live_capture

MCP tool from MCP Wireshark by khuynh22

Capture live traffic from an interface (capped at 5 minutes / 10k packets)

How to use it

live_capture is exposed by the MCP Wireshark MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the live_capture tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.

Install MCP Wireshark

$claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark

FULL MCP WIRESHARK LISTING

Other tools in MCP Wireshark (13)

analyze_iec61850

Health triage for GOOSE/SV/MMS captures: per-source OK/WARN/FAIL with sqNum/stNum gaps, TTL violations, smpCnt discontinuities, lost sync, and MMS errors

check_installation

Verify tshark is installed and show version

decode_protocol

Extract protocol fields as a TSV table. Curated defaults for HTTP, DNS, TLS, GOOSE, MMS, SV, SIP, ICMP; arbitrary fields for any other protocol

display_filter

Apply a Wireshark display filter to a pcap

expert_info

tshark expert analysis: warnings, errors, and notes grouped by severity

export_json

Export packets from a pcap to a JSON file at a path you choose

follow_tcp

Reassemble a TCP stream and return its payload