wireshark_read_packets
Read packet data from PCAP files in structured JSON format for network traffic analysis, supporting filters and pagination.
Instructions
[DEPRECATED] Read packet data in structured JSON format.
WARNING: This tool can return very large, complex JSON.
Prefer wireshark_get_packet_list and wireshark_get_packet_details for efficient analysis.
Args: pcap_file: Path to capture file limit: Maximum packets to return (default: 100) offset: Skip first N packets (pagination) display_filter: Wireshark display filter (e.g. "tcp.port == 80")
Returns: JSON array of packets with full layer details on success JSON error object on failure: {"success": false, "error": {...}}
Errors: FileNotFound: pcap_file does not exist ExecutionError: tshark JSON parsing failed
Example: wireshark_read_packets("traffic.pcap", limit=10, display_filter="http")
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| pcap_file | Yes | ||
| limit | No | ||
| offset | No | ||
| display_filter | No |