wireshark-mcp: Instructions file for Claude Code

Wireshark MCP

Network analysis tool via tshark. Portable -- any host with tshark installed.

Quick Start

{
  "mcpServers": {
    "wireshark": {
      "command": "python",
      "args": ["D:\\MCP_servers\\wireshark-mcp\\wireshark_mcp.py"],
      "env": {}
    }
  }
}

Tools (20 total)

Discrete (15)

• wireshark_list_interfaces -- available capture interfaces
• wireshark_check_permissions -- can we capture?
• wireshark_capture -- live capture to pcapng
• wireshark_list_captures -- saved capture files
• wireshark_protocol_hierarchy -- protocol distribution tree
• wireshark_conversations -- who's talking to whom (top N)
• wireshark_endpoints -- unique endpoints with byte counts
• wireshark_dns_analysis -- DNS query/response stats
• wireshark_io_stats -- traffic volume over time
• wireshark_http_analysis -- HTTP methods and response codes
• wireshark_expert_info -- Wireshark warnings/errors
• wireshark_extract_fields -- custom field extraction
• wireshark_packet_list -- first N packets summary
• wireshark_resolve_oui -- MAC address vendor lookup
• wireshark_version -- tshark version info

Workflows (5)

• wireshark_recon -- full network recon (protocols + talkers + devices + DNS)
• wireshark_identify_devices -- device discovery with OUI + hostname + port heuristics
• wireshark_traffic_profile -- profile a single IP's activity
• wireshark_security_audit -- find cleartext creds, anomalies, threat intel
• wireshark_compare_captures -- diff two captures

Config

Set via environment variables with WIRESHARK_ prefix:

• WIRESHARK_TSHARK_PATH -- explicit tshark location
• WIRESHARK_CAPTURE_DIR -- where to save captures
• WIRESHARK_DEFAULT_DURATION -- capture duration (seconds)
• WIRESHARK_DEFAULT_TOP_N -- default limit for ranked results

Token Optimization

All tools return structured JSON, never raw tshark text. Default outputs are aggregated summaries capped at ~4000 tokens. Use detail parameters or wireshark_extract_fields for targeted deep dives.