analyze_pcap_file
Analyze local PCAP/PCAPNG files with configurable filters, output formats, and custom fields using Wireshark/tshark integration for network security insights.
Instructions
Analyze a local pcap/pcapng file. LLMs control all analysis parameters including filters, output formats, and custom fields. Can use saved configurations.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| configName | No | Name of saved configuration to use for analysis parameters | |
| customFields | No | Custom tshark field list (only used with outputFormat=fields) | |
| displayFilter | No | Wireshark display filter for analysis (e.g., "tls.handshake.type == 1") | |
| filePath | Yes | Path to the local .pcap or .pcapng file to analyze. | |
| outputFormat | No | Output format: json (-T json), fields (custom -e), or text (default wireshark output) | text |
| sslKeylogFile | No | ABSOLUTE path to SSL keylog file for TLS decryption |
Implementation Reference
- src/tools/analyze-pcap-file.ts:21-78 (handler)The main handler function that executes the tool logic for analyzing PCAP files. It handles input args, loads saved configurations if specified, verifies file access, calls the analyzePcap utility for core analysis, trims output, and returns formatted results or errors.export async function analyzePcapFileHandler(args: any) { try { let { filePath, displayFilter, outputFormat, customFields, sslKeylogFile, configName } = args; // If configName is provided, load and use that configuration for analysis if (configName) { const savedConfig = await loadFilterConfig(configName); if (!savedConfig) { return { content: [{ type: 'text' as const, text: `Error: Configuration '${configName}' not found. Use manage_config with action 'list' to see available configurations.`, }], isError: true }; } // Override analysis parameters with saved config (saved config takes precedence) if (savedConfig.displayFilter) displayFilter = savedConfig.displayFilter; if (savedConfig.outputFormat) outputFormat = savedConfig.outputFormat; if (savedConfig.customFields) customFields = savedConfig.customFields; console.error(`Using saved configuration '${configName}' for analysis: ${JSON.stringify(savedConfig)}`); } // Verify file exists before proceeding await fs.access(filePath); // Analyze the file using the reusable function const output = await analyzePcap( filePath, displayFilter, outputFormat, customFields, sslKeylogFile ); const keylogToUse = sslKeylogFile || process.env.SSLKEYLOGFILE; // Trim output if too large const trimmedOutput = trimOutput(output, outputFormat); const configInfo = configName ? `\nUsing saved config: ${configName}` : ''; return { content: [{ type: 'text' as const, text: `Analysis of '${filePath}' complete!${configInfo}\nDisplay Filter: ${displayFilter || 'none'}\nOutput Format: ${outputFormat}\nSSL Decryption: ${keylogToUse ? 'Enabled' : 'Disabled'}\n\nPacket Analysis Results:\n${trimmedOutput}`, }], }; } catch (error: any) { console.error(`Error analyzing PCAP file: ${error.message}`); return { content: [{ type: 'text' as const, text: `Error: ${error.message}` }], isError: true }; } }
- src/tools/analyze-pcap-file.ts:8-15 (schema)The input schema defining parameters for the analyze_pcap_file tool, including file path, filters, output options, SSL keys, and config name.export const analyzePcapFileSchema = { filePath: z.string().describe('Path to the local .pcap or .pcapng file to analyze.'), displayFilter: z.string().optional().describe('Wireshark display filter for analysis (e.g., "tls.handshake.type == 1")'), outputFormat: z.enum(['json', 'fields', 'text']).optional().default('text').describe('Output format: json (-T json), fields (custom -e), or text (default wireshark output)'), customFields: z.string().optional().describe('Custom tshark field list (only used with outputFormat=fields)'), sslKeylogFile: z.string().optional().describe('ABSOLUTE path to SSL keylog file for TLS decryption'), configName: z.string().optional().describe('Name of saved configuration to use for analysis parameters') };
- src/index.ts:40-45 (registration)Registers the analyze_pcap_file tool with the MCP server using server.tool(), specifying the tool name, description, input schema, and handler function.server.tool( 'analyze_pcap_file', 'Analyze a local pcap/pcapng file. LLMs control all analysis parameters including filters, output formats, and custom fields. Can use saved configurations.', analyzePcapFileSchema, async (args) => analyzePcapFileHandler(args) );