Wireshark MCP gives an AI client a tshark-backed packet-analysis toolbox for investigating captures and live traffic.
Open pcaps and inspect file metadata, packets, bytes, context, streams, and search results.
Extract fields, DNS/HTTP data, credentials, TLS fingerprints, files/objects, and GeoIP enrichment.
Run capture-wide statistics: protocol hierarchy, endpoints, conversations, I/O graphs, expert info, service response time, and flow graphs.
Aggregate data, build a DuckDB capture index, run read-only SQL, timelines, diffs, and Parquet export.
Detect security issues: port scans, DNS tunneling, DoS, beaconing, exfiltration, ARP spoofing, protocol anomalies, YARA matches, and file signatures.
Analyze 25 protocols, including BLE, MQTT, Modbus, S7comm, Kerberos, QUIC, RTP, and Zigbee, plus TCP health.
Decrypt TLS/WPA, apply decode-as rules and protocol preferences, and verify TLS decryption.
Create and manipulate captures: live capture, merge, filter-save, trim, split, deduplicate, time-shift, extract frames, and import text/hex dumps.
Keep investigation state in case files with findings, evidence, verdicts, notes, and reports.
Provides tools for analyzing network traffic and pcap files, including packet summarization, deep packet dissection, stream reassembly, and automated extraction of HTTP requests, DNS queries, and credentials.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Wireshark MCP analyze capture.pcap and check for any plaintext credentials"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Give your AI assistant a packet analyzer.
Drop a .pcap file, ask questions in plain English — get answers backed by real tshark data.
An MCP server that wraps tshark (and optional Wireshark suite tools) into a structured analysis interface. Works with Claude Desktop, Claude Code, Cursor, VS Code, and 18+ other MCP clients.
You: "Find all DNS queries going to suspicious domains in this capture."
Claude: [calls wireshark_extract_dns_queries → wireshark_detect_dns_tunnel]
"Found repeated high-entropy DNS queries consistent with tunneling: ..."Capture index. With the optional [index] extra, wireshark_index dissects a capture once into a local DuckDB file. Later wireshark_aggregate and wireshark_extract_fields calls read it with answers identical to tshark: 408× faster at 1 GB, and at 10 GB it answers questions the tshark path stops on. It also adds read-only SQL, capture sets, first-seen timelines, capture or window diffs and Parquet export. See Capture index.
One finding shape. Every detector returns data.findings with a stable id, evidence anchors, a native tshark command to re-check it and candidate ATT&CK techniques.
Case files. wireshark_case keeps captures, recorded results, findings and analyst verdicts in a JSON case file, so a long investigation survives a context reset. See Findings and cases.
Upgrading from 3.x needs no configuration change. Scripts that parsed the plain-text output of wireshark_detect_beaconing, wireshark_detect_exfiltration, wireshark_detect_protocol_anomalies, wireshark_detect_arp_spoofing, wireshark_yara_scan or wireshark_quick_analysis should read the JSON envelope instead. Full notes: 4.0.0 changelog.
Related MCP server: AutoSOC Agent
Prerequisites: uv and Wireshark CLI (tshark). The plugin includes this project and both skills; the client runs the locked Python project through uv over stdio. It does not install Wireshark or capture drivers.
From a checkout containing these plugin manifests, choose your client:
# Codex
codex plugin marketplace add .
codex plugin add wireshark-mcp@wireshark-mcp
# Claude Code
claude plugin marketplace add .
claude plugin install wireshark-mcp@wireshark-mcpSee plugin distribution for local installation, old-version refresh, environment settings and the GitHub entrypoint after publication. Choose this route or the traditional registration route below, not both.
Prerequisites: Python 3.10+ and Wireshark with tshark on PATH.
Wireshark MCP runs on the stable MCP Python SDK 2.x line (mcp>=2.1.1,<3).
pip install wireshark-mcp
wireshark-mcp install # choose from detected MCP clientsFor scripts/non-interactive terminals, select clients explicitly. Preview before installing into the current project:
wireshark-mcp install --client codex --scope project --dry-run
wireshark-mcp install --client codex --scope projectThe default scope is global. Repeat --client or explicitly use --client all. Restart the client to load configuration. See the installation guide for updates, removal, backups and exit codes.
Optional extras add features on top of the base install: index (DuckDB capture index for large captures), geoip (GeoIP enrichment) and yara (YARA scanning), or all:
pip install 'wireshark-mcp[index]'The container image and the plugin route ship without extras. Every setting, extra and limit is listed in the configuration reference.
The project also ships MCP and full TShark CLI analysis skills; see skill discovery and usage.
Run wireshark-mcp doctor if anything looks off. See docs/manual-configuration.md for manual setup or platform-specific notes.
Point your AI client at a .pcap file and try:
Analyze capture.pcap using the Wireshark MCP tools.
