mcpcap

Instructions

Implementation Reference

• src/mcpcap/modules/dhcp.py:19-41 (handler)

  The main handler function implementing the 'analyze_dhcp_packets' tool. It handles input validation via docstring and delegates to base class for local/remote file processing.

  def analyze_dhcp_packets(self, pcap_file: str) -> dict[str, Any]:
      """
      Analyze DHCP packets from a PCAP file and return comprehensive analysis results.
  
      ⚠️  FILE UPLOAD LIMITATION: This MCP tool cannot process files uploaded through
      Claude's web interface. Files must be accessible via URL or local file path.
  
      SUPPORTED INPUT FORMATS:
      - Remote files: "https://example.com/capture.pcap"
      - Local files: "/absolute/path/to/capture.pcap"
  
      UNSUPPORTED:
      - Files uploaded through Claude's file upload feature
      - Base64 file content
      - Relative file paths
  
      Args:
          pcap_file: HTTP URL or absolute local file path to PCAP file
  
      Returns:
          A structured dictionary containing DHCP packet analysis results
      """
      return self.analyze_packets(pcap_file)

• src/mcpcap/core/server.py:49-63 (registration)

  The _register_tools method where the analyze_dhcp_packets tool is registered with the FastMCP server instance.

  for module_name, module in self.modules.items():
      if module_name == "dns":
          self.mcp.tool(module.analyze_dns_packets)
      elif module_name == "dhcp":
          self.mcp.tool(module.analyze_dhcp_packets)
      elif module_name == "icmp":
          self.mcp.tool(module.analyze_icmp_packets)
      elif module_name == "capinfos":
          self.mcp.tool(module.analyze_capinfos)
      elif module_name == "tcp":
          self.mcp.tool(module.analyze_tcp_connections)
          self.mcp.tool(module.analyze_tcp_anomalies)
          self.mcp.tool(module.analyze_tcp_retransmissions)
          self.mcp.tool(module.analyze_traffic_flow)

• src/mcpcap/modules/dhcp.py:43-94 (helper)

  Core helper function performing the DHCP-specific packet filtering, analysis, and statistics generation using Scapy.

  def _analyze_protocol_file(self, pcap_file: str) -> dict[str, Any]:
      """Perform the actual DHCP packet analysis on a local PCAP file."""
      try:
          packets = rdpcap(pcap_file)
          dhcp_packets = [pkt for pkt in packets if pkt.haslayer(BOOTP)]
  
          if not dhcp_packets:
              return {
                  "file": pcap_file,
                  "total_packets": len(packets),
                  "dhcp_packets_found": 0,
                  "message": "No DHCP packets found in this capture",
              }
  
          # Apply max_packets limit if specified
          packets_to_analyze = dhcp_packets
          limited = False
          if self.config.max_packets and len(dhcp_packets) > self.config.max_packets:
              packets_to_analyze = dhcp_packets[: self.config.max_packets]
              limited = True
  
          packet_details = []
          for i, pkt in enumerate(packets_to_analyze, 1):
              packet_info = self._analyze_dhcp_packet(pkt, i)
              packet_details.append(packet_info)
  
          # Generate statistics
          stats = self._generate_statistics(packet_details)
  
          result = {
              "file": pcap_file,
              "total_packets": len(packets),
              "dhcp_packets_found": len(dhcp_packets),
              "dhcp_packets_analyzed": len(packet_details),
              "statistics": stats,
              "packets": packet_details,
          }
  
          # Add information about packet limiting
          if limited:
              result["note"] = (
                  f"Analysis limited to first {self.config.max_packets} DHCP packets due to --max-packets setting"
              )
  
          return result
  
      except Exception as e:
          return {
              "error": f"Error reading PCAP file '{pcap_file}': {str(e)}",
              "file": pcap_file,
          }