Provides tools for analyzing PCAP files using Wireshark's tshark and capinfos, enabling network troubleshooting and packet analysis.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@PacketMaster run a quick network scan on the pcap at /tmp/capture.pcap"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server for network-troubleshooting PCAP analysis via tshark. Pairs with Cursor skills pcap-troubleshooting (domain workflows) and packetmaster-mcp (MCP tool usage).
Python 3.10+
uv (recommended) or pip
Wireshark with CLI tools: tshark, capinfos
brew install wireshark # macOS
PacketMaster auto-detects `/Applications/Wireshark.app/Contents/MacOS/tshark` if not on PATH.Related MCP server: Wireshark MCP
cd "/Users/networkze/Documents/Claude Projects/PacketMaster"
uv sync --extra devInstall the launcher (once), then add to ~/.cursor/mcp.json:
mkdir -p ~/.packetmaster-mcp
cp scripts/start-mcp.sh ~/.packetmaster-mcp/start-mcp.sh
chmod +x ~/.packetmaster-mcp/start-mcp.sh{
"mcpServers": {
"packetmaster": {
"command": "/Users/networkze/.packetmaster-mcp/start-mcp.sh",
"env": {
"FASTMCP_SHOW_SERVER_BANNER": "false"
}
}
}
}Uses a launcher script (like flipper-zero) because Cursor can break uv run paths that contain spaces.
PCAP paths must be absolute. By default any readable .pcap on disk is allowed. Set PM_ALLOWED_DIRS only if you want an opt-in sandbox.
Variable | Default | Description |
| (unset) | Optional colon-separated allowlist; when set, paths must stay inside |
| false | If true, |
| 10GB | Max PCAP file size |
| 10000 | Max packets per extraction request |
| 10MB | Max subprocess stdout |
| 300 | Subprocess timeout (seconds) |
| 500MB | Skip SHA-256 above this size unless requested |
| true | Redact credentials in stream/field output |
| auto | Override tshark binary path |
Tool | Description |
| Verify tshark/capinfos installation |
| capinfos + optional SHA-256 |
| Protocol distribution |
| Top conversations by bytes |
| Top IP endpoints |
| Wireshark expert information |
| TCP retrans/dup ACK/zero window/OOO/RST |
| Per-flow RTT statistics |
| Traffic over time |
| Paginated field extraction |
| Follow TCP/UDP/HTTP/TLS stream (redacted) |
| Packet summaries by display filter |
| Start here — wlan vs ethernet + tool routing |
| EPC/SPAN — DHCP, DNS, ICMP, VLAN, L2 infra, TCP |
| DHCP phases, stuck patterns, optional MAC filter |
| DNS queries/responses, NXDOMAIN, top names |
| One-sided capture / path asymmetry heuristics |
| L3 TCP-focused composite (alternate to wired scan) |
| Deep dive between two IPs |
| 802.11 monitor — retries, mgmt, roaming, BSSIDs |
| Deep dive on one STA by MAC |
| 802.11k/v roam timeline for one STA |
Capture via ios_xe_epc_capture_run (user-netops MCP) with pull_pcap=true
Run pm_troubleshoot_quick_scan on the returned local_path
Drill down with pm_troubleshoot_flow on suspect IPs
uv run pytest -q
uv run packetmaster-mcp # stdio MCP serverPCAP paths must be absolute; optional PM_ALLOWED_DIRS sandbox for locked-down setups
Symlinks rejected
Stream/field output redacts Authorization, Bearer tokens, passwords by default
Confirm with user before pm_follow_stream on production captures
Detect one-sided capture symptoms: SYN without ACK, lost segments, ICMP-in-tunnel.
Inputs: file_path (required), display_filter. Returns: result
Verify tshark/capinfos installation and configuration.
Inputs: no named parameters. Returns: result
Top conversations by bytes (ip, tcp, or udp).
Inputs: file_path (required), conv_type, limit. Returns: result
Detect wlan vs ethernet capture and recommend entry-point tool.
Inputs: file_path (required). Returns: result
DHCP transaction analysis with stuck-pattern detection (optional STA MAC).
Inputs: file_path (required), mac_address, sample_limit. Returns: result
DNS query/response analysis, top names, and failure samples (optional client IP).
Inputs: file_path (required), ip_address, sample_limit. Returns: result
Top IP endpoints by traffic volume.
Inputs: file_path (required), limit. Returns: result
Wireshark expert information (errors, warnings, notes, chats).
Inputs: file_path (required), severity. Returns: result
Extract specific tshark fields with pagination.
Inputs: file_path (required), fields (required), display_filter, offset, +1 more. Returns: result
Return capinfos metadata and optional SHA-256 hash for a PCAP file.
Inputs: file_path (required), compute_hash. Returns: result
Return packet summaries matching a display filter.
Inputs: file_path (required), display_filter (required), offset, limit. Returns: result
Follow a TCP/UDP/HTTP/TLS stream (truncated, redacted by default).
Inputs: file_path (required), stream_type, stream_index, max_bytes, +1 more. Returns: result
Traffic volume over time intervals.
Inputs: file_path (required), interval_seconds. Returns: result
Per-flow RTT statistics from tcp.analysis.ack_rtt.
Inputs: file_path (required), display_filter, limit. Returns: result
Protocol distribution tree from tshark -z io,phs.
Inputs: file_path (required). Returns: result
Count and sample TCP anomalies: retrans, dup ACK, zero window, OOO, RST.
Inputs: file_path (required), display_filter, sample_limit. Returns: result
Deep dive on traffic between two IP addresses (optional port).
Inputs: file_path (required), ip_a (required), ip_b (required), port. Returns: result
Composite triage: file info, expert, top conversations, TCP anomalies, protocol hierarchy.
Inputs: file_path (required), compute_hash. Returns: result
Deep dive on one Wi-Fi client STA by MAC (wlan.addr, bidirectional).
Inputs: file_path (required), wlan_addr (required), sample_limit. Returns: result
802.11 monitor-mode triage: retries, mgmt frames, security, roaming, top BSSIDs.
Inputs: file_path (required), rssi_threshold. Returns: result
802.11k/v roaming timeline: reassoc, neighbor reports, BSS transition, deauth.
Inputs: file_path (required), wlan_addr (required), sample_limit. Returns: result
Wired/EPC triage: DHCP, DNS, ICMP, L2 infra, VLAN, TCP anomalies, asymmetric hints.
Inputs: file_path (required), compute_hash. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 22 tools
All tools have clearly distinct purposes, targeting different network analysis aspects (WiFi vs wired, general vs specific protocols). The quick scan tools are differentiated by domain context, and pm_detect_capture_type helps select the appropriate entry point.
All tools follow the 'pm_' prefix with snake_case naming. They use a consistent pattern of pm_[domain]_[action] (e.g., pm_dhcp_analysis, pm_conversations) with occasional verb_noun (pm_extract_fields) but overall very consistent.
22 tools is slightly above the typical ideal range but justified by the breadth of packet analysis (WiFi, wired, diagnostic, protocol-specific). Each tool serves a distinct need without overwhelming the user.
The tool set covers essential packet analysis operations: file info, protocol hierarchy, conversations, endpoints, filtering, stream following, anomaly detection, and specialized scans. Minor gaps like HTTP-specific analysis or packet export are missing, but core workflows are well-supported.
MCP server for ScanMalware.com URL scanning, malware detection, and analysis.
MCP compatibility and transport verification server.
MCP compatibility and transport verification server.
MCP compatibility and transport verification server.
