Awslabs Pcap Analyzer

Prerequisites

• AWS account with Lambda, Amazon Cognito, and AgentCore Gateway access
• AWS credentials configured (aws configure or environment variables)

Step 1: Create the Lambda Execution Role (IAM)

cat > lambda-trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "lambda.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF

aws iam create-role \
  --role-name pcap-analyzer-lambda-role \
  --assume-role-policy-document file://lambda-trust-policy.json

aws iam attach-role-policy \
  --role-name pcap-analyzer-lambda-role \
  --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

aws iam attach-role-policy \
  --role-name pcap-analyzer-lambda-role \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess

Step 2: Create the Lambda Function

zip -r pcap-analyzer-lambda.zip awslabs/ pyproject.toml

aws lambda create-function \
  --function-name pcap-analyzer-mcp-server \
  --runtime python3.10 \
  --role arn:aws:iam::YOUR_ACCOUNT_ID:role/pcap-analyzer-lambda-role \
  --handler awslabs.pcap_analyzer_mcp_server.server.lambda_handler \
  --zip-file fileb://pcap-analyzer-lambda.zip \
  --timeout 300 \
  --memory-size 1024 \
  --environment Variables="{PCAP_STORAGE_DIR=/tmp/pcap_storage,WIRESHARK_PATH=/opt/bin/tshark}"

Note: For Lambda deployments, set the WIRESHARK_PATH environment variable to /opt/bin/tshark (the path where your Lambda layer installs tshark).

Step 3: Deploy tshark Layer

mkdir -p layer/bin
cp /path/to/static-tshark layer/bin/tshark
chmod +x layer/bin/tshark
cd layer && zip -r ../tshark-layer.zip . && cd ..

aws lambda publish-layer-version \
  --layer-name tshark-layer \
  --zip-file fileb://tshark-layer.zip \
  --compatible-runtimes python3.10 python3.11

aws lambda update-function-configuration \
  --function-name pcap-analyzer-mcp-server \
  --layers arn:aws:lambda:REGION:YOUR_ACCOUNT_ID:layer:tshark-layer:1

Step 4: Configure Inbound Authorization (OAuth2 via Amazon Cognito)

# Create User Pool
aws cognito-idp create-user-pool \
  --pool-name pcap-analyzer-user-pool \
  --policies '{"PasswordPolicy":{"MinimumLength":8,"RequireUppercase":true,"RequireLowercase":true,"RequireNumbers":true}}' \
  --auto-verified-attributes email \
  --region us-east-1

# Create Resource Server
aws cognito-idp create-resource-server \
  --user-pool-id us-east-1_XXXXXXXXX \
  --identifier https://pcap-analyzer.example.com \
  --name "PCAP Analyzer MCP Server" \
  --scopes ScopeName=read,ScopeDescription="Read access" \
            ScopeName=write,ScopeDescription="Write/capture access" \
  --region us-east-1

# Create App Client
aws cognito-idp create-user-pool-client \
  --user-pool-id us-east-1_XXXXXXXXX \
  --client-name pcap-analyzer-gateway-client \
  --allowed-o-auth-flows client_credentials \
  --allowed-o-auth-scopes pcap-analyzer/read pcap-analyzer/write \
  --generate-secret \
  --region us-east-1

# Configure Domain
aws cognito-idp create-user-pool-domain \
  --domain pcap-analyzer-auth \
  --user-pool-id us-east-1_XXXXXXXXX \
  --region us-east-1

Step 5: Configure Outbound Authorization (IAM)

cat > pcap-analyzer-outbound-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3PcapStorage",
      "Effect": "Allow",
      "Action": ["s3:PutObject", "s3:GetObject", "s3:ListBucket", "s3:DeleteObject"],
      "Resource": [
        "arn:aws:s3:::pcap-analyzer-storage-YOUR_ACCOUNT_ID",
        "arn:aws:s3:::pcap-analyzer-storage-YOUR_ACCOUNT_ID/*"
      ]
    },
    {
      "Sid": "AllowCloudWatchLogs",
      "Effect": "Allow",
      "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
      "Resource": "arn:aws:logs:*:YOUR_ACCOUNT_ID:log-group:/aws/lambda/pcap-analyzer-*"
    }
  ]
}
EOF

aws iam create-policy \
  --policy-name pcap-analyzer-outbound-policy \
  --policy-document file://pcap-analyzer-outbound-policy.json

aws iam attach-role-policy \
  --role-name pcap-analyzer-lambda-role \
  --policy-arn arn:aws:iam::YOUR_ACCOUNT_ID:policy/pcap-analyzer-outbound-policy

Step 6: Authorization Flow

sequenceDiagram
    participant Client as Client (Kiro/Agent)
    participant Cognito as Amazon Cognito
    participant Gateway as AgentCore Gateway
    participant Lambda as Lambda Function
    participant S3 as Amazon S3

