NSM Session Pivot (read-only)

MCP Server

• Server: nsm-mcp (NetClaw-authored, spec 091)
• Tools: nsm_status, nsm_analyze, nsm_sessions, nsm_protocol_log
• Engine: Zeek 8.2.1, pinned by image digest
• Input: a .pcap/.pcapng file already on disk. Nothing sniffs an interface.

The rule that matters most here

A missing protocol log does not mean there was no such traffic.

Zeek discards packets with invalid TCP checksums by default. Measured on a reference capture: with validation on, Zeek produced no http.log at all — the HTTP request was invisible — and a conn.log that was also wrong, 3 rows instead of the correct 2, because discarded packets fragment the flow. The only signal is a warning on stderr.