analyze_pcap_file

Analyze local pcap/pcapng files with customizable filters, output formats, and custom fields, using Wireshark/tshark integration for network security and troubleshooting.

Instructions

Analyze a local pcap/pcapng file. LLMs control all analysis parameters including filters, output formats, and custom fields. Can use saved configurations.

Input Schema

Name	Required	Description	Default
`configName`	No	Name of saved configuration to use for analysis parameters
`customFields`	No	Custom tshark field list (only used with outputFormat=fields)
`displayFilter`	No	Wireshark display filter for analysis (e.g., "tls.handshake.type == 1")
`filePath`	Yes	Path to the local .pcap or .pcapng file to analyze.
`outputFormat`	No	Output format: json (-T json), fields (custom -e), or text (default wireshark output)	text
`sslKeylogFile`	No	ABSOLUTE path to SSL keylog file for TLS decryption

Input Schema (JSON Schema)

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "additionalProperties": false,
  "properties": {
    "configName": {
      "description": "Name of saved configuration to use for analysis parameters",
      "type": "string"
    },
    "customFields": {
      "description": "Custom tshark field list (only used with outputFormat=fields)",
      "type": "string"
    },
    "displayFilter": {
      "description": "Wireshark display filter for analysis (e.g., \"tls.handshake.type == 1\")",
      "type": "string"
    },
    "filePath": {
      "description": "Path to the local .pcap or .pcapng file to analyze.",
      "type": "string"
    },
    "outputFormat": {
      "default": "text",
      "description": "Output format: json (-T json), fields (custom -e), or text (default wireshark output)",
      "enum": [
        "json",
        "fields",
        "text"
      ],
      "type": "string"
    },
    "sslKeylogFile": {
      "description": "ABSOLUTE path to SSL keylog file for TLS decryption",
      "type": "string"
    }
  },
  "required": [
    "filePath"
  ],
  "type": "object"
}

SharkMCP

analyze_pcap_file

Instructions

Input Schema

Input Schema (JSON Schema)

Other Tools from SharkMCP

Related Tools

MCP directory API