Wireshark MCP

What bx33661/Wireshark-MCP MCP server does

The bx33661/Wireshark-MCP MCP server gives an MCP client access to packet analysis backed by tshark and, when available, other Wireshark command-line tools. It works with saved capture files and can also list interfaces or capture live traffic. The tool set covers packet summaries, detailed protocol layers, raw bytes, surrounding frames, stream reconstruction, field extraction, content searches, and capture metadata.

It also supports higher-level investigation tasks. Protocol hierarchy, endpoint, conversation, I/O graph, expert information, and service response-time tools help characterize traffic. A quick-analysis operation combines several overview outputs, while dissection controls can apply decode-as rules or protocol preference overrides. TLS and WPA/WPA2 decryption are available through dedicated tools when the required key material or passphrase is supplied.

How it works

The bx33661/Wireshark-MCP MCP server receives structured tool calls and turns them into analysis operations against capture files or live traffic. Display filters, BPF capture filters, protocol names, field lists, packet offsets, and pagination parameters determine the scope of each request. Packet lists are returned as TSV, detailed packet views as JSON, and byte views as hexadecimal and ASCII output.

Results are limited to 8,000 characters by default and are truncated at both ends when they exceed that limit. Tools expose offset, limit, or display-filter controls for retrieving more focused portions. The limit can be changed with WIRESHARK_MCP_MAX_RESULT_CHARS. Profiles can reduce the advertised tool surface: full is the default, while analysis removes live-capture and file-writing tools, and core removes those plus decryption, dissection overrides, and low-level views.

Setup and configuration

Install Python 3.10 or newer and Wireshark with tshark available on the system PATH. Install the package with:

pip install wireshark-mcp

The command wireshark-mcp install can auto-configure detected MCP clients. The server can also be started with wireshark-mcp serve --profile core when a smaller tool surface is appropriate. Run wireshark-mcp doctor to investigate setup problems. Optional commands—capinfos, mergecap, editcap, dumpcap, and text2pcap—are detected automatically and enable related features when present.

Tools and capabilities

The bx33661/Wireshark-MCP MCP server includes tools for:

• Listing capture interfaces and collecting live traffic with BPF filters and ring buffers.
• Filtering, merging, trimming, splitting, deduplicating, and time-shifting capture files.
• Converting ASCII or hexadecimal dumps into captures with text2pcap.
• Reviewing protocol distributions, endpoints, conversations, traffic-over-time graphs, anomalies, and service response times.
• Extracting fields such as IP addresses, ports, and HTTP hosts in tabular form.
• Following TCP, UDP, TLS, HTTP, or HTTP/2 streams as ASCII, hexadecimal, or raw output.
• Applying decode-as rules, protocol preferences, TLS decryption, and WPA/WPA2 decryption.

Limitations and notes

The server depends on local Wireshark command-line components, with tshark required for startup and additional suite tools optional. Live capture and file-writing operations may need appropriate operating-system permissions. The deprecated packet-reading tool should be replaced by the packet-list and packet-details tools. Output truncation means large analyses should use filters or pagination rather than relying on one unrestricted response.