_file("/path/to/capture.pcap")

Overview

What is Wireshark MCP?

Wireshark MCP is an MCP server that wraps tshark into structured tools, letting AI assistants like Claude or Cursor perform deep packet analysis without touching the command line. Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.

How to use Wireshark MCP?

Install via pip install wireshark-mcp. Configure any MCP‑compatible client (Claude Desktop, Claude Code, Cursor, etc.) with the command uv tool run wireshark-mcp. Provide a pcap file and instruct the assistant to analyze it using the available tools.

Key features of Wireshark MCP

  • Paginated packet list with display filters and custom columns.
  • Full JSON dissection of a single frame with optional layer filtering.
  • TCP/UDP/HTTP stream reassembly with pagination and search.
  • Extract structured data: DNS queries, HTTP requests, IP lists, credentials.
  • Protocol hierarchy, endpoint, conversation, and I/O graph statistics.
  • Live capture from network interfaces with BPF filter and ring buffer.
  • Security analysis: threat intelligence (URLhaus), port scan, DoS, DNS tunneling.
  • TLS handshake details, TCP health, ARP spoofing, SMTP, and DHCP extraction.
  • ASCII traffic/protocol charts and payload decoding (Base64, Hex, Gzip, etc.).

Use cases of Wireshark MCP

  • Network troubleshooting: analyze TCP retransmissions, response times, and bottlenecks.
  • Security incident response: triage suspicious traffic, extract IOCs, detect attacks.
  • CTF challenge solving: search flags, follow streams, decode payloads.
  • Forensic analysis of pcap files: protocol breakdown, expert info, file extraction.

Frequently asked questions

1

What are the prerequisites?

Python 3.10+ and Wireshark installed with `tshark` available in your PATH.

2

How do I configure it for Claude Desktop?

Edit `claude_desktop_config.json` (macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`, Windows: `%APPDATA%\Claude\claude_desktop_config.json`) with the server configuration using `"command": "uv"` and `"args": ["tool", "run", "wireshark-mcp"]`.

3

Can I run it via Docker?

Yes: run `docker compose up -d`, then point your client to `http://localhost:8080/sse`.

4

What transport modes are supported?

Default is stdio. You can also start SSE mode with `wireshark-mcp --transport sse --port 8080`.

5

Does it include security analysis tools?

Yes, with tools for threat intelligence cross‑reference (URLhaus), credential detection, port scan detection, DNS tunneling detection, DoS detection, and comprehensive anomaly analysis.

Comments

More Other MCP servers

Klarix Intelligence Engine

Klarix

B2B competitive intelligence, live sales battlecards, 5-axis ICP prospect fit scoring, and tech stack teardowns over MCP and REST with cited public-web evidence.

Screenpipe

screenpipe

YC (S26) | Open Computer History | Continuously record your company computer work, map your workflows, help you find work worth automating, and power your agents' context

22.0K

Health by Dr Brad

Dr Brad Stanfield

Health by Dr Brad works out a health plan from your own results: which screening is due at your age, and evidence-based suggestions, each with the reason and the published guideline or study behind it. Your record is one

N

Next Generation Movers: free moving quotes (remote MCP)

Next Generation Movers

Free moving quotes for AI agents from Next Generation Movers, a licensed interstate mover (USDOT 3764697). US long-distance nationwide and local DC/MD/VA. Indicative ballpark price and booking options; optional $0.01 x40

DeepMark

DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.

Advertise