{"id":"130892b1-8c52-40ac-ad72-f1375e582bed","slug":"wiremcp-rs","kind":"mcp","name":"WireMCP-rs","summary":"MCP server for real-time network analysis with native Rust packet parsing. Live capture, DDoS detection (25+ patterns), baseline profiling, TCP/UDP stream analysis, Source Engine game server monitorin","owner":"RomainRicord","repoUrl":"https://github.com/RomainRicord/WireMCP-rs","license":"MIT","licenseTier":"permissive","trust":"community","stars":2,"match":null,"fewStars":true,"format":"mcp","createdAt":"2026-03-05T12:30:18.000Z","addedAt":"2026-10-21T08:26:05.157Z","logoUrl":"https://avatars.githubusercontent.com/u/104903932?u=b0195ebd14df4b80659350a7a8b5224b89768b47&v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["cloud-infra","utilities"],"tags":["802-11","libpcap","monitor-mode","network-analysis","network-security","packet-capture","pcap","rust"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-22T22:12:03.173Z","sample":false,"url":"https://conduits.dev/tools/wiremcp-rs","language":"Rust","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"![Wire-MCP Banner](wiremcp-rs.png)\n\n# WireMCP-rs\n\nMCP server for real-time network analysis — live packet capture, WiFi monitor mode scanning, threat detection — powered by native Rust parsing.\n\nForked from [0xKoda/WireMCP](https://github.com/0xKoda/WireMCP) and rewritten with Rust backends for performance (60x faster than tshark on packet parsing).\n\n## Features\n\n### MCP Tools\n\n| Tool | Description | Backend |\n|------|-------------|---------|\n| **`capture_packets`** | Live packet capture with JSON output. Modes: `basic` (native Rust) or `full` (tshark deep dissection) | Rust |\n| **`get_summary_stats`** | Protocol hierarchy statistics (eth, ip, tcp, udp, dns, tls, http...) | Rust |\n| **`get_conversations`** | TCP/UDP conversation tracking with bytes, packets, duration per flow | Rust |\n| **`check_threats`** | Capture IPs and check against URLhaus blacklist | Rust + JS |\n| **`check_ip_threats`** | Check a specific IP against URLhaus IOCs | JS |\n| **`analyze_pcap`** | Analyze existing PCAP files. Modes: `basic` or `full` | Rust |\n| **`extract_credentials`** | Extract credentials from PCAP (HTTP Basic, FTP, Telnet, Kerberos hashes) | tshark |\n| **`analyze_ddos`** | DDoS attack detection and analysis (25+ attack patterns, live or PCAP) | Rust |\n| **`create_baseline`** | Profile normal network behavior (IPs, ports, protocols, DNS, traffic rates) | Rust |\n| **`detect_anomalies`** | Compare live traffic against baseline to detect deviations | Rust |\n| **`analyze_streams`** | Deep TCP/UDP stream reassembly with payload threat detection | Rust |\n| **`source_engine_monitor`** | Source Engine game server DDoS detection (Garry's Mod, CS, TF2) | Rust |\n| **`monitor_scan`** | WiFi monitor mode scan with HTML report (clients, vendors, WiFi standards, signal) | Rust |\n\n### Native Rust Parsing (basic mode)\n\nThe `capture-rs` binary parses packets natively without tshark:\n\n- **Ethernet** (MAC addresses, VLAN 802.1Q)\n- **IPv4 / IPv6** (addresses, TTL, hop limit)\n- **TCP** (ports, flags SYN/ACK/FIN/RST/PSH, seq, ack, window)\n- **UDP** (ports, length)\n- **ICMP** (type, code, description)\n- **ARP** (request/reply, MACs, IPs)\n- **DNS** (queries, responses with A/AAAA/CNAME records, name compression)\n- **TLS** (SNI from ClientHello, version 1.0-1.3 via Supported Versions