SharkMCP - A swiss-knife MCP server for analysing PCAP files

项目说明

SharkMCP

An MCP server that exposes sharkd — Wireshark's programmatic interface — as a set of tools for LLMs. Load PCAP/PCAPNG files and analyse them with natural language.

Requirements

Python 3.10+

Wireshark (provides sharkd)

Installation

Or run directly from the repo without installing:

Configuration

Add to your .mcp.json:

| Env var | Default | Description |
|---------|---------|-------------|
| SHARKMCP_SHARKD_BIN | sharkd | Path to sharkd binary |
| SHARKMCP_TIMEOUT | 300 | Per-request timeout in seconds |

Tools

Each loaded PCAP gets a dedicated sharkd subprocess. Results from expensi (con, expert info, export objects) are cached in memory so paginated follow-up calls are ser re-scanning.

Session

| Tool | Description |
|------|-------------|
| load_pcap(path, alias?) | Load a PCAP/PCAPNG file |
| list_pcaps() | List all loaded PCAPs |
| unload_pcap(alias) | Terminate session and free memory |

O

| Tool | Description |
|------|-------------|
| pcap_summary(alias) | Frame count, duration, file size, protocols seen |
| ser(alias) | All a tap types, follow protocols, field types |

Packet Inspection

| Tool | Description |
|------|-------------|
| list_packets(alias, filter?, columns?, refs?) | Paginated frame list with display filter |
| packet_detail(alias, frame, include_bytes?, include_hidden?) | Full protocol tree for one frame |
| extract_fields(alias, fields, filter?) | Extract arbitrary fields per packet as a table |

Utilities

| Tool | Description |
|------|-------------|
| (alias, filter?, field?) | a display filter and/or field name |
| complete(alias, field?, pref?) | Autocomplete field or preference names by prefix |
| get_preference(alias, preference?) | Read dissector preferences |
| set_preference(alias, name, value) | Set a dissector preference for this session |
| set_frame_comment(alias, frame, comment) | Annotate a frame (session-scoped) |

Traffic Structure

| Tool | Description |
|------|-------------|
| protocol_hierarchy(alias, filter?) | Nested protocol tree with frame/byte counts |
| io_stats(alias, inter?, filter?) | Per-inter and byte counts |
| iograph(alias, graphs, inter?, filters?) | Multi-line traffic graph; supports packets, bytes, bits, sum:<field>, avg:<field>, min:<field>, max:<field>, load:<field>, frames:<field> |
| follow_stream(alias, protocol, filter) | Reassemble a stream (tcp, udp, tls, http, http2, quic, sip, dccp, websocket) |

Con & Topology

| Tool | Description |
|------|-------------|
| con(alias, type?, sort_by?) | Con table — bytes/frames per peer pair |
| endpoints(alias, type?, sort_by?) | Endpoint table — tx/rx per host |

Supported layer types for both: tcp, udp, ip, ipv6, eth, sctp, dccp, mptcp, wifi, bluetooth, zigbee, fc, fddi, usb, and more.

Protocol Statistics

| Tool | Description |
|------|-------------|
| expert_info(alias, filter?) | Per-frame anomaly detection — errors, warnings, notes, chats |
| protocol_stats(alias, protocol) | Aggregate stats for dns, http, http_requests, http_server, sip, dhcp, h225, http2, rtsp |
| ser(alias, protocol) | Request/response latency for smb, smb2, snmp, ldap, diameter, rpc, gtp, and more |
| response_time_delay(alias, protocol) | Round-trip delay for radius, h225_ras, megaco, mgcp |
| sequence_diagram(alias, type?) | Flow diagram data for tcp, icmp, icmpv6, any |

Media & VoIP

| Tool | Description |
|------|-------------|
| (alias, filter?) | SIP/H.323 call list with state and participants |
| rtp_streams(alias, stream_spec?) | RTP stream in; pass stream_spec for per-stream jitter/loss |
| multicast_streams(alias, filter?) | UDP multicast stream statistics |

Export & Objects

| Tool | Description |
|------|-------------|
| export_objects(alias, type?) | List extractable objects (http, imf, smb, tftp, dicom, ftp-data) |
| download_object(alias, token) | Download an object, TLS session keys (ssl-secrets), or RTP audio (rtp:<spec>) as base64 |

Escape Hatch

| Tool | Description |
|------|-------------|
| tap(alias, specs, filter?, skip?, limit?) | Run any sharkd tap directly — up to 16 specs in one PCAP scan. Use ser to disco identifiers. |

Example

Architecture

One sharkd subprocess per loaded PCAP. Sessions are isolated — concurrent queries on different aliases ne each other.

项目信息

开发语言：Python

Star 数：75

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A swiss-knife MCP server for analysing PCAP files展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。