Introduction¶

When performing network traffic analysis on models, the common approach is to let the model read pcap files on its own, or to write scripts first and then call external tools. The former cannot read the binary packet capture format, while the latter requires maintaining an additional set of scripts. The dsh-wireshark-mcp introduced below connects the upstream Wireshark-MCP server to DSH, allowing the model to directly access the mcp__wireshark__* group of tools, which can be used to call tshark for packet capture analysis within a session.

It is a third-party maintained workflow plugin, maintained by extreme-russian-dsh-fandom, and is not an official component of DeepSeek / Shangfang.

What is it¶

One-sentence positioning: dsh-wireshark-mcp is an adapter (bundle) for DeepSeek Harness, integrating the upstream MCP server Wireshark-MCP into DSH.

It is worth noting that it is not a fork of Wireshark-MCP, and the code does not contain any upstream source code. The entire plugin consists of only one cordis.patch.yml, which uses the official installation command to pull the upstream server from PyPI; therefore, the tool group the model receives changes with the upstream version. The plugin itself is only responsible for wiring and documentation, the license is MIT, and the upstream is also MIT.

The problem it solves is: DSH models originally lacked packet capture analysis capabilities. After installation, the model can read pcap/pcapng, output protocol layers, perform aggregate statistics, follow streams, and check for anomalous traffic.

Core Features¶

The plugin does not implement analysis directly; the analysis capabilities come from the upstream Wireshark-MCP, exposed to the model through its declared 42 tools. After installation, the visible tool names for the model look like:

mcp__wireshark__open_file
mcp__wireshark__quick_analysis
mcp__wireshark__aggregate
mcp__wireshark__follow_stream
mcp__wireshark__detect_dns_tunnel

As described in the README, the analysis profile covers these capabilities: packet capture list / details / bytes / streams, field and object extraction, aggregate statistics, protocol layers, endpoints and sessions, I/O graphs, expert info, credential scanning, port scanning, DNS tunneling, DoS, beaconing, data exfiltration, protocol anomalies, YARA, analyze_protocol (25 protocols), TCP health, ARP spoofing, decryption and dissecting rewrites, TLS fingerprints, GeoIP, and case files.

The plugin provides three profiles. The goal is not functional differences but cost differences—the tool list is sent with each request, so a smaller profile has lower prompt overhead:

Environment variables are read from cordis.patch.yml:

Installation & Enablement¶

The official installation command is as follows. Prefer the GitHub source; future changes will be made here:

dsh plugin --profile desktop add "github:extreme-russian-dsh-fandom/dsh-wireshark-mcp#master"

Repository address: https://github.com/extreme-russian-dsh-fandom/dsh-wireshark-mcp

There is also a GitLab legacy source. The README notes that the code is currently identical at both locations, but the GitLab side is no longer updated and may be outdated; therefore, when listed together, the GitHub specification takes precedence:

dsh plugin --profile desktop add "gitlab:andrey23525/deepseek-wireshark-mcp#master"

When there is no CLI, you can install either specification on the Plugins page of Harness Web. After installation, restart Harness, and the model can see the mcp__wireshark__* tools.

Preparation required before installation:

1. Install Wireshark. Each analysis tool shells out to tshark; on Windows, the bundle adds %ProgramFiles%\Wireshark to the PATH of child processes because the installer often does not configure this.
2. Install uv (uvx must be in PATH). If uvx is installed elsewhere, override it using WIRESHARK_MCP_COMMAND.
3. The first startup requires a network connection; uvx will pull wireshark-mcp from PyPI once, and then reuse the cache.

Optional Wireshark suite binaries enable extra tools when present: capinfos, mergecap, editcap, dumpcap, text2pcap.

To uninstall, remove it from the Plugins page or run:

dsh plugin --profile desktop remove dsh-wireshark-mcp

There is no other disk content other than the uvx cache.