extension)\n- **HTTP/1.x** (method, URI, Host, User-Agent, status, Content-Type, Server)\n- **DHCP** (message type, hostname, vendor class, assigned IP)\n\n### DDoS Detection Engine (analyze_ddos)\n\nThe `analyze_ddos` tool detects 25+ attack patterns from live traffic or PCAP files:\n\n**L3/L4 Volumetric Floods:**\n- SYN Flood (SYN/SYN+ACK ratio analysis)\n- ACK Flood, RST Flood, FIN Flood\n- UDP Flood (volume-based detection)\n- Uniform-size UDP Flood (fixed-length random payload from a few sources)\n- ICMP Flood\n- IP Protocol Flood (random IP protocol numbers)\n- IP Fragmentation attack (non-first fragments are never parsed as TCP/UDP headers)\n\n**Amplification/Reflection (19 protocols + TCP):**\n\nA protocol is flagged only when several distinct reflectors answer from its port (3, or 10 for IPsec ports),\nso a single DNS resolver or VPN server never triggers an alert.\n\n| Protocol | Port | Max Amplification |\n|----------|------|-------------------|\n| DNS | 53 | x54 000 |\n| Memcached | 11211 | x51 000 |\n| WS-Discovery | 3702 | x500 |\n| NTP | 123 | x556 |\n| Chargen | 19 | x358 |\n| Jenkins | 33848 | x100 |\n| CLDAP | 389 | x70 |\n| ARMS | 3283 | x35 |\n| CoAP | 5683 | x34 |\n| SSDP/UPnP | 1900 | x30 |\n| RPC Portmap | 111 | x7 |\n| SNMP | 161 | x6.3 |\n| Steam | 27015 | x5.5 |\n| NetBIOS | 137 | x3.8 |\n| Ubiquiti Discovery | 10001 | x35 |\n| Dahua DHDiscover | 37810 | n/a |\n| BACnet | 47808 | n/a |\n| IKE/IPsec | 500 | n/a |\n| IKE/IPsec NAT-T | 4500 | n/a |\n\n- TCP SYN-ACK Reflection (SYN-ACKs for SYNs never sent, including the same-port variant)\n\n**L7 Application Layer:**\n- HTTP/S GET Flood\n- HTTP/S POST Flood\n- WordPress XML-RPC Flood (pingback abuse)\n- Random Path / Cache Bypass Flood (unique URI tracking)\n- Rotating User-Agent Bot Detection (L7 botnet fingerprinting)\n- HTTP Carpet Bombing (requests spread across many destination IPs)\n\n**Slow Attacks:**\n- Slowloris detection (many connections, small packets over long duration)\n- Slow POST / RUDY detection\n\n**DNS Attacks:**\n- DNS Carpet Bombing (many unique subdomains of the same base domain)\n\n**Meta Detection:**\n- Multi-vector attack detection (automatic identification of simultaneous attack types)\n- Distributed attack detection (many sources, high packet rate)\n- Port scan / Scattershot detection (ignores reflectors answering from service ports)\n- Traffic timeline with per-second packet and bandwidth visualization\n\n### Baseline Profiling & Anomaly Detection (create_baseline / detect_anomalies)\n\nProfile your network's normal behavior, then detect deviations in real-time:\n\n- **Baseline mode:** Captures traffic and builds a JSON profile of known IPs, ports, protocols, DNS domains, and traffic rates\n- **Anomaly mode:** Loads a baseline and compares live traffic, alerting on:\n  - New IPs or ports not seen in the baseline\n  - New protocols or DNS domains\n  - Bandwidth spikes (>2x baseline)\n  - Connection rate spikes\n\n### Deep Stream Analysis (analyze_streams)\n\nTCP/UDP payload reassembly with threat detection:\n\n- **TCP stream reassembly** by 5-tuple (32KB cap per direction)\n- **Shannon entropy** detection for encrypted/exfiltration data on non-encrypted channels\n- **Protocol mismatch** detection (e.g., non-TLS on port 443)\n- **Pattern matching:** shell commands, reverse shells, base64 blobs, ELF/PE binaries\n- **C2 beacon detection** via periodic interval analysis (low jitter = bot)\n- **DNS tunneling** (long subdomains + high entropy)\n- **DGA detection** (consonant ratio + entropy for algorithmically generated domains)\n\n### Source Engine Game Server Monitor (source_engine_monitor)\n\nMonitor Garry's Mod / CS:GO / TF2 servers for DDoS and abuse:\n\n- **A2S protocol parsing** (INFO, PLAYER, RULES queries + challenge-response)\n- **Query flood detection** with severity levels (MEDIUM/HIGH/CRITICAL)\n- **Amplification ratio analysis** (Source Engine responses are ~200x larger than queries)\n- **Query-only bot/scanner** identification (no game data, only queries)\n- **High packet-rate client** detection\n- **Periodic bot detection** (regular interval patterns)\n- **Distributed attack detection** (many sources, coordinated queries)\n- Per-client and per-second timeline breakdown\n\n### Firewall Hardening (scripts/firewall.sh)\n\niptables management script with safety features:\n\n- SSH rate limiting (5 new connections/min/IP)\n- LLMNR and DNS blocking (anti-amplification)\n- ICMP rate limiting\n- LOG + DROP default policy\n- **5-minute auto-revert** if not confirmed (prevents lockout)\n\n```bash\nsudo bash scripts/firewall.sh apply    # Apply rules (auto-reverts in 5 min)\nsudo bash scripts/firewall.sh confirm  # Make permanent\nsudo bash scripts/firewall.sh revert   # Rollback\nsudo bash scripts/firewall.sh status   # Show current rules\n```\n\n### WiFi Monitor Mode (monitor-scan-rs)\n\nThe `monitor-scan-rs` binary handles 802.11 monitor mode:\n\n- Switches interface to monitor mode, captures, then restores managed mode\n- Native radiotap header parsing (signal, data rate, MCS/VHT)\n- 802.11 frame parsing with IE extraction (HT/VHT/HE for WiFi 4/5/6 detection)\n- Auto channel detection (scans 2.4GHz + 5GHz channels)\n- Generates a styled HTML report with:\n  - Client table (MAC, vendor, WiFi standard, signal, AP, probes)\n  - Statistics (vendor distribution, WiFi standards, AP distribution)\n  - Signal strength bars, randomized MAC detection, power save status\n\n## Installation\n\n### Prerequisites\n\n- Linux (tested on Fedora, Debian)\n- [Wireshark](https://www.wireshark.org/download.html) (`tshark` in PATH — only needed for `full` mode and `extract_credentials`)\n- Node.js (v20+)\n- Rust toolchain (`cargo`)\n- `libpcap-dev` / `libpcap-devel`\n\n### Setup\n\n```bash\ngit clone https://github.com/RomainRicord/WireMCP-rs.git\ncd WireMCP-rs\n\n# Install Node dependencies\nnpm install\n\n# Build Rust binaries\ncd capture-rs && cargo build --release && cd ..\ncd monitor-scan-rs && cargo build --release && cd ..\n\n# Set network capabilities (required for live capture without root)\nsudo setcap cap_net_raw,cap_net_admin=eip capture-rs/target/release/capture-packets\nsudo setcap cap_net_raw,cap_net_admin=eip monitor-scan-rs/target/release/monitor-scan\n```\n\n> **Note:** `setcap` must be re-run after each `cargo build --release`.\n\n### Sudoers (for monitor mode)\n\nMonitor mode requires `sudo` for `ip`, `iw`, and `nmcli`. Add to `/etc/sudoers`:\n\n```\nyour_user ALL=(ALL) NOPASSWD: /usr/sbin/ip, /usr/sbin/iw\n```\n\n### Run\n\n```bash\nnode index.js\n```\n\n## Usage with MCP Clients\n\n### Claude Desktop / Cursor\n\nAdd to your MCP config:\n\n```json\n{\n  \"mcpServers\": {\n    \"wiremcp-rs\": {\n      \"command\": \"node\",\n      \"args\": [\"/path/to/WireMCP-rs/index.js\"]\n    }\n  }\n}\n```\n\n### Standalone CLI (no MCP)\n\nThe monitor