WireMCP는 대형 언어 모델(LLM)에 실시간 네트워크 트래픽 분석 기능을 제공하기 위해 설계된 모델 컨텍스트 프로토콜(MCP) 서버입니다. Wireshark의 tshark 위에 구축된 도구를 활용하여 실시간 네트워크 데이터를 캡처하고 처리하며, 위협 추적, 네트워크 진단, 이상 탐지 등 작업을 지원하는 구조화된 맥락을 LLM에 제공합니다.

특징

WireMCP는 MCP 클라이언트에 다음 도구들을 노출하여 네트워크 활동에 대한 LLM 이해를 향상시킵니다:

• capture_packets: 실시간 트래픽을 캡처하고 원시 패킷 데이터를 JSON 형식으로 반환하여 LLM이 패킷 수준 세부사항(예: IP 주소, 포트, HTTP 메서드)을 분석할 수 있게 합니다.
• get_summary_stats: 프로토콜 계층 통계를 제공하여 LLM에 트래픽 구성(예: TCP vs. UDP 사용)에 대한 개요를 제공합니다.
• get_conversations: TCP/UDP 대화 통계를 제공하여 LLM이 엔드포인트 간 통신 흐름을 추적할 수 있게 합니다.
• check_threats: IP를 캡처하여 URLhaus 블랙리스트와 대조하여 LLM에 위협 인텔리전스 맥락을 제공하여 악의적 활동을 식별합니다.

WireMCP

WireMCP is a Model Context Protocol (MCP) server designed to empower Large Language Models (LLMs) with real-time network traffic analysis capabilities. By leveraging tools built on top of Wireshark’s tshark, WireMCP captures and processes live network data, providing LLMs with structured context to assist in tasks like threat hunting, network diagnostics, and anomaly detection.

Features

WireMCP exposes the following tools to MCP clients, enhancing LLM understanding of network activity:

• capture_packets: Captures live traffic and returns raw packet data as JSON, enabling LLMs to analyze packet-level details (e.g., IP addresses, ports, HTTP methods).
• get_summary_stats: Provides protocol hierarchy statistics, giving LLMs an overview of traffic composition (e.g., TCP vs. UDP usage).
• get_conversations: Delivers TCP/UDP conversation statistics, allowing LLMs to track communication flows between endpoints.
• check_threats: Captures IPs and checks them against the URLhaus blacklist, equipping LLMs with threat intelligence context for identifying malicious activity.
• check_ip_threats: Performs targeted threat intelligence lookups for specific IP addresses against multiple threat feeds, providing detailed reputation and threat data.
• analyze_pcap: Analyzes PCAP files to provide comprehensive packet data in JSON format, enabling detailed post-capture analysis of network traffic.
• extract_credentials: Scans PCAP files for potential credentials from various protocols (HTTP Basic Auth, FTP, Telnet), aiding in security audits and forensic analysis.

How It Helps LLMs

WireMCP bridges the gap between raw network data and LLM comprehension by:

• Contextualizing Traffic: Converts live packet captures into structured outputs (JSON, stats) that LLMs can parse and reason about.
• Threat Detection: Integrates IOCs (currently URLhaus) to flag suspicious IPs, enhancing LLM-driven security analysis.
• Diagnostics: Offers detailed traffic insights, enabling LLMs to assist with troubleshooting or identifying anomalies.
• Narrative Generation: LLM’s can Transform complex packet captures into coherent stories, making network analysis accessible to non-technical users.

Installation

Prerequisites

• Mac / Windows / Linux
• Wireshark (with tshark installed and accessible in PATH)
• Node.js (v16+ recommended)
• npm (for dependency installation)

Setup

1. Clone the repository:

   git clone https://github.com/0xkoda/WireMCP.git
   cd WireMCP
   

2. Install dependencies:

   npm install
   

3. Run the MCP server:

   node index.js
   

Note: Ensure tshark is in your PATH. WireMCP will auto-detect it or fall back to common install locations (e.g., /Applications/Wireshark.app/Contents/MacOS/tshark on macOS).

Usage with MCP Clients