PacketMaster
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| PM_TIMEOUT | No | Subprocess timeout in seconds (default: 300) | |
| TSHARK_PATH | No | Override tshark binary path (default: auto) | |
| PM_MAX_PACKETS | No | Max packets per extraction request (default: 10000) | |
| PM_ALLOWED_DIRS | No | Optional colon-separated allowlist; when set, paths must stay inside | |
| PM_MAX_FILE_SIZE | No | Max PCAP file size (default: 10GB) | |
| PM_HASH_MAX_BYTES | No | Skip SHA-256 above this size unless requested (default: 500MB) | |
| PM_MAX_STDOUT_BYTES | No | Max subprocess stdout (default: 10MB) | |
| PM_REDACT_SENSITIVE | No | Redact credentials in stream/field output (default: true) | |
| PM_REQUIRE_ALLOWED_DIRS | No | If true, PM_ALLOWED_DIRS must be set or startup validation fails (default: false) |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| logging | {} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| extensions | {
"io.modelcontextprotocol/ui": {}
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| pm_check_installA | Verify tshark/capinfos installation and configuration. |
| pm_file_infoB | Return capinfos metadata and optional SHA-256 hash for a PCAP file. |
| pm_protocol_hierarchyC | Protocol distribution tree from tshark -z io,phs. |
| pm_conversationsC | Top conversations by bytes (ip, tcp, or udp). |
| pm_endpointsC | Top IP endpoints by traffic volume. |
| pm_expert_infoC | Wireshark expert information (errors, warnings, notes, chats). |
| pm_tcp_anomaliesC | Count and sample TCP anomalies: retrans, dup ACK, zero window, OOO, RST. |
| pm_latency_summaryC | Per-flow RTT statistics from tcp.analysis.ack_rtt. |
| pm_io_statsC | Traffic volume over time intervals. |
| pm_extract_fieldsC | Extract specific tshark fields with pagination. |
| pm_follow_streamC | Follow a TCP/UDP/HTTP/TLS stream (truncated, redacted by default). |
| pm_filter_packetsC | Return packet summaries matching a display filter. |
| pm_troubleshoot_quick_scanC | Composite triage: file info, expert, top conversations, TCP anomalies, protocol hierarchy. |
| pm_troubleshoot_flowC | Deep dive on traffic between two IP addresses (optional port). |
| pm_detect_capture_typeC | Detect wlan vs ethernet capture and recommend entry-point tool. |
| pm_wired_quick_scanC | Wired/EPC triage: DHCP, DNS, ICMP, L2 infra, VLAN, TCP anomalies, asymmetric hints. |
| pm_dhcp_analysisC | DHCP transaction analysis with stuck-pattern detection (optional STA MAC). |
| pm_dns_analysisC | DNS query/response analysis, top names, and failure samples (optional client IP). |
| pm_asymmetric_hintsC | Detect one-sided capture symptoms: SYN without ACK, lost segments, ICMP-in-tunnel. |
| pm_wifi_quick_scanB | 802.11 monitor-mode triage: retries, mgmt frames, security, roaming, top BSSIDs. |
| pm_wifi_client_analysisC | Deep dive on one Wi-Fi client STA by MAC (wlan.addr, bidirectional). |
| pm_wifi_roaming_analysisC | 802.11k/v roaming timeline: reassoc, neighbor reports, BSS transition, deauth. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 22 tools
All tools have clearly distinct purposes, targeting different network analysis aspects (WiFi vs wired, general vs specific protocols). The quick scan tools are differentiated by domain context, and pm_detect_capture_type helps select the appropriate entry point.
All tools follow the 'pm_' prefix with snake_case naming. They use a consistent pattern of pm_[domain]_[action] (e.g., pm_dhcp_analysis, pm_conversations) with occasional verb_noun (pm_extract_fields) but overall very consistent.
22 tools is slightly above the typical ideal range but justified by the breadth of packet analysis (WiFi, wired, diagnostic, protocol-specific). Each tool serves a distinct need without overwhelming the user.
The tool set covers essential packet analysis operations: file info, protocol hierarchy, conversations, endpoints, filtering, stream following, anomaly detection, and specialized scans. Minor gaps like HTTP-specific analysis or packet export are missing, but core workflows are well-supported.