Get Wireshark runtime information: installed binaries, versions, available features, and allowed file roots.

List available network interfaces for packet capture. Returns interface names, display names, and addresses.

Get detailed capabilities of a specific network interface, including supported link types and timestamp types.

Validate a Wireshark display filter expression. Returns whether the filter syntax is valid. Does not require an active analysis session.

Validate a BPF capture filter expression for a specific interface. The interface is required because filter compilation depends on the link type.

Auto-complete display filter field names. Requires an active analysis session (sharkd command).

List available protocol fields, optionally filtered by prefix. Supports pagination. Uses tshark -G fields (no session required).

Get detailed information about a specific protocol field by its abbreviation (e.g., 'ip.src', 'tcp.port'). Use the 'id' value from field_list results. Requires an active analysis session.

Start live packet capture on a network interface. Requires root or cap_net_raw capability. Returns a session ID for tracking.

Stop a running packet capture. Idempotent - safe to call multiple times.

Get the current status of a capture session, including packet counts and file information.

List all capture sessions, optionally filtered by status.

List files produced by a capture session. In ring buffer mode, multiple files may exist.

Read the capture session log (dumpcap stderr output).

Open a capture file for analysis using sharkd. Either provide file_path directly or capture_session_id to select from capture output. Returns session ID and file summary.

Close an analysis session and release resources.

Get the current status of an analysis session including frame count and duration.

Get a comprehensive summary of the loaded capture file including frame count, duration, protocols, and time range.

List all analysis sessions, optionally filtered by status (ready, closed, failed).

Get the capability catalog of an analysis session: available taps, follow protocols, statistics, columns, and encapsulation types. Use this to discover what analysis operations are available.

List frame summaries with optional display filter and pagination. Returns frame numbers, column values, and metadata flags.

Get the complete protocol dissection tree for a single frame. Returns protocol layers, field values, and optionally raw bytes.

Execute a sharkd tap for statistical analysis. Returns table, tree, or graph results depending on the tap type. Use analysis_catalog to discover available taps. Friendly selector shorthands such as 'conv,tcp' are accepted.

Reassemble and follow a protocol stream (TCP, UDP, TLS, HTTP, etc.). Use analysis_get_frame's follow_filters to get the protocol and filter values.

Generate I/O graph time-series data. Specify up to 10 graph definitions with metrics and optional filters.

Get frame count and byte statistics per time interval. Useful for traffic pattern analysis.

List TCP conversations without requiring manual sharkd tap syntax.

List TLS Server Name Indication values grouped by hostname.

List HTTP hosts grouped by request host with example methods and URIs.

Download an exported object, RTP stream audio, or TLS key log from sharkd. Tokens come from analysis_get_statistics (export_objects, rtp_streams) or fixed tokens like 'ssl-secrets'.

Get capture file metadata including packet count, duration, file type, and optionally file hashes.

Identify the format of a capture file (pcap, pcapng, etc.).

Merge two or more capture files into one. 'merge' interleaves by timestamp, 'concat' appends sequentially.

Extract packets from a capture file by packet number ranges or time window.

Remove duplicate packets from a capture file.

Adjust packet timestamps in a capture file.

Filter packets by display filter and write matching frames to a new capture file. Unlike file_slice (packet ranges), this filters by protocol content.

Export packet data in structured format (fields, json, or ek). For writing filtered pcap files, use file_write_filtered_capture instead.