Packet Analysis Skill

Packet Analysis Skill

MCP Server

• Script: $PACKET_BUDDY_MCP_SCRIPT
• Invocation: python3 $MCP_CALL "python3 -u $PACKET_BUDDY_MCP_SCRIPT" <tool_name> '<json_args>'

Available Tools

Discovery

• list_pcaps — List all pcap files available for analysis
• pcap_summary — High-level stats: packet count, duration, capture size

Traffic Analysis

• pcap_protocol_hierarchy — Protocol breakdown (what % is TCP, UDP, DNS, etc.)
• pcap_conversations — Who talked to whom (IP, TCP, UDP, or Ethernet layer)
• pcap_endpoints — Top talkers by traffic volume

Filtering & Inspection

• pcap_filter — Apply Wireshark display filters (e.g. tcp.port==80, icmp, bgp)
• pcap_packet_detail — Full decode of a specific packet by number
• pcap_to_json — Export packets as JSON for detailed analysis
• pcap_expert_info — Warnings, errors, retransmissions, anomalies

Protocol-Specific

• pcap_dns_queries — Extract all DNS queries and responses
• pcap_http_requests — Extract HTTP methods, URIs, and hosts

File Management

• save_pcap_from_base64 — Save a base64-encoded pcap (e.g. from Slack file upload)

Workflow: Slack pcap Upload

When a user uploads a .pcap or .pcapng file in Slack:

1. The file arrives as a Slack file attachment
2. Download the file content and save it using save_pcap_from_base64
3. Run pcap_summary to give an overview
4. Ask the user what they want to investigate
5. Use appropriate tools to drill down

Workflow: Troubleshooting