o
��UhbN � @ s d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
mZmZmZmZ zddlmZ W n eyQ ed� ed� Y nw ejejd d
� e�e�ZG d d � d �Z G d
d� d�Z G dd� d�Z dd� Z edkr�e � dS dS )z�
Wireshark MCP Server
A Model Context Protocol server that provides AI assistants with access to
Wireshark network analysis capabilities for network troubleshooting and analysis.
Author: AI Assistant
Date: 2025-06-20
� N)�ThreadPoolExecutor)�Path)�Dict�Any�List�Optional�Union)�FastMCPz8FastMCP not installed. Install with: pip install fastmcp� z4%(asctime)s - %(name)s - %(levelname)s - %(message)s)�level�formatc @ sj e Zd ZdZg d�ZdZdZdZede de
fdd ��Z ed
e de
fd d ��Z ed
e de
e fdd��ZdS )�SecurityValidatorz>Security validation utilities for network analysis operations.)z6^(eth|wlan|lo|en|enp|wlp|docker|br-)[a-zA-Z0-9]{1,15}$z^Ethernet \d+$z ^Wi-Fi \d*$z^Local Area Connection \d*$z^\d+$i, i' i @� interface�returnc s, � rt � �dkr
dS t� fdd�tjD ��S )z9Validate network interface name against allowed patterns.�2 Fc 3 s � | ] }t �|� �V qd S �N)�re�match��.0�pattern�r � �wireshark-mcp-server.py� <genexpr>; s
�
�
�z7SecurityValidator.validate_interface.<locals>.<genexpr>)�len�anyr
�INTERFACE_PATTERNSr r r r �validate_interface5 s
�z$SecurityValidator.validate_interface� filter_exprc s6 � sdS g d�}t � fdd�|D ��rdS t� �dk S )z'Validate BPF capture filter expression.T)�;�|�&z$(�`�
�
z..c 3 s � | ]}|� v V qd S r r r �r r r r H s � z<SecurityValidator.validate_capture_filter.<locals>.<genexpr>Fi� )r r )r �dangerous_patternsr r& r �validate_capture_filter@ s z)SecurityValidator.validate_capture_filter�filepathc C sd z't | ��� }|�� sW dS |j�� dvrW dS |�� jtjkr#W dS t |�W S t
y1 Y dS w )z!Sanitize and validate file paths.N)z.pcapz.pcapng) r �resolve�exists�suffix�lower�stat�st_sizer
�
MAX_FILE_SIZE�str� Exception)r) �
resolved_pathr r r �sanitize_filepathN s
�z#SecurityValidator.sanitize_filepathN)�__name__�
__module__� __qualname__�__doc__r �MAX_CAPTURE_DURATION�MAX_PACKET_COUNTr0 � staticmethodr1 �boolr r( r r4 r r r r r
$ s
r
c
@ s� e Zd ZdZdd� Zdee fdd�Zdee fdd�Zdee fd d
�Z de
ee f fd d �Z
d dede
dede
de
ee f f
dd�Z d!dedede
de
ee f fdd�Zdede
ee f fdd �Zdede
ee f fd d �Zd S )"�WiresharkInterfacez8Interface to Wireshark CLI tools with security controls.c C s0 | � � | _| �� | _| �� | _| jstd��d S )Nz+TShark not found. Please install Wireshark.)� _find_tshark� tshark_path�
_find_dumpcap� dumpcap_path�_find_capinfos�
capinfos_path� RuntimeError��selfr r r �__init__g s
�zWiresharkInterface.__init__r c
C �Z g d�}|D ]$}zt j|dgddd�}|jdkr |W S W q t jtfy* Y qw dS )zFind TShark executable.)�tsharkz
tshark.exez%C:\Program Files\Wireshark\tshark.exez/usr/bin/tsharkz/usr/local/bin/tshark� --versionT� ��capture_output�timeoutr N��
subprocess�run�
returncode�TimeoutExpired�FileNotFoundError�rF � common_paths�path�resultr r r r> o �
�
��z WiresharkInterface._find_tsharkc
C rH )zFind dumpcap executable.)�dumpcapz dumpcap.exez&C:\Program Files\Wireshark\dumpcap.exez/usr/bin/dumpcapz/usr/local/bin/dumpcaprJ TrK rL r NrO rU r r r r@ � rY z WiresharkInterface._find_dumpcapc
C rH )zFind capinfos executable.)�capinfosz capinfos.exez'C:\Program Files\Wireshark\capinfos.exez/usr/bin/capinfosz/usr/local/bin/capinfosrJ TrK rL r NrO rU r r r rB � rY z!WiresharkInterface._find_capinfosc
C s� z7| j r2tj| j dgdddd�}|jdkr2g }|j�� �d�D ] }|r(|�|� q d|t|�d�W S d d
d �W S t yX } zt
