You: "Find all DNS queries going to suspicious domains in this capture." Claude: [calls wireshark_extract_dns_queries → wireshark_check_threats] "Found 3 queries to ...