# bx33661/Wireshark-MCP [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/bx33661/Wireshark-MCP  
**GitHub Stars:** 235  
**Views:** 4  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/bx33661-wireshark-mcp

## Description
Wireshark network packet analysis MCP Server with capture, protocol stats, field extraction, and security analysis capabilities.

## Tools
Capabilities this server exposes over MCP:

- **wireshark_list_interfaces** — List available network interfaces for capture.
- **wireshark_capture** — Capture live network traffic. capture_filter: BPF syntax. ring_buffer: "filesize:1024,files:5".
- **wireshark_filter_save** — Filter packets from a pcap and save to a new file using a Wireshark display filter.
- **wireshark_stats_protocol_hierarchy** — [PHS] Protocol hierarchy statistics showing distribution of protocols in the capture.
- **wireshark_stats_endpoints** — [Endpoints] List all endpoints and traffic stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.
- **wireshark_stats_conversations** — [Conversations] Communication pairs and stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.
- **wireshark_stats_io_graph** — [I/O Graph] Traffic volume over time. interval: bucket size in seconds. filters: optional
        semicolon-separated display filters to break the traffic out by type, e.g. 'tcp;udp;dns'.
- **wireshark_stats_expert_info** — [Expert Info] Automatic anomaly detection: retransmissions, errors, warnings, protocol issues.
- **wireshark_stats_service_response_time** — [SRT] Service response time statistics. protocol: 'http'|'dns'|'smb' etc.
- **wireshark_get_packet_list** — [Summary] Packet list (top pane). TSV: No/Time/Src/Dst/Proto/Len/Info. custom_columns: comma-separated fields.
- **wireshark_get_packet_details** — [Detail] Full JSON for one packet. layers: comma-separated protocol filter (e.g. "ip,tcp,http").
- **wireshark_get_packet_bytes** — [Bytes] Raw hex/ASCII dump of a single packet.
- **wireshark_get_packet_context** — [Context] Packets surrounding a specific frame (count before and after).
- **wireshark_read_packets** — [DEPRECATED] JSON packet data. Use get_packet_list + get_packet_details instead.
- **wireshark_extract_fields** — [Tabular] Extract fields as TSV. fields: comma-separated (e.g. "ip.src,tcp.port,http.host").
- **wireshark_search_packets** — [Search] Find packets by content.
- **wireshark_follow_stream** — [Stream] Reassemble stream with pagination. protocol: tcp|udp|tls|http|http2. output_mode: ascii|hex|raw.
- **wireshark_get_file_info** — Get capture file metadata (type, packet count, duration, size) via capinfos.
- **wireshark_merge_pcaps** — Merge multiple capture files into one. input_files: comma-separated paths.
- **wireshark_quick_analysis** — [Agent] One-call traffic overview: file info, protocols, top talkers, conversations, hostnames, anomalies.
- **wireshark_get_capabilities** — Get Wireshark suite capabilities for this MCP server instance (available tools and versions).
- **wireshark_editcap_trim** — Trim capture to a timestamp window. Times in editcap format.
- **wireshark_editcap_split** — Split capture into multiple files by packet count or time interval.
- **wireshark_editcap_time_shift** — Shift packet timestamps by a relative number of seconds.
- **wireshark_editcap_deduplicate** — Remove duplicate packets using editcap's duplicate window matching.
- **wireshark_text2pcap_import** — Convert ASCII or hex dump into a capture file using text2pcap. encapsulation: link-layer type (default: ether).
- **wireshark_decode_as** — [Dissection] Decode-as for non-standard ports. Rules: 'tcp.port==8080,http;udp.port==5353,dns'.
- **wireshark_set_protocol_prefs** — [Dissection] Protocol preference overrides. Prefs: 'tcp.desegment_tcp_streams:TRUE;http.ssl.port:8443'.
- **wireshark_decrypt_tls** — [Decrypt] Decrypt TLS traffic using SSLKEYLOGFILE, show HTTP data.
- **wireshark_decrypt_wpa** — [Decrypt] Decrypt WPA/WPA2 traffic with passphrase (+SSID).
- **wireshark_extract_frames** — [File] Extract specific frame ranges to a new pcap. Ranges: '1-10 15 20-30'.
- **wireshark_flow_graph** — [Stats] Flow/sequence graph showing packet exchange. Types: 'any', 'tcp', 'icmp'.
- **wireshark_analyze_protocol** — [Protocol] Analyze one protocol with the right fields and display filter already chosen.

        Returns a summary plus matching rows, or "no <protocol> traffic found". `limit`
        caps rows; rtp and smb return fixed-size tables and ignore it.
        