� d |� �� d t |�d �W Y d
}~S d
}~ww )z)Get list of available network interfaces.z-DT�
�rM �textrN r r$ �success)�status�
interfaces�count�errorzUnable to list interfaces�r` �messagezError getting interfaces: N)
r? rP rQ rR �stdout�strip�split�appendr r2 �loggerrc r1 )rF rX ra �line�er r r �get_interfaces� s0 �
�� ��z!WiresharkInterface.get_interfaces�d � � r rb r rN c
C s> zo| j d|dt|�ddg}|r|�d|g� tj|dd|d�}|jdkr.d d
|j� �d �W S g }|j�� r_z|j�� � d �D ]}|rLt
� |�} |� | � q>W n t
j
y^ d
|jig}Y nw d|t|�|dd� t|�d�W S tjy~ d dd � Y S ty� }
zt�d|
� �� d t|
�d �W Y d}
~
S d}
~
ww )z4Capture packets from network interface using TShark.z-i�-c�-T�jsonz-fTr] r rc zCapture failed: rd r$ �
raw_outputr_ N� )r` r � packet_count�packets�total_capturedzCapture timeoutzCapture error: )r? r1 �extendrP rQ rR �stderrrf rg rh rs �loadsri �JSONDecodeErrorr rS r2 rj rc ) rF r rb r rN �cmdrX rw rk �packetrl r r r �capture_packets� sN �
�
���
���z"WiresharkInterface.capture_packets�� r) � max_packetsc
C s4 zx| j d|ddg}|r|�d|g� |dkr |�dt|�g� tj|dddd �}|jdkr7d
d |j� �d �W S g }|j�� rhz|j�� � d
�D ]}|rUt
� |�}|� |� qGW n t
j
yg d|jig}Y nw d|t|�|dd� t|�d�W S ty� } zt�d| � �� d
t| �d �W Y d} ~ S d} ~ ww )z Analyze PCAP file using TShark.�-rrr rs z-Yr rq T�< r] rc zAnalysis failed: rd r$ rt r_ Nr\ )r` �filerv rw �total_analyzedzAnalysis error: )r? ry r1 rP rQ rR rz rf rg rh rs r{ ri r| r r2 rj rc )
rF r) r r� r} rX rw rk r~ rl r r r �analyze_pcap_file� sN �
�
���
���z$WiresharkInterface.analyze_pcap_filec
C s� z?| j d|dddg}tj|dddd�}| j d|dddg}tj|dddd�}d ||jd
kr/|jnd |jd
kr;|jd
�W S d d
�W S ty` } zt�d|� �� dt|�d�W Y d}~S d}~ww )z,Generate protocol statistics from PCAP file.r� z-qz-zzio,phsTrp r] zconv,ipr_ r zError generating hierarchyz Error generating conversations)r` r� �protocol_hierarchy�ip_conversationszStatistics error: rc rd N) r? rP rQ rR rf r2 rj rc r1 )rF r) �
cmd_hierarchy�hierarchy_result�cmd_conv� conv_resultrl r r r �get_protocol_statistics. s6 ������z*WiresharkInterface.get_protocol_statisticsc
C s� | j sddd�S z#tj| j |gdddd�}|jdkr"d||jd �W S dd
|j� �d�W S tyD } z
dt|�d�W Y d }~S d }~ww ) z4Get information about a capture file using capinfos.rc zcapinfos not availablerd Tr\ r] r r_ )r` r� �infozcapinfos failed: N)rC rP rQ rR rf rz r2 r1 )rF r) rX rl r r r �
get_file_infoN s*
�
�
���z WiresharkInterface.get_file_infoN)rn ro rp )ro r� )r5 r6 r7 r8 rG r r1 r> r@ rB r r rm �intr r� r� r� r r r r r= d s2 ���
�3 ��
�0 r= c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) �WiresharkMCPServerz7Main MCP server class providing Wireshark capabilities.c C s4 t d�| _t� | _tdd�| _| �� t�d� d S )Nzwireshark-analyzer� )� max_workersz Wireshark MCP Server initialized) r �mcpr= � wiresharkr �executor�register_toolsrj r� rE r r r rG m s
zWiresharkMCPServer.__init__c s� � j jdtttf f� fdd� �}� j j ddtdtd td
tdtttf f
� fd d �
�}� j j
d dtdtdtdtttf f� fdd�
�}� j jdtdtttf f� fdd� �}� j jdtdtttf f� fdd� �}� j �d�dtfdd��}dS ) zRegister all MCP tools.r c s
� j �� S )z<Get list of available network interfaces for packet capture.)r� rm r rE r r �get_network_interfacesw s
zAWiresharkMCPServer.register_tools.<locals>.get_network_interfacesr ro rp r rb �capture_filterrN c
� s� �t �| �s ddd�S t �|�sddd�S t|t j�}t|d�}zt�� }|�� j� j j
| |||�I dH }|W S t yX } zt �
d|� �� dt|�d�W Y d}~S d}~ww )a�
Capture live network packets from a specified interface.
