mcpcap
A modular Python MCP (Model Context Protocol) Server for analyzing PCAP files. mcpcap enables LLMs to read and analyze network packet captures with protocol-specific analysis tools that accept local file paths or remote URLs as parameters (no file uploads - provide the path or URL to your PCAP file).
Overview
mcpcap uses a modular architecture to analyze different network protocols found in PCAP files. Each module provides specialized analysis tools that can be called independently with any PCAP file, making it perfect for integration with Claude Desktop and other MCP clients.
Key Features
Stateless MCP Tools: Each analysis accepts PCAP file paths or URLs as parameters (no file uploads)
Modular Architecture: DNS, DHCP, ICMP, and CapInfos modules with easy extensibility for new protocols
Local & Remote PCAP Support: Analyze files from local storage or HTTP URLs
Scapy Integration: Leverages scapy's comprehensive packet parsing capabilities
Specialized Analysis Prompts: Security, networking, and forensic analysis guidance
JSON Responses: Structured data format optimized for LLM consumption
Installation
mcpcap requires Python 3.10 or greater.
Using pip
Using uv
Using uvx (for one-time usage)
Quick Start
1. Start the MCP Server
Start mcpcap as a stateless MCP server:
2. Connect Your MCP Client
Configure your MCP client (like Claude Desktop) to connect to the mcpcap server:
3. Analyze PCAP Files
Use the analysis tools with any PCAP file by providing the file path or URL (not file uploads):
DNS Analysis:
DHCP Analysis:
ICMP Analysis:
CapInfos Analysis:
Available Tools
DNS Analysis Tools
analyze_dns_packets(pcap_file)
: Complete DNS traffic analysisExtract DNS queries and responses
Identify queried domains and subdomains
Analyze query types (A, AAAA, MX, CNAME, etc.)
Track query frequency and patterns
Detect potential security issues
DHCP Analysis Tools
analyze_dhcp_packets(pcap_file)
: Complete DHCP traffic analysisTrack DHCP transactions (DISCOVER, OFFER, REQUEST, ACK)
Identify DHCP clients and servers
Monitor IP address assignments and lease information
Analyze DHCP options and configurations
Detect DHCP anomalies and security issues
ICMP Analysis Tools
analyze_icmp_packets(pcap_file)
: Complete ICMP traffic analysisAnalyze ping requests and replies with response times
Identify network connectivity and reachability issues
Track TTL values and routing paths (traceroute data)
Detect ICMP error messages (unreachable, time exceeded)
Monitor for potential ICMP-based attacks or reconnaissance
CapInfos Analysis Tools
analyze_capinfos(pcap_file)
: PCAP file metadata and statisticsFile information (size, name, link layer encapsulation)
Packet statistics (count, data size, average packet size)
Temporal analysis (duration, timestamps, packet rates)
Data throughput metrics (bytes/second, bits/second)
Similar to Wireshark's capinfos(1) utility
Analysis Prompts
mcpcap provides specialized analysis prompts to guide LLM analysis:
DNS Prompts
security_analysis
- Focus on threat detection, DGA domains, DNS tunnelingnetwork_troubleshooting
- Identify DNS performance and configuration issuesforensic_investigation
- Timeline reconstruction and evidence collection
DHCP Prompts
dhcp_network_analysis
- Network administration and IP managementdhcp_security_analysis
- Security threats and rogue DHCP detectiondhcp_forensic_investigation
- Forensic analysis of DHCP transactions
ICMP Prompts
icmp_network_diagnostics
- Network connectivity and path analysisicmp_security_analysis
- ICMP-based attacks and reconnaissance detectionicmp_forensic_investigation
- Timeline reconstruction and network mapping
Configuration Options
Module Selection
Analysis Limits
Complete Configuration Example
CLI Reference
Options:
--modules MODULES
: Comma-separated modules to load (default:dns,dhcp,icmp,capinfos
)Available modules:
dns
,dhcp
,icmp
,capinfos
--max-packets N
: Maximum packets to analyze per file (default: unlimited)
Examples:
Examples
Example PCAP files are included in the examples/
directory:
dns.pcap
- DNS traffic for testing DNS analysisdhcp.pcap
- DHCP 4-way handshake captureicmp.pcap
- ICMP ping and traceroute traffic
Using with MCP Inspector
Then test the tools:
Architecture
mcpcap's modular design supports easy extension:
Core Components
BaseModule: Shared file handling, validation, and remote download
Protocol Modules: DNS, DHCP, and ICMP analysis implementations
MCP Interface: Tool registration and prompt management
FastMCP Framework: MCP server implementation
Tool Flow
Adding New Modules
Create new protocol modules by:
Inheriting from
BaseModule
Implementing
_analyze_protocol_file(pcap_file)
Registering analysis tools with the MCP server
Adding specialized analysis prompts
Future modules might include:
HTTP/HTTPS traffic analysis
TCP connection tracking
BGP routing analysis
SSL/TLS certificate analysis
Network forensics tools
Remote File Support
Both analysis tools accept remote PCAP files via HTTP/HTTPS URLs:
Features:
Automatic temporary download and cleanup
Support for
.pcap
,.pcapng
, and.cap
filesHTTP/HTTPS protocols supported
Security Considerations
When analyzing PCAP files:
Files may contain sensitive network information
Remote downloads are performed over HTTPS when possible
Temporary files are cleaned up automatically
Consider the source and trustworthiness of remote files
Contributing
Contributions welcome! Areas for contribution:
New Protocol Modules: Add support for HTTP, BGP, TCP, etc.
Enhanced Analysis: Improve existing DNS/DHCP analysis
Security Features: Add more threat detection capabilities
Performance: Optimize analysis for large PCAP files
License
MIT
Requirements
Python 3.10+
scapy (packet parsing and analysis)
requests (remote file access)
fastmcp (MCP server framework)
Documentation
GitHub: github.com/mcpcap/mcpcap
Documentation: docs.mcpcap.ai
Website: mcpcap.ai
Support
For questions, issues, or feature requests, please open an issue on GitHub.
Enables LLMs to analyze network packet captures (PCAP files) from local or remote sources through a modular architecture. Supports DNS traffic analysis with structured JSON responses for network security and troubleshooting tasks.