display_filter

MCP tool from MCP Wireshark by khuynh22

Apply a Wireshark display filter to a pcap

How to use it

Project documentation lists display_filter for the MCP Wireshark MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install MCP Wireshark

$claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark
FULL MCP WIRESHARK LISTING

Other tools in MCP Wireshark (13)

analyze_iec61850

Health triage for GOOSE/SV/MMS captures: per-source OK/WARN/FAIL with sqNum/stNum gaps, TTL violations, smpCnt discontinuities, lost sync, and MMS errors

check_installation

Verify tshark is installed and show version

decode_protocol

Extract protocol fields as a TSV table. Curated defaults for HTTP, DNS, TLS, GOOSE, MMS, SV, SIP, ICMP; arbitrary fields for any other protocol

expert_info

tshark expert analysis: warnings, errors, and notes grouped by severity

export_json

Export packets from a pcap to a JSON file at a path you choose

follow_tcp

Reassemble a TCP stream and return its payload

follow_udp

Reassemble a UDP stream and return its payload

list_interfaces

List network interfaces available to capture from

live_capture

Capture live traffic from an interface (capped at 5 minutes / 10k packets)

protocol_stats

Aggregate -z reports (protocol hierarchy, conversations, endpoints, HTTP/DNS/SMB stats)

read_pcap

Read packets from a .pcap / .pcapng file (preview + total count)

stats_by_proto

Protocol hierarchy statistics

summarize_pcap

High-level summary: I/O stats, protocol hierarchy, top talkers