wireshark_capture
Capture live network traffic to a PCAP file for analysis, with configurable duration, packet limits, and BPF filters.
Instructions
Capture live network traffic.
Args: interface: Interface index or name (from list_interfaces) output_file: Absolute path for output .pcap file duration_seconds: Capture duration (0 = unlimited) packet_count: Stop after N packets (0 = unlimited) capture_filter: BPF filter (e.g. "host 192.168.1.1 and port 80") ring_buffer: Ring buffer config (e.g. "filesize:1024,files:5")
Returns: Success message with file path or error JSON
Errors: ExecutionError: Capture failed
Example: wireshark_capture("eth0", "/tmp/capture.pcap", duration_seconds=30, capture_filter="port 80")
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| interface | Yes | ||
| output_file | Yes | ||
| duration_seconds | No | ||
| packet_count | No | ||
| capture_filter | No | ||
| ring_buffer | No |