wireshark_search_packets
Search packet capture files for specific data patterns using string, hex, regex, or Wireshark display filters. Returns matching packets from the capture.
Instructions
[Search] Find packets containing specific data.
Args: pcap_file: Path to capture file match_pattern: Pattern to search for search_type: Search method - 'string', 'hex', 'regex' limit: Maximum matches to return (default: 50) scope: Search scope - 'bytes' (default), 'details', or 'filter' - 'bytes': Searches raw packet payload (frame contains) - 'details': Searches decoded text layer (frame matches) - 'filter': Uses standard Wireshark display filter syntax (e.g. "http.response.code == 200")
Returns: List of matching packets (summary view) or JSON error
Errors: FileNotFound: pcap_file does not exist
Example: wireshark_search_packets("traffic.pcap", "password", scope="bytes") wireshark_search_packets("traffic.pcap", "http.response.code == 200", scope="filter")
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| scope | No | bytes | |
| pcap_file | Yes | ||
| search_type | No | string | |
| match_pattern | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |