0

I'm trying to capture MySQL activities through my web application and MySQL Server by using Wireshark on Windows. I've seen that most of questions about capturing packets related to MySQL return MySQL Protocol and the possibility of seeing the queries sent and their responses. Yet, when running Wireshark and using my application, I see only TCP packets coming and going, as can be seen in the pictures in the links below.

TCP Packet -> Src - Dst

Inside TCP Packet

It's important to note that I've used tools like tshark and WinDump to collect packets through the network, but nothing worked.

Am I doing something wrong or it's a Wireshark bug?

Thanks for the answers! I did what was suggested by Christopher following Edit -> Preferences -> Protocols -> MySQL. There was nothing like "Port Number", but the issue was that "Show SQL Query string in INFO column" was not selected.

Wiler Jr
  • 45
  • 1
  • 11
  • Possible duplicate of [How to use wireshark to capture mysql query sql clearly](http://stackoverflow.com/questions/38167587/how-to-use-wireshark-to-capture-mysql-query-sql-clearly) – Alex K. Apr 03 '17 at 15:31
  • He's on linux, isn't he? I've been to that post before and it hasn't solved my issue. – Wiler Jr Apr 03 '17 at 15:33
  • You dont need to use wireshark.. the mysql protocol is written down in the documention https://dev.mysql.com/doc/internals/en/client-server-protocol.html – Raymond Nijland Apr 03 '17 at 16:04

2 Answers2

2

The image provided indicates that the port in use is 3307, but the MySQL dissector registers by default on port 3306, which is the IANA-registered port for mysql traffic. So, when a non-standard port is used, you must make use of the "Decode As" feature of Wireshark, as nnovich-OK has already mentioned.

Another option in many cases, which unfortunately is not yet available in this case, is to change the port number that the dissector registers for. The MySQL dissector does not offer a port preference though, but you could open a Wireshark bug report asking for such a preference to be added - even better if you submit a patch that actually implements it. Once a preference is available, then you could set it as desired via Edit -> Preferences -> Protocols -> MySQL -> Port Number, similar to how many other dissectors allow a configurable port.

Community
  • 1
  • 1
Christopher Maynard
  • 5,702
  • 2
  • 17
  • 23
1

Wireshark has some logic which automatically determines type of traffic observed. I don't know the reason for it to fail in your case, but you can always manually point to the desired protocol. Right click on one of your TCP packets, click on "decode as" and choose "MySQL" in the last column.

nnovich-OK
  • 2,900
  • 2
  • 13
  • 16