Wireshark MCP Server

Analyze an existing PCAP/PCAPNG file. Args: filepath: Path to the PCAP/PCAPNG file display_filter: Wireshark display filter (e.g., "http.request", "tcp.port == 443") max_packets: Maximum number of packets to analyze (max 1000) Returns: Packet analysis results Example: { "status": "success", "file": …

Generate protocol hierarchy and conversation statistics from a PCAP file. Args: filepath: Path to the PCAP/PCAPNG file Returns: Protocol statistics including hierarchy and IP conversations Example: { "status": "success", "file": "/path/to/capture.pcap", "protocol_hierarchy": "...", "ip_conversations…

Get detailed information about a capture file. Args: filepath: Path to the PCAP/PCAPNG file Returns: File metadata including size, packet count, duration, etc. Example: { "status": "success", "file": "/path/to/capture.pcap", "info": "File name: ...\nFile size: ...\nPacket count: ..." }

Get list of available network interfaces for packet capture. Returns: List of network interfaces with their names and numbers Example: { "status": "success", "interfaces": [ "1. eth0", "2. wlan0", "3. lo" ], "count": 3 }

Capture live network packets from a specified interface. Args: interface: Network interface name or number (e.g., "eth0", "1") count: Number of packets to capture (max 1000) capture_filter: BPF capture filter (e.g., "tcp port 80", "host 192.168.1.1") timeout: Capture timeout in seconds (max 60) form…

Export packets from PCAP to structured JSON format. Args: filepath: Path to PCAP file display_filter: Wireshark display filter max_packets: Maximum packets to export Returns: Full packet data in JSON format

Export packets to CSV format with custom fields. Args: filepath: Path to PCAP file fields: Comma-separated list of fields to export display_filter: Wireshark display filter Returns: CSV formatted packet data Example fields: - "frame.number,frame.time,ip.src,ip.dst" - "tcp.srcport,tcp.dstport,tcp.fla…

Convert PCAP file between formats. Args: filepath: Path to input PCAP file output_format: Target format ("pcap" or "pcapng") Returns: Conversion result with output file path Note: Output file is created in same directory with new extension.

Follow TCP stream to reconstruct conversation. Args: filepath: Path to PCAP file stream_index: TCP stream index (0-based) format: Output format ("ascii", "hex", "raw") Returns: Reconstructed TCP conversation Example: { "status": "success", "stream_index": 0, "format": "ascii", "data": "GET / HTTP/1.…

Follow UDP stream to reconstruct conversation. Args: filepath: Path to PCAP file stream_index: UDP stream index (0-based) format: Output format ("ascii", "hex", "raw") Returns: Reconstructed UDP conversation Example: { "status": "success", "stream_index": 0, "format": "ascii", "data": "DNS query dat…

Enumerate all TCP conversations in capture file. Args: filepath: Path to PCAP file Returns: List of TCP streams with endpoints and statistics Example: { "status": "success", "streams": "TCP Conversations\n192.168.1.1:50234 <-> 93.184.216.34:80 ..." }

Scan target for open ports using nmap. Args: target: IP address, CIDR range, or hostname (e.g., "192.168.1.1", "10.0.0.0/24") ports: Port specification (e.g., "80,443", "1-1000", "22,80,443,3306") scan_type: Scan type ("connect", "syn", "udp"). Note: "syn" and "udp" require root. format: Output form…

Detect service versions on open ports. Args: target: IP address or hostname ports: Port specification (empty = detect on all open ports) Returns: Service version information Example: { "status": "success", "target": "192.168.1.1", "open_ports": [ { "port": "22", "service": "ssh", "product": "OpenSSH…

Detect operating system of target (requires root privileges). Args: target: IP address or hostname Returns: OS detection results Note: This scan requires root/administrator privileges. Example: { "status": "success", "target": "192.168.1.1", "os": { "name": "Linux 3.2 - 4.9", "accuracy": "95" } }

Run NSE vulnerability detection scripts. Args: target: IP address or hostname ports: Port specification Returns: Vulnerability scan results with NSE script output Note: This is a longer-running scan (uses nmap --script vuln). Example: { "status": "success", "target": "192.168.1.1", "open_ports": [ {…

Quick scan of top 100 most common ports. Args: target: IP address or hostname Returns: Quick scan results Example: { "status": "success", "target": "192.168.1.1", "open_ports": [...] }

Comprehensive scan with OS detection, version detection, and default scripts. Args: target: IP address or hostname Returns: Comprehensive scan results Note: This is a long-running operation (may require root for some features). Example: { "status": "success", "target": "192.168.1.1", "open_ports": […

Check IP addresses against threat intelligence databases. Args: ip_or_filepath: Single IP address, comma-separated IPs, or PCAP file path providers: Comma-separated providers ("urlhaus", "abuseipdb") Returns: Threat intelligence results for each IP Example: check_ip_threat_intel("1.2.3.4,5.6.7.8", "…

Comprehensive threat scan of PCAP file. Extracts all IPs and checks against threat intelligence, providing a summary report of malicious traffic. Args: filepath: Path to PCAP file providers: Comma-separated threat intel providers Returns: Threat analysis report Example: { "status": "success", "total…