"Wireshark" matching MCP tools:

• ws_runtime_infoA

  wireshark-mcpB

  Retrieve Wireshark runtime information: installed binaries, versions, available features, and allowed file roots.

  MIT

• filter_validate_displayA

  wireshark-mcpB

  Validate Wireshark display filter syntax. Returns validity status without requiring an active analysis session.

  MIT

• wireshark_get_capabilitiesA

  Wireshark MCPB

  Retrieve the list of available tools and versions supported by the Wireshark MCP server for pcap analysis.

  MIT

• check_installationA

  mcp-wiresharkA

  Check Wireshark and tshark installation status and display version information.

  MIT

• display_filterA

  mcp-wiresharkA

  Filter a pcap file using a Wireshark display filter and preview matching packets.

  MIT

• wireshark_filter_saveB

  Wireshark MCPB

  Apply a Wireshark display filter to a packet capture (pcap) file and save matching packets to a new file.

  MIT

  Destructive

• apply_profile_captureB

  NetMCPB

  Analyzes packet captures using a specified Wireshark profile and optional display filter to extract targeted network insights.

  MIT

• packet_summaryB

  wireshark-mcpB

  Summarize packets from a network capture as one-line entries, optionally narrowed by a Wireshark display filter.

  MIT

• expert_infoC

  wireshark-mcpB

  Retrieve Wireshark expert info to identify network issues like retransmissions, resets, malformed packets, and warnings from a capture file.

  MIT

• diagnostics_supported_featuresA

  Wireshark MCPC

  Summarizes local Wireshark dissection support by returning registry counts, helping diagnose available protocol dissectors.

  -

• diagnostics_check_installA

  Wireshark MCPC

  Reports installed Wireshark binaries and their versions to confirm proper setup for network capture and analysis.

  -

• registry_fieldsC

  Wireshark MCPC

  Need a specific display filter? Search the Wireshark field registry to find the exact protocol field identifier.

  -

• open_in_wiresharkC

  Wireshark MCPC

  Opens a network capture file in the Wireshark GUI for detailed packet analysis, with optional display filter and profile settings.

  -

• registry_output_formatsC

  Wireshark MCPC

  List available output formats for Wireshark capture tools, enabling selection of the correct format for saving or exporting packet data.

  -

• llm_protocol_summaryC

  Wireshark MCPC

  Summarize a network protocol from a capture file using curated fields or Wireshark registry discovery. Specify capture path and protocol to get a concise summary.

  -

• registry_protocolsC

  Wireshark MCPC

  Search the local Wireshark protocol registry to retrieve protocol details and identifiers for network analysis.

  -

• profile_analyzeC

  Wireshark MCPC

  Analyze a packet capture file using a specified Wireshark configuration profile to filter and inspect network traffic.

  -

• stats_expertC

  Wireshark MCPC

  Extract Wireshark expert information from a network capture file to identify protocol issues and anomalies.

  -

• wireshark_cliD

  Wireshark MCPC

  Execute allowlisted Wireshark CLI binaries to capture, analyze, or summarize network traffic from pcap files or live captures.

  -

• fetch_pcap_fileA

  wlanpi-mcpB

  Retrieve a stopped packet capture's pcapng file as a binary blob for analysis in Wireshark or tshark. Specify the capture ID or a path inside the managed capture directory to download the complete capture.

  BSD 3-Clause

• get-session-pcapA

  greynoise-mcp-serverA

  Download raw PCAP capture for a single GreyNoise sensor session. Returns file path for analysis with Wireshark or tcpdump.

  MIT