Report detected Wireshark binaries and versions.

Return registry counts that summarize local Wireshark dissection support.

List live capture interfaces.

List link-layer types supported by an interface.

List managed live or previous capture sessions and artifact summaries.

Capture a short bounded sample to a pcapng artifact.

Start a bounded live capture. Long captures use ring-buffer rotation by default.

Return process and artifact status for a running or previous capture.

Persist and return metadata for a capture without stopping it.

Stop a managed capture.

Delete or mark a managed capture session after optionally stopping it.

Start a long ring-buffer capture using configured file count and size limits.

Summarize the newest pcapng file in a managed capture directory.

Return capinfos metadata for a capture file.

Return capture file type.

Verify that tshark can read at least one packet from a capture.

Return LLM-sized packet list rows.

Return bounded tshark JSON packet output.

Extract selected tshark display fields.

Apply a display filter and return matching summaries.

Return packet summaries for a frame range.

Return packet hexdumps for bounded packets.

Validate a display filter against a capture.

Return protocol hierarchy statistics.

Return conversation statistics for a protocol.

Return endpoint statistics for a protocol.

Return IO statistics.

Return Wireshark expert information.

Return HTTP request/response fields.

Return DNS query/response fields.

Return TLS handshake and SNI-oriented fields.

Return notable TCP stream fields.

Search the local Wireshark protocol registry.

Search the local Wireshark display field registry.

Return registry lines matching a field abbreviation.

Search current Wireshark preferences.

Search dissector tables.

List tshark statistics taps.

List capture output formats for a Wireshark utility.

Analyze a capture with a tshark decode-as rule.

Analyze with selected protocols enabled or disabled.

Analyze with selected heuristic dissectors enabled or disabled.

Analyze with a Wireshark configuration profile.

Trim a capture by time or packet range.

Remove duplicate packets with editcap.

Merge multiple capture files.

Reorder a capture by timestamp.

Convert capture file format.

Generate a capture from a text hex dump.

Generate a local random or malformed packet capture with randpkt.

Run rawshark over raw pcap records with explicit encapsulation and fields.

Open a capture in a local console-mode sharkd session.

List managed sharkd sessions.

Send a bounded generic JSON-RPC request to a managed sharkd session.

Get sharkd status for a loaded capture.

Return sharkd packet-list frames for a bounded range or display filter.

Return sharkd details for one frame, optionally with protocol tree and bytes.

Follow a stream in sharkd using a protocol name and display filter.

Close a managed sharkd session.

Return a compact capture brief with metadata, top protocols, talkers, and notable packets.

Return ranked source-to-destination talkers from a bounded packet sample.

Return notable protocol findings such as resets, retransmissions, failures, and alerts.

Return a protocol-count timeline using bounded packet summaries.

Return candidate IPs, domains, HTTP hosts, URIs, user agents, and TLS SNI values.

Rank TCP streams worth following based on packet counts and examples.

Return DNS query, answer, and response-code summary for LLM triage.

Return HTTP host, method, status, error, and slow-response summary.

Return TLS SNI, handshake type, and alert summary.

Return TCP stream health markers such as retransmissions, resets, and zero-window events.

Run a compact investigation recipe set and return next-tool hints.

Inventory observed protocols, expert rows, suggested filters, and next tools.

Summarize one protocol using curated fields or Wireshark registry discovery.

Run inventory and bounded summaries for the top observed protocols.

Return curated protocol analysis profiles and fallback behavior.

Open a capture in the Wireshark GUI.

Expert escape hatch for allowlisted Wireshark binaries only.