live_capture

MCP tool from MCP Wireshark by khuynh22

Capture live traffic from an interface (capped at 5 minutes / 10k packets)

How to use it

Project documentation lists live_capture for the MCP Wireshark MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.

Install MCP Wireshark

$claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark

FULL MCP WIRESHARK LISTING

Other tools in MCP Wireshark (13)

analyze_iec61850

Health triage for GOOSE/SV/MMS captures: per-source OK/WARN/FAIL with sqNum/stNum gaps, TTL violations, smpCnt discontinuities, lost sync, and MMS errors

check_installation

Verify tshark is installed and show version

decode_protocol

Extract protocol fields as a TSV table. Curated defaults for HTTP, DNS, TLS, GOOSE, MMS, SV, SIP, ICMP; arbitrary fields for any other protocol

display_filter

Apply a Wireshark display filter to a pcap

expert_info

tshark expert analysis: warnings, errors, and notes grouped by severity

export_json

Export packets from a pcap to a JSON file at a path you choose

follow_tcp

Reassemble a TCP stream and return its payload