tcpdump抓取mysql语句

抓包工具tcpdump的使用，抓取具体的sql语句 [root@test7_chat_api_im ~]# tcpdump -s 0 -l -w - dst 106.75.74.38 and port 3306 |strings tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes SELECT refresh FROM tbl_device where device = 'H0001'K SELECT refresh FROM tbl_device where device = 'A0001'K jKJ& call sp_get_log_db_rs('OC')K call sp_get_log_db_rs('OK')K jKJ& SELECT refresh FROM tbl_device where device = 'B0001'K 1e{"server":"106.75.74.38","port":3306,"dbname":"yunva-log","user":"root","pwd":"pass"}

centos6.9
1.安装依赖
yum install -y cmake libpcap-devel glib2-devel libnet-devel

2.获取mysql-sniffer代码并编译
git clone https://github.com/Qihoo360/mysql-sniffer
cd mysql-sniffer
mkdir proj
cd proj
cmake ../
make
cd bin/

# 启动监听
# ./mysql-sniffer -i eth0 -p 3306 -e stderr

说明：
1.必需要带-e才能输出日志
-e stderr

2.经过工具navicat不管是直连仍是经过ssh跳转都不能抓到sql，只看到报错的信息

3.经过其余linux直接mysql链接就能够抓到语句

经过tcpdump进行抓包

# tcpdump -s 0 -l -w - dst 10.11.0.211 and port 3306 |strings