Wireshark MCP

The Wireshark MCP server provides comprehensive network packet analysis capabilities by integrating Wireshark/tshark tools, enabling AI assistants to analyze pcap files, capture live traffic, and perform security analysis.

Packet Analysis: View packet summaries and detailed JSON information, extract raw hex/ASCII dumps, view packets in context, reassemble and follow complete TCP/UDP/TLS/HTTP streams with pagination, and search for patterns using string, hex, or regex matching.

Data Extraction: Extract specific protocol fields as tabular data with custom filtering, retrieve HTTP requests and DNS queries, list unique IP addresses, export embedded files from HTTP/SMB/TFTP traffic, and verify TLS decryption using keylog files.

Statistics & Reporting: Generate protocol hierarchy statistics, endpoint and conversation analysis, I/O graphs for traffic volume over time, expert information for anomaly detection (retransmissions, errors, warnings), and service response time metrics for HTTP, DNS, SMB and other protocols.

File Operations & Live Capture: Get detailed metadata for pcap files, merge multiple capture files, filter and save packets, list available network interfaces, and capture live traffic with duration, packet count, BPF filters, and ring buffer support.

Security Analysis: Check captured IP addresses against URLhaus threat intelligence feeds and scan for plaintext credentials in HTTP Basic Auth, FTP, and Telnet traffic.

Utilities: Decode common encodings (Base64, Hex, URL, Gzip, Deflate, Rot13) with auto-detection and generate ASCII charts for traffic volume and protocol hierarchy trees.

Supported Protocols: Network layer (Ethernet, IP, IPv6, TCP, UDP, SCTP, WLAN) and application layer (HTTP, HTTP/2, DNS, TLS/SSL, SMB, FTP, Telnet, TFTP, DICOM).

Provides tools for analyzing network traffic and pcap files, including packet summarization, deep packet dissection, stream reassembly, and automated extraction of HTTP requests, DNS queries, and credentials.

1. Click on "Install Server".

2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.

3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Wireshark MCP analyze capture.pcap and check for any plaintext credentials"

That's it! The server will respond to your query, and you can continue using it as needed.

Here is a step-by-step guide with screenshots.