The Wireshark MCP server provides comprehensive network packet analysis capabilities by integrating Wireshark/tshark tools, enabling AI assistants to analyze pcap files, capture live traffic, and perform security analysis.
Packet Analysis: View packet summaries and detailed JSON information, extract raw hex/ASCII dumps, view packets in context, reassemble and follow complete TCP/UDP/TLS/HTTP streams with pagination, and search for patterns using string, hex, or regex matching.
Data Extraction: Extract specific protocol fields as tabular data with custom filtering, retrieve HTTP requests and DNS queries, list unique IP addresses, export embedded files from HTTP/SMB/TFTP traffic, and verify TLS decryption using keylog files.
Statistics & Reporting: Generate protocol hierarchy statistics, endpoint and conversation analysis, I/O graphs for traffic volume over time, expert information for anomaly detection (retransmissions, errors, warnings), and service response time metrics for HTTP, DNS, SMB and other protocols.
File Operations & Live Capture: Get detailed metadata for pcap files, merge multiple capture files, filter and save packets, list available network interfaces, and capture live traffic with duration, packet count, BPF filters, and ring buffer support.
Security Analysis: Check captured IP addresses against URLhaus threat intelligence feeds and scan for plaintext credentials in HTTP Basic Auth, FTP, and Telnet traffic.
Utilities: Decode common encodings (Base64, Hex, URL, Gzip, Deflate, Rot13) with auto-detection and generate ASCII charts for traffic volume and protocol hierarchy trees.
Supported Protocols: Network layer (Ethernet, IP, IPv6, TCP, UDP, SCTP, WLAN) and application layer (HTTP, HTTP/2, DNS, TLS/SSL, SMB, FTP, Telnet, TFTP, DICOM).
Provides tools for analyzing network traffic and pcap files, including packet summarization, deep packet dissection, stream reassembly, and automated extraction of HTTP requests, DNS queries, and credentials.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Wireshark MCP analyze capture.pcap and check for any plaintext credentials"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Give your AI assistant a packet analyzer.
Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.
An MCP server that wraps tshark (and optional Wireshark suite tools) into a structured analysis interface. Works with Claude Desktop, Claude Code, Cursor, VS Code, and 18+ other MCP clients.
You: "Find all DNS queries going to suspicious domains in this capture."
Claude: [calls wireshark_extract_dns_queries → wireshark_detect_dns_tunnel]
"Found repeated high-entropy DNS queries consistent with tunneling: ..."Related MCP server: AutoSOC Agent
Prerequisites: Python 3.10+ and Wireshark with tshark on PATH.
pip install wireshark-mcp
wireshark-mcp install # auto-configures all detected MCP clientsRestart your AI client — done.
Run wireshark-mcp doctor if anything looks off. See docs/manual-configuration.md for manual setup or platform-specific notes.
Point your AI client at a .pcap file and try:
Analyze capture.pcap using the Wireshark MCP tools.
Start with wireshark_open_file, then run wireshark_quick_analysis.
Write findings to report.md.51 tools, each backed by real tshark output — organized into categories:
Category | Highlights | Count |
Entry & Workflow |
| 2 |
Packet Analysis | Packet list, details, bytes, context, stream follow, search, file info | 8 |
Data Extraction | HTTP requests, DNS queries, arbitrary fields, object export | 4 |
Statistics | Protocol hierarchy, endpoints, conversations, I/O graph, expert info, service response time, flow graph | 7 |
Security & Anomaly | Credential scan, port scan, DNS tunnel, DoS, beaconing, exfiltration, protocol anomalies, YARA | 8 |
Protocol Analysis |
| 3 |
Decrypt & Dissection | TLS/WPA decrypt, decryption check, decode-as, protocol preferences | 5 |
Forensics & Enrichment | TLS fingerprints, file signature scan, GeoIP | 3 |
File Ops, Capture & Suite | Live capture, interfaces, merge, filter-save, editcap trim/split/dedup/time-shift, frame extract, text2pcap, capabilities | 11 |
One tool covers 20 protocols rather than 20 tools covering one each: wireshark_analyze_protocol takes a protocol argument (tls_handshakes, mqtt, modbus, s7comm, zigbee, wifi, rtp, kerberos, …) and applies the right fields and display filter for it. The field names are the point — s7comm.param.item.dbnum is not something a caller should have to guess, and a wrong guess returns an empty result that reads like a clean capture.
The server starts with only tshark required. Optional tools (capinfos, mergecap, editcap, dumpcap, text2pcap) are auto-detected and enable extra features when present.
The tool list travels in the prompt prefix of every request your client sends, so its size is a fixed per-request cost. The default surface is ~21 KB — about 9 KB of parameter schema, 5 KB of descriptions, and 3 KB of read/write annotations — and it is byte-identical across restarts so clients can cache the prefix rather than re-reading it each session.
If your client never captures live traffic or writes pcaps, --profile advertises less:
Profile | Tools | Payload | Drops |
| 51 | ~21 KB | nothing |
| 41 | ~17 KB | live capture, interface listing, all file-writing tools |
| 33 | ~14 KB | the above, plus decryption, dissection overrides, and low-level views |
wireshark-mcp serve --profile coreEvery profile still contains every tool the bundled prompts, resources, skill files, and protocol recommendations can point the model at, so reducing the surface never leaves it chasing a tool that is not there.
Tool results are bounded too, since a result stays in the conversation for the rest of the session. Output over 8000 characters is truncated head-and-tail with a marker, and the tool's offset / limit / display_filter parameters are the way to page through the rest. Raise or lower the ceiling with:
export WIRESHARK_MCP_MAX_RESULT_CHARS=16000Every tool also declares whether it reads or writes, so clients can auto-approve the 40 read-only analysis tools and still prompt for the 11 that create files (live capture, merge, filter-save, editcap, text2pcap, frame extract, object export).
Topic | Link |
Platform setup (macOS/Linux/Windows) | |
Manual client configuration | |
Prompt templates | |
Release checklist | |
Contributing | |
Changelog | |
Security policy |
pip install -e ".[dev]"
pytest tests/ -v
ruff check src/ tests/See CONTRIBUTING.md for the full guide.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
MCP server providing access to the Scorecard API to evaluate and optimize LLM systems.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/bx33661/Wireshark-MCP'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