During development and debugging, you can directly install the checkout directory, for example C:\Work\dsh-wireshark-mcp. Installing a local directory is a link relationship; just modify it and trigger the bundle to re-enable. Installing the git specification involves copying a copy; changes must be pushed before reinstalling.

Typical Usage¶

The README provides two reproducible examples:

Analyze C:\captures\capture.pcap: call mcp__wireshark__open_file, then mcp__wireshark__quick_analysis.
Index big.pcapng with mcp__wireshark__index, then count destinations with mcp__wireshark__aggregate.

The first example is to open a packet capture file first, then perform a quick analysis. The second example is to index a large file first, then use aggregate tools to count destination addresses.

Switching profiles does not require changing YAML. After changing environment variables, restart Harness (the server process is generated only once at startup):

$env:WIRESHARK_MCP_PROFILE = 'full'
$env:WIRESHARK_MCP_ALLOWED_DIRS = 'C:\captures'

If precise control of the startup command is needed, you can override the same line in the profile’s cordis.patch.yml. The id remains the same, and the latter overrides the former:

- insert:
    - id: wireshark-mcp
      name: '@deepseek-ai/dsh-mcp-client'
      config:
        serverName: wireshark
        transport: stdio
        command: 'C:\Users\<you>\AppData\Local\Programs\Python\Python312\Scripts\uvx.exe'
        args: ['--from', 'wireshark-mcp', 'wireshark-mcp', 'serve', '--profile', 'full']
        env:
          WIRESHARK_MCP_ALLOWED_DIRS: 'C:\captures'
        toolCallTimeoutMs: 300000

The MCP client cleans environment variable names matching KEY|PASSWORD|SECRET|TOKEN as well as all DSH_* names; therefore, parameters required by the server must be passed explicitly.

Verification build: probe/ directory contains check scripts used to build this bundle, and are not published with the plugin:

python probe/make_pcap.py probe/sample.pcap   # 2 DNS queries + 1 TCP SYN
node probe/mcp-probe.mjs                     # raw stdio handshake, expects 54 tools on full
node probe/mcp-probe-full.mjs                # full profile with the empty allowlist

In a Harness session, mcp__wireshark__get_capabilities should report tshark.available: true, and calling mcp__wireshark__quick_analysis on probe/sample.pcap should return protocol layers.

Suitable Scenarios & Notes¶

Suitable for DSH users who need models to directly analyze network packet captures: tasks like security troubleshooting, protocol anomaly confirmation, and traffic aggregate statistics are more convenient than letting the model write scripts to call tshark every time. Network packet capture analysis involves reading file contents; although the model receives read-only tools, it still involves a stage where sensitive data is accessed.

Note three points:

1. The plugin runs with the current DSH process permissions. After enabling the full profile, the server can execute dumpcap with host user permissions; file writing tools are constrained by the WIRESHARK_MCP_ALLOWED_DIRS whitelist; an empty default value means failure and closure.
2. Analysis tools are read-only packet captures; the default profile does not include real-time packet capture and file writing; the server uses local stdio and does not open ports.
3. Check source code and license before installation. This plugin is MIT, only for wiring and documentation; upstream is bx33661/Wireshark-MCP, also MIT.

This plugin is a community-maintained third-party workflow plugin. The directory page is on skillhub.cn, with no official affiliation to DeepSeek / Shangfang.

Conclusion¶

The value of dsh-wireshark-mcp lies in moving Wireshark packet capture analysis into DSH’s tool table, allowing the model to complete analysis using the ready-made mcp__wireshark__* tools without extra scripts. This plugin is currently in adapter form, and analysis capabilities depend on the upstream version; pay attention to profile selection and environment variable configuration when using.

• Directory page: https://www.skillhub.cn/plugins/extreme-russian-dsh-fandom/dsh-wireshark-mcp
• GitHub: https://github.com/extreme-russian-dsh-fandom/dsh-wireshark-mcp