Start with wireshark_open_file, then run wireshark_quick_analysis.
Use wireshark_aggregate for any capture-wide count or distribution.
Write findings to report.md.For a large capture, or several related ones, build the index first and keep the investigation in a case file:
Index big.pcapng with wireshark_index, then use wireshark_aggregate and
wireshark_index action="timeline" to find when 10.0.0.5 first appeared.
Open a case with wireshark_case, record every detector result you rely on,
and verify each conclusion with wireshark_get_packet_details.54 tools, each backed by real tshark output — organized into categories:
Category | Highlights | Count |
Entry & Workflow |
| 3 |
Packet Analysis | Packet list, details, bytes, context, stream follow, search, file info | 8 |
Data Extraction | HTTP requests, DNS queries, arbitrary fields, object export | 4 |
Statistics | Aggregate/group/distinct/top-k/time buckets, protocol hierarchy, endpoints, conversations, I/O graph, expert info, service response time, flow graph | 8 |
Security & Anomaly | Credential scan, port scan, DNS tunnel, DoS, beaconing, exfiltration, protocol anomalies, YARA | 8 |
Protocol Analysis |
| 3 |
Decrypt & Dissection | TLS/WPA decrypt, decryption check, decode-as, protocol preferences | 5 |
Forensics & Enrichment | TLS fingerprints, file signature scan, GeoIP | 3 |
File Ops, Capture & Suite | Live capture, interfaces, merge, filter-save, editcap trim/split/dedup/time-shift, frame extract, text2pcap, capabilities | 11 |
Capture Index (optional |
| 1 |
One tool covers 25 protocols rather than 25 tools covering one each: wireshark_analyze_protocol takes a protocol argument (tls_handshakes, mqtt, modbus, s7comm, zigbee, wifi, rtp, kerberos, …) and applies the right fields and display filter for it. The field names are the point — s7comm.param.item.dbnum is not something a caller should have to guess, and a wrong guess returns an empty result that reads like a clean capture.
The server starts with only tshark required. Optional tools (capinfos, mergecap, editcap, dumpcap, text2pcap) are auto-detected and enable extra features when present.
The tool list travels in the prompt prefix of every request your client sends, so its size is a fixed per-request cost. The default surface is ~23 KB — about 9 KB of parameter schema, 5 KB of descriptions, and 3 KB of read/write annotations — and it is byte-identical across restarts so clients can cache the prefix rather than re-reading it each session.
If your client never captures live traffic or writes pcaps, --profile advertises less:
Profile | Tools | Payload | Drops |
| 54 | ~23 KB | nothing |
| 42 | ~18 KB | live capture, interface listing, all caller-directed file-writing tools |
| 34 | ~15 KB | the above, plus decryption, dissection overrides, and low-level views |
wireshark-mcp serve --profile coreRuntime prompts and protocol recommendations respect the selected profile. Static guides may describe full-only workflows, but the server never recommends an excluded tool during capture discovery.
Tool results are bounded too, since a result stays in the conversation for the rest of the session. Output over 8000 characters is truncated head-and-tail with a marker, and the tool's offset / limit / display_filter parameters are the way to page through the rest. Raise or lower the ceiling with:
export WIRESHARK_MCP_MAX_RESULT_CHARS=16000Every tool also declares whether it reads or writes, so clients can auto-approve the 41 read-only analysis tools and still prompt for the 12 that create files (live capture, merge, filter-save, editcap, text2pcap, frame extract, object export, case files). wireshark_index is marked non-destructive: it writes only the server's own index cache.
Since 3.0, those tools fail closed until WIRESHARK_MCP_ALLOWED_DIRS names existing directories. Remote HTTP/SSE binding also stays loopback-only unless --allow-insecure-http is explicitly supplied behind a trusted authenticated TLS proxy. See the 3.0 security migration guide.
Topic | Link |
Documentation index | |
Configuration reference (extras, environment variables, limits) | |
Capture-wide aggregation | |
Capture index (DuckDB) | |
Findings and case files | |
Install, update and uninstall | |
Platform setup (macOS/Linux/Windows) | |
Manual client configuration | |
Deployment scenarios | |
3.0 security migration | |
Prompt templates | |
Architecture | |
Release checklist | |
Contributing | |
Changelog | |
Feature roadmap | |
Security policy |
uv sync --group dev --extra index
uv run python -m pytest
uv run python -m ruff check src/ tests/See CONTRIBUTING.md for the full guide.
[Primary statistics] Full-filter counts, groups, distinct values, numeric metrics, top-k, and time buckets. Field lists are comma-separated.
Inputs: pcap_file (required), top_k, sort_by, distinct, +8 more.
[Protocol] Analyze one protocol with preset fields and filter. Returns a summary and bounded rows; BLE values add device inventory, scanners, GATT timeline, connection lifecycle, pairing.