scan can also be used without MCP/LLM:\n\n```bash\n# Node.js CLI\nnode monitor-scan.js --interface wlo1 --channel 0 --duration 30 --output report.html\n\n# Or directly with the Rust binary\n./monitor-scan-rs/target/release/monitor-scan --interface wlo1 --channel 0 --duration 30 --output report.html\n\n# Packet capture\n./capture-rs/target/release/capture-packets --interface wlo1 --duration 5 --mode basic\n./capture-rs/target/release/capture-packets --mode stats --file capture.pcap\n./capture-rs/target/release/capture-packets --mode conversations --interface wlo1 --duration 10\n\n# DDoS analysis (live or PCAP)\n./capture-rs/target/release/capture-packets --mode ddos --interface eth0 --duration 60\n./capture-rs/target/release/capture-packets --mode ddos --file attack.pcap\n\n# Baseline profiling & anomaly detection\nBASELINE_OUTPUT=baseline.json ./capture-rs/target/release/capture-packets --mode baseline --interface eth0 --duration 60\nBASELINE_FILE=baseline.json ./capture-rs/target/release/capture-packets --mode anomaly --interface eth0 --duration 30\n\n# Deep stream analysis\n./capture-rs/target/release/capture-packets --mode streams --interface eth0 --duration 15\n./capture-rs/target/release/capture-packets --mode streams --file capture.pcap\n\n# Source Engine game server monitoring\nSOURCE_PORT=27015 ./capture-rs/target/release/capture-packets --mode source-engine --interface eth0 --duration 120\n```\n\n## Tests\n\n```bash\ncd capture-rs && cargo test --release\n```\n\n- Synthetic tests generate small pcaps on the fly: legitimate traffic (QUIC download, IPsec VPN, home DNS) must stay\n  silent, and edge cases (fragments, uniform UDP flood) must behave.\n- Dataset tests run the detector on the 18 real attacks of the\n  [StopDDoS packet-captures](https://github.com/StopDDoS/packet-captures) collection and check the expected alerts.\n  Download it into `packet-captures-main/` at the repo root (or set `WIREMCP_PCAP_DIR`); without it these tests are skipped.\n\n## Performance\n\n| Operation | tshark (JS) | Rust native | Speedup |\n|-----------|-------------|-------------|---------|\n| Parse 125 packets | 0.124s | 0.002s | **60x** |\n| Monitor scan (15k frames) | 1.33s CPU | 0.13s CPU | **10x** |\n| Binary size | — | 859K (stripped) | — |\n\n## Architecture\n\n```\nWireMCP-rs/\n  index.js              # MCP server (13 tools, prompts)\n  monitor-scan.js       # Standalone monitor mode CLI\n  capture-rs/           # Rust: packet capture + parsing + analysis\n    src/main.rs         #   Modes: basic, full, stats, conversations, ddos,\n    src/capture.rs      #          baseline, anomaly, streams, source-engine\n    src/baseline.rs     #   Baseline profiling & anomaly detection\n    src/streams.rs      #   TCP/UDP stream reassembly & threat detection\n    src/sourceengine.rs #   Source Engine protocol DDoS detection\n  monitor-scan-rs/      # Rust: WiFi monitor mode scanner\n    src/main.rs         #   802.11 parsing, HTML report generation\n  scripts/\n    firewall.sh         # iptables management with auto-revert safety\n```\n\n## License\n\n[MIT](LICENSE)\n\n## Acknowledgments\n\n- [0xKoda/WireMCP](https://github.com/0xKoda/WireMCP) — original project\n- Wireshark/tshark — deep protocol dissection\n- [pcap crate](https://crates.io/crates/pcap) — Rust libpcap bindings\n- URLhaus — threat intelligence data\n- Model Context Protocol — framework and specifications\n"}