List all available network interfaces for packet capture.

Capture live network packets from a specified interface.

Args: interface: Network interface name (e.g., eth0, en0, Wi-Fi) duration: Maximum capture duration in seconds packet_count: Maximum number of packets to capture bpf_filter: BPF capture filter (e.g., 'tcp port 80')

Perform a quick packet capture (3 seconds, default interface).

A fast way to see what's happening on the network without configuration.

Args: interface: Network interface name (default: eth0) packet_count: Maximum packets to capture (default: 10)

Capture network traffic and save to a PCAP file.

Useful when you want to keep a capture for later analysis.

Args: interface: Network interface name output_file: Path where to save the PCAP file duration: Max capture duration in seconds packet_count: Max packets to capture bpf_filter: BPF capture filter (optional)

Analyze a PCAP file with optional display filters.

Args: filepath: Path to PCAP/PCAPNG file display_filter: Wireshark display filter (e.g., 'http', 'ip.addr == 10.0.0.1') max_packets: Maximum number of packets to analyze

Get protocol hierarchy statistics from a PCAP file.

Args: filepath: Path to PCAP/PCAPNG file

Get metadata about a PCAP capture file.

Args: filepath: Path to PCAP/PCAPNG file

Capture traffic targeted to specific host, port, or protocol.

Args: interface: Network interface name target_host: Filter by host IP (optional) target_port: Filter by port number (optional) protocol: Filter by protocol (tcp, udp, icmp, http) duration: Max capture duration in seconds packet_limit: Maximum packets to capture ctx: Optional MCP context for progress reporting

Analyze HTTP traffic from a PCAP file.

Extracts HTTP methods, hosts, URIs, user agents, and response codes.

Args: filepath: Path to PCAP/PCAPNG file

Detect and report network protocols in use.

Args: filepath: Path to existing PCAP file (optional) interface: Network interface for live capture (if no file) duration: Duration in seconds for live capture

Analyze HTTP headers from a PCAP file — tokens, cookies, auth headers.

Extracts:

• Cookies and session tokens

• Authorization headers (Bearer, API keys)

• Custom security headers

• Suspicious headers (X-Forwarded-For spoofing)

Args: filepath: Path to PCAP/PCAPNG file include_cookies: Whether to include cookie analysis

Look up geographic information for IP addresses.

Can check specific IPs or extract all from a PCAP file.

Args: ip_addresses: Comma-separated IP addresses (e.g., '1.1.1.1,8.8.8.8') filepath: PCAP file to extract IPs from (optional, overrides ip_addresses if provided)

Analyze DNS queries and responses from a PCAP file.

Extracts DNS query names, types, response codes, and identifies potential DNS tunneling or suspicious patterns.

Args: filepath: Path to PCAP/PCAPNG file max_queries: Maximum number of DNS rows to process

Extract Wireshark expert information from a PCAP file.

Returns warnings, errors, and notes from Wireshark's expert system. Useful for identifying protocol violations, malformed packets, etc.

Args: filepath: Path to PCAP/PCAPNG file

Deep packet analysis with protocol breakdown, layer details, and markdown tables.

Args: file_path: Path to PCAP/PCAPNG file count: Maximum number of packets to analyze display_filter: Optional Wireshark display filter

Reconstruct a TCP conversation from a PCAP file.

Args: filepath: Path to PCAP/PCAPNG file stream_index: Index of the TCP stream to follow (0-based) format: Output format: ascii, hex, or raw

Reconstruct a UDP conversation from a PCAP file.

Args: filepath: Path to PCAP/PCAPNG file stream_index: Index of the UDP stream to follow (0-based) output_format: Output format: ascii, hex, or raw

List all TCP conversations found in a PCAP file.

Args: filepath: Path to PCAP/PCAPNG file

Export packets from a PCAP file as structured JSON.

Args: filepath: Path to PCAP/PCAPNG file display_filter: Wireshark display filter max_packets: Maximum packets to export

Export packet fields from a PCAP as CSV with proper headers using tshark -E flags.

Args: filepath: Path to PCAP/PCAPNG file fields: Comma-separated field names (default: standard fields including column fields) display_filter: Wireshark display filter separator: CSV field separator character (default: comma)

Get a quick packet summary similar to Wireshark's packet list view.

Uses column fields (_ws.col.*) for human-readable output.

Args: file_path: Path to PCAP/PCAPNG file count: Maximum number of packets to show (default: 20) display_filter: Optional Wireshark display filter

Convert a PCAP file between pcap and pcapng formats.

