TShark2MCP

You can run an MCP server that leverages TShark2MCP to perform AI-assisted analysis of network traffic. This server exposes a set of standardized messages your MCP client can call to extract, filter, and summarize pcap data, helping you quickly identify unusual network activity.

How to use

You connect to the TShark2MCP server with an MCP client and invoke the available analysis tools to process pcap data. The server exposes six core capabilities: provide an overview of a pcap file, extract network sessions, filter by time range, filter by protocol type, analyze a specific network flow, and compute statistics. Use each tool to guide your investigation, combine results for deeper insights, and iterate on filters to narrow down anomalies.

To accomplish common tasks, you typically do the following: load a pcap file into the tool, apply a time window to focus on a particular period, apply protocol filters to isolate traffic (for example, TCP or UDP), and then request session-level or flow-level details. The statistics tool helps you quantify traffic characteristics such as counts, durations, or packet rates. These steps help you locate and analyze any abnormal or suspicious communication patterns.

How to install

Prerequisites you need before installing and running the server:

• Python 3.8+

• Wireshark/TShark 4.0+

1. Install Wireshark

• Windows: Download and install Wireshark. Ensure TShark is added to your system PATH, or note the installation path.

2. Install Python dependencies

pip install -r requirements.txt

Start the MCP server

Run the server entry point with Python.

python main.py

Configuration example

Configure your MCP client to point to this server using the provided entry with the exact environment and path details below.

{
  "mcpServers": {
    "tshark2mcp": {
      "command": "python",
      "args": [
        "D:\\niusulong\\wireshark_mcp\\TShark2MCP\\main.py"
      ],
      "env": {
        "PYTHONPATH": "D:\\niusulong\\wireshark_mcp\\TShark2MCP\\src",
        "TSHARK_PATH": "C:\\Program Files\\Wireshark\\tshark.exe"
      }
    }
  }
}

Available tools

pcapOverview

Provide a quick overview of a pcap file, including basic metadata such as capture duration, packet count, and file size to orient your analysis.

sessionExtraction

Extract network sessions from the pcap, grouping traffic by 5-tuple or flow semantics to show conversations and their endpoints.

timeRangeFilter

Filter traffic by a specific time window to focus on events of interest within the capture.

protocolFilter

Filter results by protocol type (e.g., TCP, UDP, ICMP) to narrow down relevant communication.

specificFlowAnalysis

Analyze a particular network flow or 5-tuple (source IP, source port, destination IP, destination port, protocol) for detailed metrics.

statisticsMetrics

Compute statistical metrics such as packet counts, byte totals, durations, and flow rates to quantify traffic characteristics.