Get Wireshark suite capabilities for this MCP server instance (available tools and versions).

Get capture file metadata (type, packet count, duration, size) via capinfos.

Merge multiple capture files into one. input_files: comma-separated paths.

Convert ASCII or hex dump into a capture file using text2pcap. encapsulation: link-layer type (default: ether).

List available network interfaces for capture.

Capture live network traffic. capture_filter: BPF syntax. ring_buffer: "filesize:1024,files:5".

Filter packets from a pcap and save to a new file using a Wireshark display filter.

Trim capture to a timestamp window. Times in editcap format.

Split a capture into smaller files by packet count or interval.

Adjust all packet timestamps by a positive or negative offset in seconds.

Remove duplicate packets within a sliding window (default: 5 packets).

[Primary statistics] Full-filter counts, groups, distinct values, numeric metrics, top-k, and time buckets. Field lists are comma-separated.

[PHS] Protocol hierarchy statistics showing distribution of protocols in the capture.

[Endpoints] List all endpoints and traffic stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.

[Conversations] Communication pairs and stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.

[I/O Graph] Traffic volume by time bucket, optionally split by semicolon-separated display filters.

[Expert Info] Automatic anomaly detection: retransmissions, errors, warnings, protocol issues.

[SRT] Service response time statistics. protocol: 'http'|'dns'|'smb' etc.

[Index] Build once; aggregate/extract_fields reuse it. more_files: extra captures (capture_id). query: SELECT on packets/pkt/flows/captures. timeline: first/last seen. diff: vs more_files/compare_filter. export: Parquet.

[Summary] Packet list (top pane). TSV: No/Time/Src/Dst/Proto/Len/Info. custom_columns: comma-separated fields.

[Detail] Full JSON for one packet. layers: comma-separated protocol filter (e.g. "ip,tcp,http").

[Bytes] Raw hex/ASCII dump of a single packet.

[Context] Packets surrounding a specific frame (count before and after).

[DEPRECATED] JSON packet data. Use get_packet_list + get_packet_details instead.

[Tabular] Extract fields as TSV. fields: comma-separated; limit/offset count lines including the header.

[Search] Find packets by content.

[Stream] Reassemble stream with pagination. protocol: tcp|udp|tls|http|http2. output_mode: ascii|hex|raw.

[Agent] One-call traffic overview: file info, protocols, top talkers, conversations, hostnames, anomalies.

[Dissection] Decode-as for non-standard ports. Rules: 'tcp.port==8080,http;udp.port==5353,dns'.

[Dissection] Protocol preference overrides. Prefs: 'tcp.desegment_tcp_streams:TRUE;http.ssl.port:8443'.

[Decrypt] Decrypt TLS traffic using SSLKEYLOGFILE, show HTTP data.

[Decrypt] Decrypt WPA/WPA2 traffic with passphrase (+SSID).

[File] Extract specific frame ranges to a new pcap. Ranges: '1-10 15 20-30'.

[Stats] Flow/sequence graph showing packet exchange. Types: 'any', 'tcp', 'icmp'.

[Case] Saved investigation. create(text=title,target=pcaps) record(text=tool JSON) verdict(target=finding id,text=confirmed|dismissed|open: note) note show report list

[Protocol] Analyze one protocol with preset fields and filter. Returns a summary and bounded rows; BLE values add device inventory, scanners, GATT timeline, connection lifecycle, pairing.

[TCP] Analyze TCP connection health (retransmissions, dup ACKs, zero window, resets).

[ARP] Detect potential ARP spoofing (duplicate IP-MAC, gratuitous floods, reply storms).

[Anomaly] Detect periodic communication patterns (C2 beacons) by analyzing connection timing intervals and jitter.

[Security] Detect DNS tunneling candidates (long query names, TXT abuse, high subdomain fanout).

[Security] Detect DoS/DDoS traffic volume patterns (SYN flood, ICMP/UDP flood, DNS amplification).

[Anomaly] Detect data exfiltration (large outbound transfers, DNS length anomalies, non-standard ports).

[Security] Detect port scanning (SYN, FIN, NULL, Xmas scans). threshold: min unique dst ports to flag.

[Anomaly] Detect protocol anomalies (known protocols on non-standard ports, unusual protocol distributions).

[Export] Extract embedded files from traffic. protocol: 'http'|'smb'|'tftp'|'imf'|'dicom'.

[Security] Scan for plaintext credentials (HTTP Basic Auth, FTP passwords, Telnet).

[DNS] Extract DNS query details (name, type, response flag) as TSV.

[Forensics] Extract JA3/JA3S TLS fingerprints and optionally match local user-maintained lists. Treat matches as leads.

[HTTP] Extract HTTP request details (method, URI, host, user-agent) as TSV.

[Enrichment] GeoIP lookup for unique IPs — country, city, ASN. Needs GeoLite2 DB.

[Forensics] Count packets containing common file signatures. Hits require object extraction and verification.

[TLS] Verify TLS decryption with SSLKEYLOGFILE-format keylog file.

[Security] YARA scan exported files. Detects malware, webshells, shellcode. protocol: http|smb|tftp.

[Entry Point] Open a pcap and get protocol-aware tool recommendations. Returns protocols and relevant tools.