MCP Wireshark
未认领An MCP server that integrates Wireshark/tshark with AI tools and IDEs. Capture live traffic, parse .pcap files, apply display filters, follow streams, and export JSON - all via Claude Desktop, VS Code, or CLI. Cross‑platform, typed, tested, and pip‑installable.
安装
claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark工具（14 个）
analyze_iec61850
Health triage for GOOSE/SV/MMS captures: per-source OK/WARN/FAIL with sqNum/stNum gaps, TTL violations, smpCnt discontinuities, lost sync, and MMS errors
check_installation
Verify tshark is installed and show version
decode_protocol
Extract protocol fields as a TSV table. Curated defaults for HTTP, DNS, TLS, GOOSE, MMS, SV, SIP, ICMP; arbitrary fields for any other protocol
display_filter
Apply a Wireshark display filter to a pcap
expert_info
tshark expert analysis: warnings, errors, and notes grouped by severity
export_json
Export packets from a pcap to a JSON file at a path you choose
follow_tcp
Reassemble a TCP stream and return its payload
follow_udp
Reassemble a UDP stream and return its payload
list_interfaces
List network interfaces available to capture from
live_capture
Capture live traffic from an interface (capped at 5 minutes / 10k packets)
protocol_stats
Aggregate -z reports (protocol hierarchy, conversations, endpoints, HTTP/DNS/SMB stats)
read_pcap
Read packets from a .pcap / .pcapng file (preview + total count)
stats_by_proto
Protocol hierarchy statistics
summarize_pcap
High-level summary: I/O stats, protocol hierarchy, top talkers