Use Wireshark to view MySQL interactive data captured by tcpdump

Use tcpdump to crawl MySQL client interaction with server side

1 Opening tcpdump

Tcpdump-i eth0-s Port 3306-w ~/sql.pcap

First intentionally entering an incorrect password

[[Email protected] ~] # mysql-h192.168.100.206-uroot-p Enter Password: for user ' root ' @ ' 192.168.11.201 ' (using Password:yes)

Enter the correct password to enter and perform a series of operations

[[Email protected] ~]#mysql-h192.168.100.206-uroot-pEnter Password:Welcome to theMySQLMonitor. CommandsEndwith; or \g.YourMySQLConnection ID is 442447Server version: 5.5.25-LogSource Distributioncopyright (c)The Oracle and/or its affiliates. All rights reserved.Oracle is a registered trademark of Oracle Corporation and/or Itsaffiliates.Other names trademarks of their respectiveowners.Type' Help; ' or ' \h ' forHelp. Type ' \c ' to clear the CurrentInput statement.MySQL> UseJwbx;database changedMySQL> select * from Jwbx_customer limit 10;

Open Sql.pcap file with Wireshark

The wrong password entered

Request 6 0.001146 192.168.11.201 192.168.100.206 MySQL Login Request user=root

Response 8 0.001636 192.168.100.206 192.168.11.201 MySQL 147 Response Error 1045

Landing success

4.953321 192.168.11.201 192.168.100.206 MySQL Login Request user=root

Greetings from the server side

4.952968 192.168.100.206 192.168.11.201 MySQL 148 Server Greeting proto=10 version=5.5.25- Log

Server-side status

Access

SELECT @ @version_comment Limit 1 returns to Source distribution

SELECT DATABASE ()

Use database return name

Access to SQL

Return

You can also access MySQL data in the crawler to see which SQL statements were executed

It is also possible to use the Wireshark method as follows:

# tcpdump-i any-a-S Port 3306 >~/sql.log
#grep "SELECT * from" ~/Sql.log|head

Note:-A prints out all the groupings in ASCII format and minimizes the head of the link layer. The SQL statements that are transmitted to the MySQL server are transmitted in ASCII format. We can use the-a parameter to view the specific SQL statements that are transmitted.

Use Wireshark to view MySQL interactive data captured by tcpdump