- **wireshark_analyze_tcp_health** — [TCP] Analyze TCP connection health (retransmissions, dup ACKs, zero window, resets).
- **wireshark_detect_arp_spoofing** — [ARP] Detect potential ARP spoofing (duplicate IP-MAC, gratuitous floods, reply storms).
- **wireshark_detect_beaconing** — [Anomaly] Detect periodic communication patterns (C2 beacons) by analyzing connection timing intervals and jitter.
- **wireshark_detect_dns_tunnel** — [Security] Detect DNS tunneling (long queries, TXT abuse, subdomain entropy).
- **wireshark_detect_dos_attack** — [Security] Detect DoS/DDoS patterns (SYN flood, ICMP/UDP flood, DNS amplification).
- **wireshark_detect_exfiltration** — [Anomaly] Detect data exfiltration (large outbound transfers, DNS length anomalies, non-standard ports).
- **wireshark_detect_port_scan** — [Security] Detect port scanning (SYN, FIN, NULL, Xmas scans). threshold: min unique dst ports to flag.
- **wireshark_detect_protocol_anomalies** — [Anomaly] Detect protocol anomalies (known protocols on non-standard ports, unusual protocol distributions).
- **wireshark_export_objects** — [Export] Extract embedded files from traffic. protocol: 'http'|'smb'|'tftp'|'imf'|'dicom'.
- **wireshark_extract_credentials** — [Security] Scan for plaintext credentials (HTTP Basic Auth, FTP passwords, Telnet).
- **wireshark_extract_dns_queries** — [DNS] Extract DNS query details (name, type, response flag) as TSV.
- **wireshark_extract_fingerprints** — [Forensics] Extract JA3 (client) and JA3S (server) TLS fingerprints.

        Matches against ~/.wireshark-mcp/fingerprints/*.json if you maintain any; no
        fingerprint list ships with this package. A JA3 identifies a TLS configuration,
        not an application, so treat any match as a lead to corroborate.
        
- **wireshark_extract_http_requests** — [HTTP] Extract HTTP request details (method, URI, host, user-agent) as TSV.
- **wireshark_geoip_enrich** — [Enrichment] GeoIP lookup for unique IPs — country, city, ASN. Needs GeoLite2 DB.
- **wireshark_scan_file_signatures** — [Forensics] Count packets containing a file magic number (PE, ELF, PDF, Office, archives, images).

        An indicator, not an extraction — use wireshark_export_objects to get file bytes.
        A hit may be a coincidental byte sequence.
        
- **wireshark_verify_ssl_decryption** — [TLS] Verify TLS decryption with SSLKEYLOGFILE-format keylog file.
- **wireshark_yara_scan** — [Security] YARA scan exported files. Detects malware, webshells, shellcode. protocol: http|smb|tftp.
- **wireshark_open_file** — [Entry Point] Open a pcap and get protocol-aware tool recommendations. Returns protocols and relevant tools.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "wireshark-mcp": {
    "command": "uvx",
    "args": ["wireshark-mcp"]
  }
}
```

## Documentation

## What bx33661/Wireshark-MCP MCP server does

The bx33661/Wireshark-MCP MCP server gives an MCP client access to packet analysis backed by tshark and, when available, other Wireshark command-line tools. It works with saved capture files and can also list interfaces or capture live traffic. The tool set covers packet summaries, detailed protocol layers, raw bytes, surrounding frames, stream reconstruction, field extraction, content searches, and capture metadata.

It also supports higher-level investigation tasks. Protocol hierarchy, endpoint, conversation, I/O graph, expert information, and service response-time tools help characterize traffic. A quick-analysis operation combines several overview outputs, while dissection controls can apply decode-as rules or protocol preference overrides. TLS and WPA/WPA2 decryption are available through dedicated tools when the required key material or passphrase is supplied.

## How it works

The bx33661/Wireshark-MCP MCP server receives structured tool calls and turns them into analysis operations against capture files or live traffic. Display filters, BPF capture filters, protocol names, field lists, packet offsets, and pagination parameters determine the scope of each request. Packet lists are returned as TSV, detailed packet views as JSON, and byte views as hexadecimal and ASCII output.

Results are limited to 8,000 characters by default and are truncated at both ends when they exceed that limit. Tools expose offset, limit, or display-filter controls for retrieving more focused portions. The limit can be changed with `WIRESHARK_MCP_MAX_RESULT_CHARS`. Profiles can reduce the advertised tool surface: `full` is the default, while `analysis` removes live-capture and file-writing tools, and `core` removes those plus decryption, dissection overrides, and low-level views.

## Setup and configuration

Install Python 3.10 or newer and Wireshark with `tshark` available on the system PATH. Install the package with:

```sh
pip install wireshark-mcp
```

The command `wireshark-mcp install` can auto-configure detected MCP clients. The server can also be started with `wireshark-mcp serve --profile core` when a smaller tool surface is appropriate. Run `wireshark-mcp doctor` to investigate setup problems. Optional commands—`capinfos`, `mergecap`, `editcap`, `dumpcap`, and `text2pcap`—are detected automatically and enable related features when present.

## Tools and capabilities

The bx33661/Wireshark-MCP MCP server includes tools for:

- Listing capture interfaces and collecting live traffic with BPF filters and ring buffers.
- Filtering, merging, trimming, splitting, deduplicating, and time-shifting capture files.
- Converting ASCII or hexadecimal dumps into captures with text2pcap.
- Reviewing protocol distributions, endpoints, conversations, traffic-over-time graphs, anomalies, and service response times.
- Extracting fields such as IP addresses, ports, and HTTP hosts in tabular form.
- Following TCP, UDP, TLS, HTTP, or HTTP/2 streams as ASCII, hexadecimal, or raw output.
- Applying decode-as rules, protocol preferences, TLS decryption, and WPA/WPA2 decryption.

## Limitations and notes

The server depends on local Wireshark command-line components, with `tshark` required for startup and additional suite tools optional. Live capture and file-writing operations may need appropriate operating-system permissions. The deprecated packet-reading tool should be replaced by the packet-list and packet-details tools. Output truncation means large analyses should use filters or pagination rather than relying on one unrestricted response.

_Full upstream README: https://allmcps.com/mcp/bx33661-wireshark-mcp/readme_