Args: filepath: Path to source PCAP file output_format: Target format: pcap or pcapng

Extract potential credentials from a PCAP file.

Scans for:

• HTTP Basic Authentication headers

• FTP USER/PASS commands

• Telnet login/password prompts

• Kerberos AS-REQ/AS-REP hashes (crackable with hashcat)

Args: filepath: Path to PCAP/PCAPNG file

Check an IP address against threat intelligence feeds.

Args: ip_address: IP address to check providers: Comma-separated providers (urlhaus, abuseipdb)

Extract all IPs from a PCAP file and check against threat feeds.

Args: filepath: Path to PCAP/PCAPNG file providers: Comma-separated providers (urlhaus, abuseipdb)

Analyze a large PCAP file in chunks for memory efficiency.

Processes packets in batches, accumulating statistics.

Args: filepath: Path to PCAP/PCAPNG file chunk_size: Number of packets per processing chunk display_filter: Optional Wireshark display filter ctx: Optional MCP context for progress reporting

List available Wireshark profiles and their configuration files.

Analyze a PCAP file using a specific Wireshark profile.

Args: filepath: Path to PCAP/PCAPNG file profile_name: Wireshark profile name to apply display_filter: Optional Wireshark display filter max_packets: Maximum packets to return

Read Wireshark color filter rules from a profile or the default config.

Args: profile_name: Profile name (empty string uses default config)

Live capture using a Wireshark profile's configuration.

Args: interface: Network interface name (e.g., eth0, en0) profile_name: Wireshark profile name to apply duration: Capture duration in seconds packet_count: Maximum number of packets

Compare two PCAP files and report differences.

Args: filepath1: Path to first PCAP file filepath2: Path to second PCAP file display_filter: Optional Wireshark display filter applied to both

Merge multiple PCAP files into one using mergecap.

Args: filepaths: List of PCAP file paths to merge output_file: Output file path (.pcap or .pcapng) chronological: Merge by timestamp (True) or append in order (False)

Slice or filter a PCAP file using editcap.

Args: filepath: Path to input PCAP file output_file: Output file path (.pcap or .pcapng) start_packet: First packet number to keep (1-based) end_packet: Last packet number to keep start_time: Keep packets after this time (editcap -A format) end_time: Keep packets before this time (editcap -B format) remove_duplicates: Remove duplicate packets

Decode a single packet in full detail.

Args: filepath: Path to PCAP file packet_number: Packet number to decode (1-based) verbose: If True, return verbose text decode; if False, return JSON layers hex_dump: If True, include hex and ASCII dump of raw packet bytes (-x flag)

Generate visual diagrams of network flows from a PCAP file.

Produces ASCII art or Mermaid sequence diagrams showing packet exchanges between endpoints.

Args: filepath: Path to PCAP/PCAPNG file flow_type: Protocol type: tcp or udp max_flows: Maximum number of packet arrows to include (1-200) output_format: Diagram format: text or mermaid

Decrypt TLS/HTTPS traffic using an SSLKEYLOGFILE.

Requires a TLS key log file (NSS Key Log Format) captured alongside the traffic. Set SSLKEYLOGFILE env var or pass keylog_file explicitly.

Args: filepath: Path to PCAP/PCAPNG file containing TLS traffic keylog_file: Path to TLS key log file (NSS format) output_file: Optional path to write decrypted pcapng

Extract files from HTTP/SMB/DICOM/IMF/TFTP streams using tshark.

Args: file_path: Path to PCAP/PCAPNG file protocol: Protocol to extract objects from (http, smb, dicom, imf, tftp) output_dir: Directory to write extracted files (created if empty)

Time-binned I/O statistics from a PCAP file.

Args: file_path: Path to PCAP/PCAPNG file interval: Time interval in seconds for binning (positive number) display_filter: Optional Wireshark display filter

IP/TCP/UDP/Ethernet conversation statistics from a PCAP file.

Args: file_path: Path to PCAP/PCAPNG file conv_type: Conversation type (eth, ip, ipv6, tcp, udp) display_filter: Optional Wireshark display filter

Generate a comprehensive analysis report in markdown or HTML.

Args: file_path: Path to PCAP/PCAPNG file report_format: Output format — 'markdown' or 'html' sections: Comma-separated list of sections to include

Get detailed capture file information using capinfos.

Args: file_path: Path to PCAP/PCAPNG file