Wireshark MCP

Simple MCP Server to allow vibe packet analysis in Wireshark.

Prerequisites

Python (3.10 or higher)
Wireshark (ensure tshark is in your PATH)
Supported MCP Client (pick one you like)
- Claude Code
- Claude
- Cursor
- VS Code with generic MCP client extension
- Other MCP Clients

Installation

Install the latest version of the Wireshark MCP package:

pip install wireshark-mcp

Or install directly from source:

pip install git+https://github.com/bx33661/Wireshark-MCP.git

Configuration

Add the server to your MCP client configuration (e.g., claude_desktop_config.json):

{
  "mcpServers": {
    "wireshark": {
      "command": "uv",
      "args": [
        "tool",
        "run",
        "wireshark-mcp"
      ]
    }
  }
}

Note: You can also run it directly with python -m wireshark_mcp if installed in your environment.

Prompt Engineering

LLMs are good at general analysis but can struggle with the specifics of packet dissection. Below is a minimal example prompt strategy:

Your task is to analyze a pcap file using Wireshark MCP tools.
- Start by getting a packet list summary to understand the traffic flow (`wireshark_get_packet_list`).
- If you see interesting packets, get full details for that specific frame (`wireshark_get_packet_details`).
- For TCP/HTTP flows, use `wireshark_follow_stream` to see the full conversation.
- Use `wireshark_extract_http_requests` or `wireshark_extract_dns_queries` for quick high-level overviews.
- NEVER try to guess packet contents; always verify with the tools.
- Create a report.md with your findings.

Available Tools

Packet Analysis (extract.py)

wireshark_get_packet_list(pcap_file, limit=20, offset=0, display_filter="", custom_columns=""): Get summary list of packets. Supports custom columns (e.g., "ip.src,http.host") to replace default view.
wireshark_get_packet_details(pcap_file, frame_number, layers=""): Get full JSON details for a single packet. Supports layer filtering (e.g., "ip,tcp,http") to significantly reduce token usage.
wireshark_get_packet_bytes(pcap_file, frame_number): [New] Get raw Hex/ASCII dump (Packet Bytes view).
wireshark_get_packet_context(pcap_file, frame_number, count=5): [New] View packets surrounding a specific frame (before and after) to understand context.
wireshark_follow_stream(...): Reassemble and view complete stream content with pagination and search.
wireshark_search_packets(pcap_file, match_pattern, search_type="string", limit=50, scope="bytes"): [Enhanced] Find packets.
- scope="bytes": Search in raw payload (Hex/String).
- scope="details": Search in decoded text/fields (Regex supported).
wireshark_read_packets(...): [DEPRECATED] Use get_packet_details instead.

Data Extraction (extract.py)

wireshark_extract_fields(pcap_file, fields, display_filter="", limit=100, offset=0): Extract specific fields as tabular data.
wireshark_extract_http_requests(pcap_file, limit=100): Convenience tool for HTTP method, URI, host.
wireshark_extract_dns_queries(pcap_file, limit=100): Convenience tool for DNS queries.
wireshark_list_ips(pcap_file, type="both"): List all unique IP addresses (src, dst, or both).
wireshark_export_objects(pcap_file, protocol, dest_dir): Extract embedded files (http, smb, etc.) from traffic.
wireshark_verify_ssl_decryption(pcap_file, keylog_file): Verify TLS decryption using a keylog file.

Statistics (stats.py)

wireshark_stats_protocol_hierarchy(pcap_file): Get Protocol Hierarchy Statistics (PHS).
wireshark_stats_endpoints(pcap_file, type="ip"): List all endpoints and their traffic stats.
wireshark_stats_conversations(pcap_file, type="ip"): Show communication pairs and their stats.
wireshark_stats_io_graph(pcap_file, interval=1): Get traffic volume over time (I/O Graph).
wireshark_stats_expert_info(pcap_file): Get Expert Information (anomalies, warnings).
wireshark_stats_service_response_time(pcap_file, protocol="http"): Service Response Time (SRT) statistics.

File Operations (files.py & capture.py)

wireshark_get_file_info(pcap_file): Get detailed metadata about a capture file (capinfos).
wireshark_merge_pcaps(output_file, input_files): Merge multiple capture files into one.
wireshark_list_interfaces(): List available network interfaces for capture.
wireshark_capture(interface, output_file, duration_seconds=10, packet_count=0, capture_filter="", ring_buffer=""): Capture live network traffic.
wireshark_filter_save(input_file, output_file, display_filter): Filter packets from a pcap and save to a new file.

Security (security.py)

wireshark_check_threats(pcap_file): Check captured IPs against URLhaus threat intelligence.
wireshark_extract_credentials(pcap_file): Scan for plaintext credentials (HTTP Auth, FTP, Telnet).

Decoding (decode.py)

wireshark_decode_payload(data, encoding="auto"): Decode common encodings (Base64, Hex, URL, Gzip, Deflate, Rot13, etc.) with smart auto-detection.

Visualization (visualize.py)

wireshark_plot_traffic(pcap_file, interval=1): Generate ASCII bar chart of traffic volume over time.
wireshark_plot_protocols(pcap_file): Generate ASCII tree view of protocol hierarchy.

Development

To test the MCP server itself:

npx -y @modelcontextprotocol/inspector uv run wireshark-mcp

This will open a web interface where you can interact with the tools directly.

MCP Servers