Pcapport

io.github.CloudCorpRecords由 GitHub 帳號 CloudCorpRecords 發布v0.1.0更新於 Nov 3, 2026

PCAP分析：從擷取檔案中分析DNS、DHCP、ICMP、TCP流、異常和SIP。

AI 翻譯由 AI 模型根據下方的原文描述翻譯，可能有誤。

原文描述

PCAP analysis: DNS, DHCP, ICMP, TCP flows, anomalies, and SIP from capture files.

已驗證STDIO僅桌面

概覽

Pcapport 的本機 MCP 服務；無需登入；STDIO。

暫無 AI 概覽：以下資訊來自註冊中心條目和服務本身。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Pcapport，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

pcapport

pcapport analyses PCAP capture files entirely on your own machine. Point it at a classic libpcap file and it summarises what is inside: DNS questions and response codes, DHCP message types and the servers and clients involved, ICMP traffic, TCP connections with state estimates, TCP anomalies and retransmissions, traffic flow to and from one server, SIP calls, and basic capture information such as packet count, duration, and encapsulation.

There is no network access, no API key, and no live capture: the tool only reads the capture file you name. The parser is an original minimal implementation covering Ethernet (including a single VLAN tag) and raw-IP captures carrying IPv4, with TCP, UDP, and ICMP decoded, and DNS, DHCP, and SIP payloads understood.

Install

bash
npx @reneturcios/pcapport analyze_capinfos '{"pcap_file":"capture.pcap"}'

Or run the container image:

bash
docker run -i ghcr.io/cloudcorprecords/pcapport

The container defaults to the MCP server. Pass CLI arguments to use it as a CLI instead.

CLI

The CLI mirrors the tools: one subcommand per tool, taking its arguments as a single JSON object.

bash
pcapport analyze_capinfos '{"pcap_file":"capture.pcap"}'pcapport analyze_dns_packets '{"pcap_file":"capture.pcap"}'pcapport analyze_tcp_connections '{"pcap_file":"capture.pcap","detailed":true}'pcapport analyze_tcp_retransmissions '{"pcap_file":"capture.pcap","threshold":0.05}'pcapport analyze_traffic_flow '{"pcap_file":"capture.pcap","server_ip":"10.0.0.5","server_port":80}'pcapport --version

Exit codes: 0 on success, 1 on an error (the error names the problem, e.g. a bad PCAP magic or a truncated file), 2 for usage errors. An empty capture is not an error: tools return zeroed summaries for it.

MCP server

One bin serves both faces. The mcp subcommand starts a stdio MCP server:

bash
npx -y @reneturcios/pcapport mcp

MCP client configuration:

json
{  "mcpServers": {    "pcapport": {      "command": "npx",      "args": ["-y", "@reneturcios/pcapport", "mcp"]    }  }}

Tools

ToolInputWhat it does
analyze_dns_packetspcap_file (required)DNS query/response counts, top questions (aggregated, top 20), and a response-code summary.
analyze_dhcp_packetspcap_file (required)DHCP packet count by message type (discover, offer, request, ack, ...), server IPs, and client MACs.
analyze_icmp_packetspcap_file (required)ICMP counts by type, echo requests/replies, unreachable count, and top talkers.
analyze_tcp_connectionspcap_file (required), server_ip, server_port, detailedConnections keyed by the normalised 4-tuple with client/server, packets, bytes, SYN/FIN/RST counts, and a state estimate (established, closed, reset, half-open). With detailed, a per-connection timestamp summary is included.
analyze_tcp_anomaliespcap_file (required), server_ip, server_portCounts of reset connections, half-open connections (SYN with no SYN-ACK), connections without data, and zero-window advertisements, computed from flags and window fields.
analyze_tcp_retransmissionspcap_file (required), server_ip, threshold (default 0.02)A retransmission is a repeated (tuple, sequence, payload-length) data segment. Reports data segments, retransmissions, the rate, whether it exceeds the threshold, and the top offending connections.
analyze_traffic_flowpcap_file (required), server_ip (required), server_portPackets and bytes to and from the server, the unique client count, and the top clients by bytes.
analyze_sip_packetspcap_file (required)SIP requests by method, responses by status class, and calls (Call-ID, From, To). Payloads on port 5060 plus any payload starting with a SIP method or SIP/2.0 are considered.
analyze_capinfospcap_file (required)Packet count, duration, data bytes, average packet size, first/last packet times, encapsulation, and capture length.

Scope and limits

The parser covers classic libpcap only (big/little endian, micro- and nanosecond timestamps) — no pcapng. Only IPv4 is decoded; IPv6 and other ethertypes are counted in packet totals but not analysed. There is no TCP stream reassembly, so SIP over TCP is matched per segment, and TLS payloads are opaque. Anomaly and state heuristics are deliberately simple approximations, not a substitute for a full tshark-grade analysis.

Development

bash
npm installnpm run build   # tsc -> dist/npm test        # node test runner over test/*.test.ts, synthetic captures only, no networknpm run dev     # run the CLI from source via tsx

License

MIT — see LICENSE.

來源：README.md，提交 788aeab

工具

0
SourceWeft 尚未在沙箱中啟動過該軟體包，因此其工具未知。

版本歷史

1
  1. v0.1.0最新Nov 3, 2026

評分

已滿足適用檢查項的 50%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分

    請保持端點能夠回應 MCP 握手；SourceWeft 每 30 天探測一次。

  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具15 分

    請讓伺服器在無憑證時回應 tools/list，或發布可在沙箱中無憑證啟動的軟體包。

  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分