网络分析工具包

# Linux (Ubuntu/Debian)
sudo apt-get install wireshark tshark tcpdump python3-pip

# macOS  
brew install wireshark tcpdump python3

# Windows
choco install wireshark python3

git clone https://github.com/priestlypython/wireshark-mcp.git
cd wireshark-mcp
pip install -r requirements.txt

# Configure permissions (Linux)
sudo usermod -a -G wireshark $USER
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
newgrp wireshark

{
  "mcpServers": {
    "wireshark-mcp": {
      "command": "python",
      "args": ["/path/to/wireshark-mcp/enhanced_server.py"],
      "cwd": "/path/to/wireshark-mcp",
      "env": {
        "PYTHONPATH": "/path/to/wireshark-mcp",
        "WIRESHARK_PATH": "/usr/bin",
        "TSHARK_PATH": "/usr/bin/tshark",
        "TCPDUMP_PATH": "/usr/sbin/tcpdump"
      }
    }
  }
}

# Check system capabilities
wireshark_system_info(info_type="all")
# → Returns interfaces, capabilities, server status

# Capture HTTP traffic for 30 seconds
wireshark_live_capture(
    interface="eth0", 
    duration=30, 
    filter="tcp port 80",
    max_packets=1000
)
# → Returns captured packets with analysis

# Comprehensive PCAP analysis
wireshark_analyze_pcap(
    filepath="/path/to/capture.pcap",
    analysis_type="comprehensive" 
)
# → File info, protocols, security analysis

# Generate filter from natural language
wireshark_generate_filter(
    description="Show all HTTP traffic from 192.168.1.0/24",
    complexity="intermediate"
)
# → Returns optimized Wireshark filter

# Split large PCAP by time
wireshark_pcap_time_slice(
    input_file="/path/to/large.pcap",
    start_time="2025-01-01T10:00:00",
    end_time="2025-01-01T11:00:00"
)
# → Creates time-sliced PCAP file

# Merge multiple PCAPs
wireshark_pcap_merger(
    input_files=["file1.pcap", "file2.pcap"],
    output_file="merged.pcap",
    sort_chronologically=true
)
# → Creates chronologically sorted merged file

# Threat detection
wireshark_threat_detector(
    input_file="/path/to/suspicious.pcap",
    detection_mode="comprehensive",
    sensitivity="high"
)
# → Threat scores, anomalies, behavioral analysis

# DNS tunneling detection
wireshark_dns_analyzer(
    input_file="/path/to/capture.pcap",
    analysis_type="comprehensive",
    detect_tunneling=true
)
# → DNS patterns, suspicious domains, entropy analysis

# Linux: Set capabilities
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
sudo usermod -a -G wireshark $USER

# macOS: Run Wireshark as admin once
sudo /Applications/Wireshark.app/Contents/MacOS/Wireshark

# Windows: Run as Administrator