一款用于将Wireshark网络分析功能与Claude等AI系统集成的模型上下文协议（MCP）服务器。该实现实现实现了与Claude的直接集成，无需手动复制粘贴提示。

什么是Wireshark MCP？

Wireshark MCP 为 AI 助手提供了一种标准化的方式，通过 Wireshark 访问和分析网络数据包数据。它通过实现模型上下文协议，弥合了低层网络数据与高级 AI 理解之间的鸿沟。

服务器提供以下工具：

1. 捕获实时网络流量
2. 分析现有的pcap文件
3. 提取协议特定信息
4. 网络流的总结

快速启动

安装

运行MCP服务器

配置 Claude 桌面

要配置 Claude Desktop 以使用 Wireshark MCP 服务器：

1. 打开 Claude 桌面
2. 进入设置>开发者>编辑配置
3. 添加以下构型：

将/path/to/wireshark-mcp替换为实际访问仓库的路径。

可用工具

Wireshark MCP 服务器提供以下工具：

• capture_live_traffic：使用 tshark 捕获实时网络流量

Wireshark MCP (Model Context Protocol)

A Model Context Protocol (MCP) server for integrating Wireshark network analysis capabilities with AI systems like Claude. This implementation provides direct integration with Claude without requiring manual copy/paste of prompts.

What is Wireshark MCP?

Wireshark MCP provides a standardized way for AI assistants to access and analyze network packet data through Wireshark. It bridges the gap between low-level network data and high-level AI understanding by implementing the Model Context Protocol.

The server provides tools for:

1. Capturing live network traffic
2. Analyzing existing pcap files
3. Extracting protocol-specific information
4. Summarizing network flows

Quick Start

Installation

# Clone the repository 
git clone https://github.com/sarthaksiddha/Wireshark-mcp.git 
cd Wireshark-mcp

# Install dependencies
pip install -e .

Running the MCP Server

# Run with stdio transport (for Claude Desktop)
python mcp_server.py --stdio

# Run with SSE transport (for other MCP clients)
python mcp_server.py --host 127.0.0.1 --port 5000

Configuring Claude Desktop

To configure Claude Desktop to use the Wireshark MCP server:

1. Open Claude Desktop
2. Go to Settings > Developer > Edit Config
3. Add the following configuration:

{
  "mcpServers": {
    "wireshark": {
      "command": "python",
      "args": [
        "/path/to/wireshark-mcp/mcp_server.py",
        "--stdio"
      ]
    }
  }
}

Replace /path/to/wireshark-mcp with the actual path to your repository.

Available Tools

The Wireshark MCP server provides the following tools:

• capture_live_traffic: Capture live network traffic using tshark
• analyze_pcap: Analyze an existing pcap file
• get_protocol_list: Get a list of supported protocols

Example Usage in Claude

Once configured, you can use the Wireshark MCP server in Claude with queries like:

• “Capture 30 seconds of network traffic on my system and show me what’s happening”
• “Analyze my network.pcap file and tell me if there are any suspicious activities”
• “What protocols can I focus on when analyzing network traffic?”

Key Features

• Packet Summarization: Convert large pcap files into token-optimized summaries
• Protocol Intelligence: Enhanced context for common protocols (HTTP, DNS, TLS, SMTP, etc.)
• Flow Tracking: Group related packets into conversation flows
• Anomaly Highlighting: Emphasize unusual or suspicious patterns
• Query Templates: Pre-built prompts for common network analysis tasks