Home / server / Questions / 259912
Accepted
Clark
Asked: 2011-04-15 16:51:31 +0800 CST

Problem with WireShark (MySQL sniffing)

  • 772

How can I snif MySQL data using WireShark? Also I used «mysqlsniffer» and have no results. There are no any packets from MySQL. I've filtered by «MySQL.isPresent» in WireShark but nothing happened.

MySQL installed on Ubuntu 10.10 from repository. Here is my.conf: http://pastebin.com/jkJU773E

Also I can telnet to MySQL:

halo@desktop:~$ telnet localhost 3306
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
?
5.1.49-1ubuntu8.1�otw|(N2iL~Vsam~Sbr9
^CConnection closed by foreign host.
halo@desktop:~$

ubuntu mysql wireshark sniffing

2 Answers

  1. Best Answer

    By default, on localhost, mysql actually connects over a UNIX socket. Add -h 127.0.0.1 to your mysql line to force communication over TCP.

    • 3

  2. Are you sure you're sniffing the right interface? If you're connecting locally as in your example you should attach to the loopback interface (lo) instead of eth0 or any other eth*.

    I don't know MySQL.isPresent, have you tried filtering tcp port 3306? It should be enough, really.

    As an alternative, you can capture the traffic using tcpdump on the commandline and then open the dump file with wireshark:

    tcpdump -nli lo port 3306 -s 0 -w mysql.dump
wireshark mysql.dump

    Replace lo with eth0, etc. if needed.

    • 0