Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Tshark MCP Server Analyze /pcaps/traffic.pcap for attacks"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP (Model Context Protocol) server for analyzing pcap files using tshark to detect potential network attacks and security threats.
Automated Attack Detection: Analyzes pcap files for common attack patterns:
Port scanning attempts
DDoS indicators (traffic volume anomalies)
DNS tunneling and exfiltration
HTTP-based attacks (SQL injection, XSS)
Failed connection attempts
Suspicious IP addresses
Custom Queries: Run custom tshark queries with Wireshark display filters
Statistics: Get comprehensive pcap statistics including protocols and conversations
Related MCP server: PCAP MCP Server
Docker and Docker Compose installed
No other dependencies needed!
Node.js (v16 or higher)
Tshark installed and available in PATH
Windows: Install Wireshark (includes tshark)
Linux: sudo apt-get install tshark
macOS: brew install wireshark
Build the Docker image:
docker-compose buildPlace your pcap files in the pcaps/ directory (or configure a custom volume in docker-compose.yml)
Configure Claude Desktop with the Docker container:
Add to your Claude Desktop config file:
Windows: %APPDATA%\Claude\claude_desktop_config.json
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json
{
"mcpServers": {
"tshark": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-v",
"/path/to/your/pcaps:/pcaps:ro",
"tshark-mcp-server:latest"
]
}
}
}Windows example:
{
"mcpServers": {
"tshark": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-v",
"C:\\captures:/pcaps:ro",
"tshark-mcp-server:latest"
]
}
}
}Linux/Mac example:
{
"mcpServers": {
"tshark": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-v",
"${HOME}/captures:/pcaps:ro",
"tshark-mcp-server:latest"
]
}
}
}Install dependencies:
npm installConfigure Claude Desktop:
{
"mcpServers": {
"tshark": {
"command": "node",
"args": ["/absolute/path/to/tshark-mcp/index.js"]
}
}
}After configuration, restart Claude Desktop. Your pcap files should be accessible at /pcaps/ (Docker) or their original paths (local).
analyze_pcap_attacksAutomatically analyzes a pcap file for security threats.
Parameters:
pcap_path (required): Path to the pcap file
Example:
# Docker: pcap files are in /pcaps inside container
Analyze /pcaps/traffic.pcap for attacks
# Local installation
Analyze c:\captures\traffic.pcap for attacksThe AI will automatically identify suspicious IPs and attack patterns.
query_pcapRun custom tshark queries with display filters.
Parameters:
pcap_path (required): Path to the pcap file
display_filter (optional): Wireshark display filter
fields (optional): Array of fields to extract
Examples:
# Docker
Show all HTTP GET requests from /pcaps/traffic.pcap
Query /pcaps/traffic.pcap with filter "ip.src==192.168.1.100 && tcp.port==443"
# Local
Show all HTTP GET requests from traffic.pcap
Extract source IPs and ports from traffic.pcap where tcp.flags.syn==1get_pcap_statsGet general statistics about a pcap file.
Parameters:
pcap_path (required): Path to the pcap file
Example:
Get statistics for traffic.pcapWhen you use analyze_pcap_attacks, the server:
Runs multiple tshark queries to extract security-relevant data
Formats the results for AI analysis
The AI (Claude) analyzes the data to:
Identify suspicious IP addresses
Detect attack patterns
Explain potential threats
Provide remediation suggestions
User: "Analyze /pcaps/suspicious.pcap"
AI Response:
Identifies potential attackers by IP
Explains attack types detected (port scan, DDoS, etc.)
Lists suspicious domains or URLs
Recommends next steps
User: "Show me all traffic from IP 192.168.1.50"
AI uses query_pcap:
Filters pcap for that specific IP
Shows relevant packets
Analyzes behavior
✅ Portability: Works on Windows, Linux, and macOS ✅ No Dependencies: Tshark is pre-installed in the container ✅ Isolation: Secure execution environment ✅ Easy Updates: Just rebuild the image ✅ Consistent: Same environment everywhere
The server looks for:
Port Scanning: SYN packets to multiple ports from the same source
DDoS Attacks: Unusual traffic volumes from single sources
DNS Anomalies: Suspicious query patterns, potential tunneling
HTTP Attacks: SQL injection, XSS, directory traversal in URLs
Reconnaissance: Multiple failed connections (RST packets)
Protocol Anomalies: Unusual protocol usage patterns
Common filters you can use with query_pcap:
ip.addr==192.168.1.1 # Traffic to/from specific IP
tcp.port==80 # HTTP traffic
http.request.method==POST # POST requests
dns.qry.name contains "evil" # DNS queries with "evil"
tcp.flags.syn==1 && tcp.flags.ack==0 # SYN packets (port scan)
icmp.type==8 # ICMP echo requests (ping)"tshark: command not found"
Ensure tshark is installed and in your PATH
Restart Claude Desktop after installation
Permission errors on Linux:
sudo dpkg-reconfigure wireshark-common # Select "Yes"
sudo usermod -a -G wireshark $USERLog out and back in for changes to take effect.
