MCP Wireshark

Prerequisites

• Python 3.10+
• Wireshark installed; tshark reachable on PATH

Install with pip or uv:

```bash pip install mcp-wireshark

Verify the install

claude mcp list

You should see mcp-wireshark listed. Inside Claude Code, ask:

"Run check_installation."

If tshark is on your PATH, it returns the version. If not, see troubleshooting.

---

Quick start with Claude Code

pip install mcp-wireshark
claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark

That's it. Open Claude Code and try:

"Summarize ./capture.pcap and tell me which IPs talked the most."

--scope user makes the server available across every Claude Code project. Drop the flag to install it for the current project only. See claude mcp docs for more.

Example prompts

Drop these into Claude Code as-is:

List my network interfaces.
Summarize ./traffic.pcap.
From ./traffic.pcap, show me only HTTP requests.
Follow TCP stream 0 in ./traffic.pcap and tell me what protocol is in it.
Capture 30 seconds of traffic on Wi-Fi filtered to tcp.port == 443.
Export every DNS packet from ./traffic.pcap to ./dns.json.
Decode the GOOSE messages in ./substation.pcapng — only stNum >= 1.
Run expert analysis on ./traffic.pcap and group findings by severity.
Show me the IP conversations in ./traffic.pcap.

Troubleshooting

<details> <summary><b>tshark not found on Windows</b></summary>

Add Wireshark to your system PATH:

1. Press Win+R → run sysdm.cpl → Advanced → Environment Variables
2. Edit Path → add C:\Program Files\Wireshark
3. Restart your terminal and Claude Code, then re-run check_installation

(Avoid passing PATH through claude mcp add --env — values are taken literally, no %PATH% expansion.)

</details>

<details> <summary><b>Permission denied capturing on Linux</b></summary>

Add yourself to the wireshark group, then log out and back in:

sudo usermod -aG wireshark $USER

</details>

<details> <summary><b>"No packets captured" from live_capture</b></summary>

- Confirm the interface name from list_interfaces (Wireshark uses different names than ifconfig/ip) - On macOS, you may need to install ChmodBPF (ships with the Wireshark .dmg) - Check that no display filter is excluding everything </details>

---