mcp-wireshark

概述

mcp-wireshark 是一个生产就绪的 MCP 服务器，为 Claude Desktop、VS Code 和 CLI 提供直接访问网络数据包捕获和分析功能的能力。它提供了 10 个工具，分为读取操作（安全检查）和写入操作（捕获和导出），使 AI 助手能够总结 PCAP 文件、应用显示过滤器、跟踪 TCP/UDP 流、捕获实时流量并将数据导出为 JSON。该服务器跨平台、类型安全、经过测试且可通过 pip 安装，文档清晰且维护良好。

试试问 AI

装完之后，这里有 5 个你可以让 AI 做的事：

• check_installation

  Verify tshark is installed and show version

  试试:Run check_installation试试:Is tshark installed?
• list_interfaces

  List network interfaces available to capture from

  试试:List my network interfaces试试:What capture interfaces are available?
• read_pcap

  Read packets from a .pcap/.pcapng file

  试试:Read ./capture.pcap试试:Show me packets in traffic_analysis.pcapng
• display_filter

  Apply a Wireshark display filter to a pcap

  试试:Filter ./traffic.pcap for HTTP requests试试:Show only DNS packets in capture.pcap
• summarize_pcap

  Generate high-level summary of pcap including stats and top talkers

  试试:Summarize ./capture.pcap试试:What's in this traffic dump?
• stats_by_proto

  Get protocol hierarchy statistics from a pcap

  试试:Show protocol breakdown of ./traffic.pcap试试:Which protocols are most common in capture.pcap?
• follow_tcp

  Reassemble a TCP stream and return its payload

  试试:Follow TCP stream 0 in ./traffic.pcap试试:Show me the content of TCP stream 5
• follow_udp

  Reassemble a UDP stream and return its payload

  试试:Follow UDP stream 3 in capture.pcap试试:What's in UDP stream 2 from the file?
• live_capture

  Capture live traffic from an interface

  试试:Capture 30 seconds of traffic on Wi-Fi试试:Get 1000 packets from eth0
• export_json

  Export packets from a pcap to a JSON file

  试试:Export every DNS packet from ./traffic.pcap to dns.json试试:Save HTTP requests from capture.pcap as http.json

可对比工具

安装

pip install mcp-wireshark
claude mcp add --transport stdio --scope user mcp-wireshark -- mcp-wireshark

{
    "mcpServers": {
        "wireshark": {
            "command": "mcp-wireshark"
        }
    }
}

{
    "servers": {
        "wireshark": {
            "command": "mcp-wireshark"
        }
    }
}

FAQ

如何在 Windows 上安装 tshark？

从 https://www.wireshark.org/download.html 安装 Wireshark，并将 'C:\Program Files\Wireshark' 添加到系统 PATH。

在 Linux 上进行实时捕获需要什么权限？

使用 'sudo usermod -aG wireshark $USER' 将自己添加到 'wireshark' 组，然后注销并重新登录。

mcp-wireshark 对比