data-ai MCP Server
Wireshark-MCP，Give your AI assistant a packet analyzer. Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.
Discovered via unknown and last synced 3mo ago.
1. Install the package
pip install wireshark-mcp
**Smart file opener**: analyzes pcap content and recommends the most relevant tools while keeping the MCP tool surface stable
Reassemble a full TCP / UDP / HTTP stream with pagination and search
**One-call security audit**: 8-phase analysis (threat intel, credential scan, port scan, DNS tunnel, cleartext, anomalies) with risk scoring (0-100) and recommendations
All unique source, destination, or both IP addresses
**One-call traffic overview**: file info, protocol distribution, top talkers, conversations, hostnames, anomaly summary, suggested next steps
Protocol Hierarchy Statistics — see what protocols dominate
v1.0 baseline
Config File
Full JSON dissection of a single frame, with optional layer filtering to cut token usage
Pattern search across raw bytes or decoded fields (Regex supported)
File metadata via `capinfos` (duration, packet count, link type)
Shift packet timestamps by a relative offset using `editcap`
Detect DoS/DDoS patterns (SYN flood, ICMP/UDP flood, DNS amplification)
Extract embedded files (HTTP, SMB, TFTP, etc.)
SRT stats for HTTP, DNS, and other protocols
Detect DNS tunneling (long queries, TXT abuse, subdomain entropy)
DHCP lease information: assigned IPs, hostnames, DNS servers
CTF challenge solver: flag search, stream analysis, steganography checks
Confirm TLS decryption using a keylog file
Split a capture by packet count or interval using `editcap`
View N packets before and after a frame for contextual debugging
Wireshark's expert analysis: errors, warnings, notes
Detect plaintext credentials in HTTP Basic Auth, FTP, and Telnet
Remove duplicate packets using `editcap`'s duplicate window
List available network interfaces
Raw Hex + ASCII dump (Wireshark's "Packet Bytes" pane)
All DNS queries in the capture
Traffic volume over time (spot DDoS, scans, bursts)
Comprehensive anomaly analysis: cleartext protocols, unusual ports, expert warnings
--- ## Troubleshooting
Extract any tshark fields as a table
Communication pairs with byte/packet counts
Start a live capture (duration, packet count, BPF filter, ring buffer)
SMTP email metadata: sender, recipient, mail server info
Description
**Toolchain capability report**: required, recommended, and optional Wireshark suite tools visible to the current MCP server
Paginated packet list with display filter and custom column support
Deprecated compatibility tool retained for `1.x`; prefer `wireshark_get_packet_list` and `wireshark_get_packet_details`
HTTP method, URI, and host for every request
All endpoints sorted by traffic volume
Merge multiple captures into one file
Apply a display filter and save matching packets to a new file
Trim a capture to a timestamp window using `editcap`
Convert ASCII or hex dumps into capture files using `text2pcap`
Cross-reference captured URLs and hostnames against [URLhaus](https://urlhaus.abuse.ch/) threat intelligence
Detect SYN, FIN, NULL, and Xmas port scans with configurable threshold
TLS version, cipher suite, SNI, and certificate info from Client/Server Hello
TCP retransmissions, duplicate ACKs, zero window, resets, out-of-order analysis
ARP spoofing detection: IP-MAC conflicts, gratuitous ARP floods
Auto-detect and decode Base64, Hex, URL encoding, Gzip, Deflate, Rot13, and more
ASCII bar chart of traffic over time — spot DDoS or scan patterns instantly
ASCII protocol tree — visual overview of what's in the capture
Description
Full security audit workflow: threat intel, credential scan, attack detection
Network performance analysis: TCP health, response times, bottlenecks
Wireshark MCP
IR workflow: triage, IOC extraction, attack timeline, containment
Quick traffic summary with protocol breakdown and visualization
[CONTRIBUTING.md](CONTRIBUTING.md)
[CHANGELOG.md](CHANGELOG.md)
Highlights
The server starts with only `tshark` required. Optional tools (`capinfos`, `mergecap`, `editcap`, `dumpcap`, `text2pcap`) are auto-detected and enable extra features when present. --- ## Documentation