Inputs: protocol (required), pcap_file (required), limit.
[TCP] Analyze TCP connection health (retransmissions, dup ACKs, zero window, resets).
Inputs: pcap_file (required).
Capture live network traffic. capture_filter: BPF syntax. ring_buffer: "filesize:1024,files:5".
Inputs: interface (required), output_file (required), ring_buffer, packet_count, +2 more.
[Case] Saved investigation. create(text=title,target=pcaps) record(text=tool JSON) verdict(target=finding id,text=confirmed|dismissed|open: note) note show report list
Inputs: action (required), text, target, case_id.
[Dissection] Decode-as for non-standard ports. Rules: 'tcp.port==8080,http;udp.port==5353,dns'.
Inputs: pcap_file (required), decode_rules (required), limit, fields, +1 more.
[Decrypt] Decrypt TLS traffic using SSLKEYLOGFILE, show HTTP data.
Inputs: pcap_file (required), keylog_file (required), display_filter.
[Decrypt] Decrypt WPA/WPA2 traffic with passphrase (+SSID).
Inputs: pcap_file (required), wpa_passphrase (required), ssid, display_filter.
[ARP] Detect potential ARP spoofing (duplicate IP-MAC, gratuitous floods, reply storms).
Inputs: pcap_file (required).
[Anomaly] Detect periodic communication patterns (C2 beacons) by analyzing connection timing intervals and jitter.
Inputs: pcap_file (required), max_jitter, min_connections.
[Security] Detect DNS tunneling candidates (long query names, TXT abuse, high subdomain fanout).
Inputs: pcap_file (required).
[Security] Detect DoS/DDoS traffic volume patterns (SYN flood, ICMP/UDP flood, DNS amplification).
Inputs: pcap_file (required).
[Anomaly] Detect data exfiltration (large outbound transfers, DNS length anomalies, non-standard ports).
Inputs: pcap_file (required), limit.
[Security] Detect port scanning (SYN, FIN, NULL, Xmas scans). threshold: min unique dst ports to flag.
Inputs: pcap_file (required), threshold.
[Anomaly] Detect protocol anomalies (known protocols on non-standard ports, unusual protocol distributions).
Inputs: pcap_file (required), limit.
Remove duplicate packets within a sliding window (default: 5 packets).
Inputs: input_file (required), output_file (required), duplicate_window.
Split a capture into smaller files by packet count or interval.
Inputs: input_file (required), output_prefix (required), packets_per_file, seconds_per_file.
Adjust all packet timestamps by a positive or negative offset in seconds.
Inputs: seconds (required), input_file (required), output_file (required).
Trim capture to a timestamp window. Times in editcap format.
Inputs: input_file (required), output_file (required), stop_time, start_time.
[Export] Extract embedded files from traffic. protocol: 'http'|'smb'|'tftp'|'imf'|'dicom'.
Inputs: dest_dir (required), protocol (required), pcap_file (required).
[Security] Scan for plaintext credentials (HTTP Basic Auth, FTP passwords, Telnet).
Inputs: pcap_file (required).
[DNS] Extract DNS query details (name, type, response flag) as TSV.
Inputs: pcap_file (required), limit.
[Tabular] Extract fields as TSV. fields: comma-separated; limit/offset count lines including the header.
Inputs: fields (required), pcap_file (required), limit, offset, +1 more.
[Forensics] Extract JA3/JA3S TLS fingerprints and optionally match local user-maintained lists. Treat matches as leads.
Inputs: pcap_file (required), limit.
[File] Extract specific frame ranges to a new pcap. Ranges: '1-10 15 20-30'.
Inputs: pcap_file (required), output_file (required), frame_ranges (required).
[HTTP] Extract HTTP request details (method, URI, host, user-agent) as TSV.
Inputs: pcap_file (required), limit.
Filter packets from a pcap and save to a new file using a Wireshark display filter.
Inputs: input_file (required), output_file (required), display_filter (required).
[Stats] Flow/sequence graph showing packet exchange. Types: 'any', 'tcp', 'icmp'.
Inputs: pcap_file (required), flow_type.
[Stream] Reassemble stream with pagination. protocol: tcp|udp|tls|http|http2. output_mode: ascii|hex|raw.
Inputs: pcap_file (required), stream_index (required), protocol, limit_lines, +3 more.
[Enrichment] GeoIP lookup for unique IPs — country, city, ASN. Needs GeoLite2 DB.
Inputs: pcap_file (required), limit.
Get Wireshark suite capabilities for this MCP server instance (available tools and versions).
Inputs: no named parameters.
Get capture file metadata (type, packet count, duration, size) via capinfos.
Inputs: pcap_file (required).
[Bytes] Raw hex/ASCII dump of a single packet.
Inputs: pcap_file (required), frame_number (required).
[Context] Packets surrounding a specific frame (count before and after).