This tool is designed for defensive security analysis only. Use it to:
Analyze your own network traffic
Investigate security incidents
Learn about network security
Detect threats in authorized environments
MIT
Analyze a pcap file for potential security threats and attacks. Returns suspicious IPs, port scans, DDoS indicators, DNS anomalies, HTTP attacks, and connection patterns.
| Name | Required | Description | Default |
|---|---|---|---|
| pcap_path | Yes | Path to the pcap file to analyze |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description carries full burden. It lists return types but does not mention side effects, resource usage, permissions, or whether the tool modifies data. Behavior is implied but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no fluff; front-loaded purpose and concise enumeration of outputs. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema), the description adequately covers output types. Could mention limitations like file size or processing time, but overall sufficient for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear parameter description. The tool description does not add meaning beyond repeating 'pcap_path' as the path, so no extra value; baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool analyzes pcap files for security threats and lists specific outputs (suspicious IPs, port scans, etc.), which distinguishes it from sibling tools like query_pcap or get_pcap_stats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives; only implicitly suggests use for general attack analysis. Lacks when-not-to-use or context for selecting among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get general statistics about a pcap file including packet counts, protocols, and conversations.
| Name | Required | Description | Default |
|---|---|---|---|
| pcap_path | Yes | Path to the pcap file |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, and the description provides no behavioral details such as permissions needed, side effects, or error conditions. It only states what the tool does without disclosing traits like read-only nature or potential limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no unnecessary words. Every part serves to convey the tool's function efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema), the description covers the main outputs (packet counts, protocols, conversations) adequately. It lacks details on return format but is sufficient for the tool's scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, pcap_path, is described adequately in the schema. The description adds no extra meaning beyond 'pcap file', so with 100% schema coverage, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Get general statistics about a pcap file', listing specific content like packet counts, protocols, and conversations. It distinguishes well from siblings such as analyze_pcap_attacks, query_pcap, and investigate_dns_tunneling, which have different focuses.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for obtaining general statistics, but lacks explicit guidance on when to use this tool versus its siblings. No exclusions or alternative recommendations are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Perform detailed DNS tunneling investigation. Identifies attack characteristics, starting packet number, source IP, OS fingerprinting via TTL, and entropy analysis. Perfect for forensic investigations.
| Name | Required | Description | Default |
|---|---|---|---|
| pcap_path | Yes | Path to the pcap file | |
| time_filter | No | Optional time filter in Wireshark syntax (e.g., 'frame.time >= "2021-07-12 19:27:00"') |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It discloses some behaviors (e.g., OS fingerprinting via TTL, entropy analysis) but does not mention read-only nature, required permissions, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, no unnecessary words. Efficiently conveys core function and key features.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 2 simple parameters and no output schema, the description adequately covers what the tool does and what it returns (attack characteristics). It could optionally detail return structure but is sufficient for the complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters described. The description adds no additional meaning beyond listing capabilities; it does not elaborate on how parameters affect the investigation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Perform detailed DNS tunneling investigation' and lists specific outputs (attack characteristics, starting packet, source IP, OS fingerprinting via TTL, entropy analysis). This distinguishes it from sibling tools like analyze_pcap_attacks (broader) or query_pcap (generic querying).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Perfect for forensic investigations' suggests appropriate context. However, it does not explicitly state when not to use (e.g., for non-DNS-tunneling traffic) or name alternatives like sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a custom tshark query on a pcap file with optional display filters and field extraction. Use Wireshark display filter syntax.
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | Fields to extract (e.g., ['ip.src', 'ip.dst', 'tcp.port']) | |
| pcap_path | Yes | Path to the pcap file | |
| display_filter | No | Wireshark display filter (e.g., 'ip.addr==192.168.1.1', 'tcp.port==80', 'http.request.method==GET') |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden but only says 'run a custom tshark query' without disclosing output format, side effects (presumably read-only), or limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the core action and add a syntax tip. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description omits return value information. It also lacks usage context relative to siblings, making it incomplete for an agent to fully understand capabilities.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with clear descriptions. The description adds minimal value, only restating that display filters use Wireshark syntax and that fields are optional.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it runs custom tshark queries with display filters and field extraction, which differentiates it from sibling tools like analyze_pcap_attacks or get_pcap_stats that have more specific purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool vs siblings. It implies usage for custom queries but does not explain when to choose it over pre-built analyses.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v1.0.0analyze_pcap_attacksget_pcap_statsinvestigate_dns_tunnelingquery_pcapScored across 4 tools
Each tool has a distinct focus: general attack detection, custom queries, overall stats, and detailed DNS tunneling investigation. However, the general attack analysis in 'analyze_pcap_attacks' could overlap with the DNS tunneling investigation, creating slight ambiguity for agents that might pick the wrong tool for a specific subtask.
All tool names follow a consistent 'verb_noun' pattern in snake_case (e.g., analyze_pcap_attacks, query_pcap, get_pcap_stats, investigate_dns_tunneling), making it easy to predict functionality.
With only 4 tools, the server is well-scoped for pcap analysis. Each tool serves a clear purpose: statistics, custom queries, general attack detection, and specialized DNS tunneling investigation. No tool feels redundant or missing given the domain.
The tool set covers core pcap analysis tasks: statistics, custom queries, generic attack detection, and deep forensic investigation of DNS tunneling. A potential gap is the lack of a tool for direct file upload or results export, but 'query_pcap' with Wireshark syntax provides flexible extraction. Overall, it's reasonably complete for security analysis.
TLPTOracle — 17-tool TIBER-EU TLPT framework: scope, threat intel, scenarios, reports.
Crypto security, honeypot detection, wallet analysis, and token risk scoring across 31 blockchains.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.