io.github.bx33661/wireshark-mcp MCP Server

The Wireshark MCP server wraps tshark and optional Wireshark suite tools into a structured analysis interface for AI assistants. It enables natural-language network packet analysis, threat detection, and security audits on .pcap files through 40+ specialized tools.

This server gives Claude, Cursor, and other MCP clients the ability to analyze network traffic using tshark. Drop a .pcap file and ask questions in plain English—the server extracts DNS queries, HTTP requests, TLS handshakes, detects threats, performs security audits, and generates detailed reports. Ideal for security professionals, network engineers, and incident responders who want AI-assisted packet analysis.

• wireshark_open_file — Open and initialize a .pcap file for analysis
• wireshark_security_audit — Run a comprehensive security audit on the capture
• wireshark_quick_analysis — Perform a quick overview analysis of the capture
• wireshark_extract_dns_queries — Extract and analyze DNS queries from the capture
• wireshark_extract_http_requests — Extract HTTP requests and responses
• wireshark_extract_tls_handshakes — Extract TLS/SSL handshake data
• wireshark_check_threats — Check for known threats and suspicious indicators
• wireshark_credential_scan — Scan for exposed credentials in traffic
• wireshark_port_scan_detection — Detect port scanning activity
• wireshark_dns_tunnel_detection — Detect DNS tunneling attempts
• wireshark_dos_detection — Detect denial-of-service patterns
• wireshark_protocol_hierarchy — Generate protocol hierarchy statistics
• wireshark_endpoints — List and analyze network endpoints
• wireshark_conversations — Analyze conversations between hosts
• wireshark_io_graph — Generate I/O graph statistics
• wireshark_expert_info — Extract expert analysis and warnings
• wireshark_tcp_health — Analyze TCP connection health
• wireshark_arp_spoofing_detection — Detect ARP spoofing attempts
• wireshark_packet_list — Retrieve packet list from capture
• wireshark_packet_details — Get detailed information about a specific packet

• Perform security audits on network captures to identify threats, exposed credentials, and suspicious activity
• Extract and analyze DNS queries, HTTP requests, and TLS handshakes for investigation
• Detect port scans, DoS attacks, DNS tunneling, and ARP spoofing in network traffic
• Generate detailed statistics and protocol analysis reports from .pcap files
• Investigate live network traffic or merge and filter multiple capture files for deeper analysis