Args:
interface: Network interface name or number (e.g., "eth0", "1")
count: Number of packets to capture (max 1000)
capture_filter: BPF capture filter (e.g., "tcp port 80")
timeout: Capture timeout in seconds (max 60)
rc zInvalid interface namerd zInvalid capture filterr� NzLive capture error: )r
r r( �minr: �asyncio�get_event_loop�run_in_executorr� r� r r2 rj rc r1 )r rb r� rN �looprX rl rE r r �capture_live_packets| s( �
���z?WiresharkMCPServer.register_tools.<locals>.capture_live_packetsrn r) �display_filterr� c
� s� �t �| �}|s
ddd�S t|d�}zt�� }|�� j� jj|||�I dH }|W S t yI } zt
� d|� �� dt |�d�W Y d}~S d}~ww )a'
Analyze an existing PCAP/PCAPNG file.
Args:
filepath: Path to the PCAP/PCAPNG file
display_filter: Wireshark display filter (e.g., "http.request")
max_packets: Maximum number of packets to analyze
rc �!Invalid or inaccessible file pathrd r� NzFile analysis error: )
r
r4 r� r� r� r� r� r� r� r2 rj rc r1 )r) r� r� �sanitized_pathr� rX rl rE r r r� � s$ �
���z<WiresharkMCPServer.register_tools.<locals>.analyze_pcap_filec �$ t �| �}|s ddd�S � j�|�S )z�
Generate protocol hierarchy and conversation statistics from a PCAP file.
Args:
filepath: Path to the PCAP/PCAPNG file
rc r� rd )r
r4 r� r� �r) r� rE r r r� � �
zBWiresharkMCPServer.register_tools.<locals>.get_protocol_statisticsc r� )z�
Get detailed information about a capture file.
Args:
filepath: Path to the PCAP/PCAPNG file
rc r� rd )r
r4 r� r� r� rE r r �get_capture_file_info� r� z@WiresharkMCPServer.register_tools.<locals>.get_capture_file_infoznetwork://helpc S s dS )z9Comprehensive help documentation for Wireshark MCP tools.ay
# Wireshark MCP Server Help
## Available Tools
### get_network_interfaces()
- Lists all available network interfaces for packet capture
- No parameters required
- Returns interface names and numbers
### capture_live_packets(interface, count, capture_filter, timeout)
- Captures live network packets from specified interface
- Parameters:
- interface: Interface name (e.g., "eth0") or number (e.g., "1")
- count: Number of packets to capture (default: 50, max: 1000)
- capture_filter: BPF filter expression (optional)
- timeout: Capture timeout in seconds (default: 30, max: 60)
### analyze_pcap_file(filepath, display_filter, max_packets)
- Analyzes existing PCAP/PCAPNG files
- Parameters:
- filepath: Path to capture file
- display_filter: Wireshark display filter (optional)
- max_packets: Maximum packets to analyze (default: 100, max: 1000)
### get_protocol_statistics(filepath)
- Generates protocol hierarchy and conversation statistics
- Parameters:
- filepath: Path to capture file
### get_capture_file_info(filepath)
- Gets detailed information about capture file
- Parameters:
- filepath: Path to capture file
## Common Filters
### Capture Filters (BPF syntax):
- "tcp port 80" - HTTP traffic
- "host 192.168.1.1" - Traffic to/from specific host
- "net 10.0.0.0/8" - Traffic on specific network
### Display Filters (Wireshark syntax):
- "http.request" - HTTP requests
- "tcp.flags.syn == 1" - TCP SYN packets
- "dns.flags.response == 1" - DNS responses
## Security Notes
- All inputs are validated for security
- File paths are sanitized and checked
- Capture limits are enforced
- Only PCAP/PCAPNG files are accepted
r r r r r �get_help_documentation� s zAWiresharkMCPServer.register_tools.<locals>.get_help_documentationN)r ro rp )ro rn )r� �toolr r1 r r� �resource)rF r� r� r� r� r� r� r rE r r� t sF �����
�&����
�!
z!WiresharkMCPServer.register_toolsc C s t �d� | j�� dS )zRun the MCP server.z Starting Wireshark MCP Server...N)rj r� r� rQ rE r r r rQ s
zWiresharkMCPServer.runN)r5 r6 r7 r8 rG r� rQ r r r r r� j s )r� c
C s\ z
t � } | �� W dS ty t�d� Y dS ty- } z t�d|� �� � d}~ww )zMain entry point.zServer stopped by userzServer error: N)r� rQ �KeyboardInterruptrj r� r2 rc )�serverrl r r r �main! s ��r� �__main__) r8 r� rs �logging�osr rP �time�concurrent.futuresr �pathlibr �typingr r r r r �fastmcpr � ImportError�print�exit� basicConfig�INFO� getLoggerr5 rj r
r= r� r� r r r r �<module> s@
��
@ 8
�
