(Blog) MySQL packet capture

packet_capture.out

$sudo ngrep -x -q -d lo port 16001
# where,
#   -x          : Dump packet contents as hexadecimal
#   -q          : Be quiet, do not print '#' for every packet received
#   -d <dev>    : Listen to 'dev' interface only
#   port <port> : Print packets with this source or destination port only

interface: lo (127.0.0.0/255.0.0.0)
filter: (ip or ip6) and ( port 16001 )

T 127.0.0.1:16001 -> 127.0.0.1:41499 [AP]
  5e 00 00 00 0a 35 2e 35    2e 35 2d 31 30 2e 31 2e    ^....5.5.5-10.1.
  38 2d 4d 61 72 69 61 44    42 2d 64 65 62 75 67 00    8-MariaDB-debug.
  07 00 00 00 5f 50 50 23    58 76 69 2e 00 ff f7 08    ...._PP#Xvi.....
  02 00 3f a0 15 00 00 00    00 00 00 00 00 00 00 45    ..?............E
  52 4a 5b 6a 25 75 3f 7b    6f 3b 74 00 6d 79 73 71    RJ[j%u?{o;t.mysq
  6c 5f 6e 61 74 69 76 65    5f 70 61 73 73 77 6f 72    l_native_passwor
  64 00                                                 d.              

T 127.0.0.1:41499 -> 127.0.0.1:16001 [AP]
  a7 00 00 01 0d a6 3f 20    00 00 00 01 21 00 00 00    ......? ....!...
  00 00 00 00 00 00 00 00    00 00 00 00 00 00 00 00    ................
  00 00 00 00 72 6f 6f 74    00 00 74 65 73 74 00 6d    ....root..test.m
  79 73 71 6c 5f 6e 61 74    69 76 65 5f 70 61 73 73    ysql_native_pass
  77 6f 72 64 00 65 03 5f    6f 73 05 4c 69 6e 75 78    word.e._os.Linux
  0c 5f 63 6c 69 65 6e 74    5f 6e 61 6d 65 08 6c 69    ._client_name.li
  62 6d 79 73 71 6c 04 5f    70 69 64 04 39 31 39 37    bmysql._pid.9197
  0f 5f 63 6c 69 65 6e 74    5f 76 65 72 73 69 6f 6e    ._client_version
  06 31 30 2e 31 2e 38 09    5f 70 6c 61 74 66 6f 72    .10.1.8._platfor
  6d 06 78 38 36 5f 36 34    0c 70 72 6f 67 72 61 6d    m.x86_64.program
  5f 6e 61 6d 65 05 6d 79    73 71 6c                   _name.mysql     

.. snip ..

T 127.0.0.1:41499 -> 127.0.0.1:16001 [AP]
  11 00 00 00 03 53 45 4c    45 43 54 20 56 45 52 53    .....SELECT VERS
  49 4f 4e 28 29                                        ION()           

T 127.0.0.1:16001 -> 127.0.0.1:41499 [AP]
  01 00 00 01 01 1f 00 00    02 03 64 65 66 00 00 00    ..........def...
  09 56 45 52 53 49 4f 4e    28 29 00 0c 21 00 3c 00    .VERSION()..!.<.
  00 00 fd 01 00 1f 00 00    05 00 00 03 fe 00 00 02    ................
  00 15 00 00 04 14 31 30    2e 31 2e 38 2d 4d 61 72    ......10.1.8-Mar
  69 61 44 42 2d 64 65 62    75 67 05 00 00 05 fe 00    iaDB-debug......
  00 02 00                                              ...