Inputs: pcap_file (required), frame_number (required), count.
[Detail] Full JSON for one packet. layers: comma-separated protocol filter (e.g. "ip,tcp,http").
Inputs: pcap_file (required), frame_number (required), layers.
[Summary] Packet list (top pane). TSV: No/Time/Src/Dst/Proto/Len/Info. custom_columns: comma-separated fields.
Inputs: pcap_file (required), limit, offset, custom_columns, +1 more.
[Index] Build once; aggregate/extract_fields reuse it. more_files: extra captures (capture_id). query: SELECT on packets/pkt/flows/captures. timeline: first/last seen. diff: vs more_files/compare_filter. export: Parquet.
Inputs: pcap_file (required), sql, action, more_files, +2 more.
List available network interfaces for capture.
Inputs: no named parameters.
Merge multiple capture files into one. input_files: comma-separated paths.
Inputs: input_files (required), output_file (required).
[Entry Point] Open a pcap and get protocol-aware tool recommendations. Returns protocols and relevant tools.
Inputs: pcap_file (required).
[Agent] One-call traffic overview: file info, protocols, top talkers, conversations, hostnames, anomalies.
Inputs: pcap_file (required).
[DEPRECATED] JSON packet data. Use get_packet_list + get_packet_details instead.
Inputs: pcap_file (required), limit, offset, display_filter.
[Forensics] Count packets containing common file signatures. Hits require object extraction and verification.
Inputs: pcap_file (required).
[Search] Find packets by content.
Inputs: pcap_file (required), match_pattern (required), limit, scope, +1 more.
[Dissection] Protocol preference overrides. Prefs: 'tcp.desegment_tcp_streams:TRUE;http.ssl.port:8443'.
Inputs: prefs (required), pcap_file (required), limit, fields, +1 more.
[Conversations] Communication pairs and stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.
Inputs: pcap_file (required), type.
[Endpoints] List all endpoints and traffic stats. type: 'eth'|'ip'|'ipv6'|'tcp'|'udp'|'sctp'|'wlan'.
Inputs: pcap_file (required), type.
[Expert Info] Automatic anomaly detection: retransmissions, errors, warnings, protocol issues.
Inputs: pcap_file (required).
[I/O Graph] Traffic volume by time bucket, optionally split by semicolon-separated display filters.
Inputs: pcap_file (required), filters, interval.
[PHS] Protocol hierarchy statistics showing distribution of protocols in the capture.
Inputs: pcap_file (required).
[SRT] Service response time statistics. protocol: 'http'|'dns'|'smb' etc.
Inputs: pcap_file (required), protocol.
Convert ASCII or hex dump into a capture file using text2pcap. encapsulation: link-layer type (default: ether).
Inputs: output_file (required), input_text_file (required), ascii_mode, encapsulation, +1 more.
[TLS] Verify TLS decryption with SSLKEYLOGFILE-format keylog file.
Inputs: pcap_file (required), keylog_file (required).
[Security] YARA scan exported files. Detects malware, webshells, shellcode. protocol: http|smb|tftp.
Inputs: pcap_file (required), dest_dir, protocol.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 54 tools
The tools are grouped into recognizable categories (security detections, packet retrieval, statistics, capture/file operations), but several analytics tools overlap substantially: aggregate, index, extract_fields, analyze_protocol, quick_analysis, and the stats_* tools can all answer similar traffic-summary questions. Packet-access tools are mostly distinct, but the deprecated read_packets and the multi-action case tool add avoidable ambiguity. Descriptions help, but an agent still faces non-trivial tool-selection risk.
Most tools use a wireshark_ prefix, but action encoding is mixed: many follow verb_noun (detect_*, extract_*, get_*), while others are bare verbs/nouns (capture, index, aggregate, case), noun_verb (filter_save, text2pcap_import), or subsystem-prefixed (editcap_*, stats_*). The pattern is readable but not predictable enough for a 5 or 4.
At 54 tools, the surface is heavy for an MCP server and several capabilities could be consolidated (e.g. packet listing/detail/bytes/search plus deprecated read_packets; multiple stats and aggregate tools). The Wireshark domain is broad enough that this is not a trivial or nonsensical set, but the count is well beyond a well-scoped tool surface.
The set covers a full Wireshark workflow: live capture, file open/metadata/merge/import, packet listing/details/bytes/search, streams, protocol stats, security detections, credential/object extraction, TLS/WPA decryption, field extraction, case management, and export/edit operations. There are no obvious lifecycle gaps for traffic analysis, and workarounds exist for advanced edge cases.
Zero-log MCP server with 49 tools for AI guardrails, secret scanning, MCP linting & EU compliance.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Security scanner for MCP servers. Detect vulnerabilities, prompt injection, and tool poisoning.
MCP server providing access to the Scorecard API to evaluate and optimize LLM systems.
