List available network interfaces for capture.

Capture live network traffic. capture_filter: BPF syntax. ring_buffer: "filesize:1024,files:5".

Filter packets from a pcap and save to a new file using a Wireshark display filter.

[PHS] Protocol hierarchy statistics showing distribution of protocols in the capture.

[Endpoints] List all endpoints and traffic stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.

[Conversations] Communication pairs and stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.

[I/O Graph] Traffic volume over time. interval: bucket size in seconds. filters: optional semicolon-separated display filters to break the traffic out by type, e.g. 'tcp;udp;dns'.

[Expert Info] Automatic anomaly detection: retransmissions, errors, warnings, protocol issues.

[SRT] Service response time statistics. protocol: 'http'|'dns'|'smb' etc.

[Summary] Packet list (top pane). TSV: No/Time/Src/Dst/Proto/Len/Info. custom_columns: comma-separated fields.

[Detail] Full JSON for one packet. layers: comma-separated protocol filter (e.g. "ip,tcp,http").

[Bytes] Raw hex/ASCII dump of a single packet.

[Context] Packets surrounding a specific frame (count before and after).

[DEPRECATED] JSON packet data. Use get_packet_list + get_packet_details instead.

[Tabular] Extract fields as TSV. fields: comma-separated (e.g. "ip.src,tcp.port,http.host").

[Search] Find packets by content.

[Stream] Reassemble stream with pagination. protocol: tcp|udp|tls|http|http2. output_mode: ascii|hex|raw.

Get capture file metadata (type, packet count, duration, size) via capinfos.

Merge multiple capture files into one. input_files: comma-separated paths.

[Agent] One-call traffic overview: file info, protocols, top talkers, conversations, hostnames, anomalies.

Get Wireshark suite capabilities for this MCP server instance (available tools and versions).

Trim capture to a timestamp window. Times in editcap format.

Split capture into multiple files by packet count or time interval.

Shift packet timestamps by a relative number of seconds.

Remove duplicate packets using editcap's duplicate window matching.

Convert ASCII or hex dump into a capture file using text2pcap. encapsulation: link-layer type (default: ether).

[Dissection] Decode-as for non-standard ports. Rules: 'tcp.port==8080,http;udp.port==5353,dns'.

[Dissection] Protocol preference overrides. Prefs: 'tcp.desegment_tcp_streams:TRUE;http.ssl.port:8443'.

[Decrypt] Decrypt TLS traffic using SSLKEYLOGFILE, show HTTP data.

[Decrypt] Decrypt WPA/WPA2 traffic with passphrase (+SSID).

[File] Extract specific frame ranges to a new pcap. Ranges: '1-10 15 20-30'.

[Stats] Flow/sequence graph showing packet exchange. Types: 'any', 'tcp', 'icmp'.

[Protocol] Analyze one protocol with the right fields and display filter already chosen.

Returns a summary plus matching rows, or "no traffic found". limit caps rows; rtp and smb return fixed-size tables and ignore it.

[TCP] Analyze TCP connection health (retransmissions, dup ACKs, zero window, resets).

[ARP] Detect potential ARP spoofing (duplicate IP-MAC, gratuitous floods, reply storms).

[Anomaly] Detect periodic communication patterns (C2 beacons) by analyzing connection timing intervals and jitter.

[Security] Detect DNS tunneling (long queries, TXT abuse, subdomain entropy).

[Security] Detect DoS/DDoS patterns (SYN flood, ICMP/UDP flood, DNS amplification).

[Anomaly] Detect data exfiltration (large outbound transfers, DNS length anomalies, non-standard ports).

[Security] Detect port scanning (SYN, FIN, NULL, Xmas scans). threshold: min unique dst ports to flag.

[Anomaly] Detect protocol anomalies (known protocols on non-standard ports, unusual protocol distributions).

[Export] Extract embedded files from traffic. protocol: 'http'|'smb'|'tftp'|'imf'|'dicom'.

[Security] Scan for plaintext credentials (HTTP Basic Auth, FTP passwords, Telnet).

[DNS] Extract DNS query details (name, type, response flag) as TSV.

[Forensics] Extract JA3 (client) and JA3S (server) TLS fingerprints.

Matches against ~/.wireshark-mcp/fingerprints/*.json if you maintain any; no fingerprint list ships with this package. A JA3 identifies a TLS configuration, not an application, so treat any match as a lead to corroborate.

[HTTP] Extract HTTP request details (method, URI, host, user-agent) as TSV.

[Enrichment] GeoIP lookup for unique IPs — country, city, ASN. Needs GeoLite2 DB.

[Forensics] Count packets containing a file magic number (PE, ELF, PDF, Office, archives, images).

An indicator, not an extraction — use wireshark_export_objects to get file bytes. A hit may be a coincidental byte sequence.

[TLS] Verify TLS decryption with SSLKEYLOGFILE-format keylog file.

[Security] YARA scan exported files. Detects malware, webshells, shellcode. protocol: http|smb|tftp.

[Entry Point] Open a pcap and get protocol-aware tool recommendations. Returns protocols and relevant tools.