    Client->>Cognito: POST /oauth2/token (client_credentials)
    Cognito-->>Client: Bearer Token (JWT)
    Client->>Gateway: MCP Request + Authorization: Bearer <token>
    Gateway->>Cognito: Validate JWT (JWKS)
    Cognito-->>Gateway: Token Valid ✓
    Gateway->>Lambda: Invoke (IAM SigV4 signed)
    Lambda->>S3: GetObject PCAP file (IAM role)
    S3-->>Lambda: PCAP data
    Lambda-->>Gateway: MCP Response
    Gateway-->>Client: MCP Response

Step 7: PCAP Ingestion

Manual Upload:

aws s3 mb s3://pcap-analyzer-storage-YOUR_ACCOUNT_ID --region us-east-1
aws s3 cp capture.pcap s3://pcap-analyzer-storage-YOUR_ACCOUNT_ID/captures/

Active Capture via SSM (no SSH required):

aws ssm send-command \
  --instance-ids "i-XXXXXXXXXXXXXXXXX" \
  --document-name "AWS-RunShellScript" \
  --parameters '{"commands":[
    "CAPTURE_FILE=/tmp/capture-$(date +%Y%m%d-%H%M%S).pcap",
    "timeout 60 tcpdump -i any -w $CAPTURE_FILE -s 0 2>/dev/null || true",
    "aws s3 cp $CAPTURE_FILE s3://pcap-analyzer-storage-YOUR_ACCOUNT_ID/captures/",
    "rm -f $CAPTURE_FILE"
  ]}' \
  --region us-east-1

Step 8: Test the Integration

TOKEN=$(curl -s -X POST \
  https://pcap-analyzer-auth.auth.us-east-1.amazoncognito.com/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=YOUR_CLIENT_ID&client_secret=YOUR_SECRET&scope=pcap-analyzer/read" \
  | jq -r '.access_token')

curl -X POST https://YOUR_AGENTCORE_ENDPOINT/mcp \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"tools/list","params":{},"id":1}'

Lambda Considerations

• list_network_interfaces — Discover available network interfaces for capture

• start_packet_capture — Start capture on specified interface
• stop_packet_capture — Stop an active capture session
• get_capture_status — Get status of all active sessions
• list_captured_files — List all captured PCAP files

• analyze_pcap_file — Generate comprehensive analysis
• extract_http_requests — Extract HTTP requests
• generate_traffic_timeline — Create temporal traffic analysis
• search_packet_content — Search for patterns in packet data

• analyze_network_performance — Performance metrics analysis
• analyze_network_latency — Latency and response time analysis

• analyze_tls_handshakes — TLS handshakes including PQC detection
• analyze_sni_mismatches — SNI mismatches correlated with resets
• extract_certificate_details — Certificate validation against SNI
• analyze_tls_alerts — TLS alert messages and handshake failures
• analyze_connection_lifecycle — Complete connection flow tracking
• extract_tls_cipher_analysis — Cipher suite and key exchange analysis

• analyze_tcp_retransmissions — Retransmissions and packet loss
• analyze_tcp_zero_window — Flow control issues
• analyze_tcp_window_scaling — Window scaling mechanisms
• analyze_packet_timing_issues — Timing and duplicate packets
• analyze_congestion_indicators — Congestion metrics

• analyze_dns_resolution_issues — DNS resolution troubleshooting
• analyze_expert_information — Wireshark expert analysis
• analyze_protocol_anomalies — Protocol violations
• analyze_network_topology — Network structure mapping
• analyze_security_threats — Security threat identification

• generate_throughput_io_graph — Throughput visualization data
• analyze_bandwidth_utilization — Bandwidth usage patterns
• analyze_application_response_times — Application performance
• analyze_network_quality_metrics — Jitter and packet loss

• analyze_mtu_fragmentation — MTU/PMTU discovery failures
• analyze_tcp_resets — RST analysis with context
• analyze_duplicate_acks — Duplicate ACKs vs. reordering
• analyze_icmp_errors — ICMP error classification
• analyze_connection_timeouts — SYN timeouts, idle timeouts, half-open
• analyze_out_of_order_packets — Path issue detection

• analyze_quic_traffic — QUIC/HTTP3 connection analysis
• follow_tcp_stream — TCP stream reassembly
• follow_udp_stream — UDP stream reassembly

• detect_arp_spoofing — ARP spoofing detection
• detect_dns_tunneling — DNS tunneling, entropy analysis, beaconing
• extract_credentials — Plaintext credential detection (HTTP Basic, FTP, Telnet, SMTP)

• extract_fields — Arbitrary tshark field extraction
• analyze_connection_reuse — HTTP connection pooling analysis
• analyze_geo_asn_mapping — IP to ASN/organization mapping

tshark --version    # Verify installation
brew install wireshark              # macOS
sudo apt-get install tshark         # Linux

If tshark is installed in a non-standard location, set the WIRESHARK_PATH environment variable to the full path of your tshark binary.

• macOS: sudo dseditgroup -o edit -a $(whoami) -t user access_bpf (restart)
• Linux: sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
• Windows: Run as Administrator

• Use list_captured_files to see available files
• Try relative path (bgp.pcap) or absolute path
• Verify .pcap or .pcapng extension

• PCAP may not contain the target protocol
• Display filter may be too restrictive
• Start with analyze_pcap_file for a general overview