This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi guys,

I'm testing tshark 1.10.14 on Centos 7.2.1511 and tshark 1.0.15 on Centos 5.11. I'd like to save for a range of 10 minutes or more mysql.user, ip.src and mysql.query.

I arrived to test these commands:

  • tshark -i any -n -Y "mysql.command==3" -T fields -e ip.src -e mysql.query "dst port 3306 and (host x.x.x.x or host y.y.y.y)" # tshark 1.10.14
  • tshark -i any -n -f "dst port 3306 and tcp[(((tcp[12:1]&0xf0)>>2)+4):1]=0x03 and (host x.x.x.x or host y.y.y.y)" -T fields -e ip.src -e mysql.query # tshark 1.0.15

ADDITION

I'm able to capture mysql.user with these comands:

  1. tshark -i any -n -Y "mysql.user" -T fields -e mysql.user "dst port 3306 and (host x.x.x.x or host y.y.y.y)"
  2. tshark -i any -n -d tcp.port==3306,mysql -T fields -e mysql.user -e ip.src -e mysql.query "dst port 3306 and (host x.x.x.x or host y.y.y.y)"

The second configuration capture different records: records with only mysql.user and ip.src and records with ip.src and mysql.query. @Jaap and @sindy confirmed only with an ad hoc script I can create a unique line with all three fields.

Is improvable the second configuration?

Thanks.

asked 24 Oct '16, 09:38

bilardi's gravatar image

bilardi
6113
accept rate: 0%

edited 26 Oct '16, 01:34

1

Do you have an (unfiltered) capture taken here, where the user field is filled in? Then you should be able to reverse engineer what you'll need to change.

(25 Oct '16, 02:55) Jaap ♦

@Jaap, I added the paragraph ADDITION. I'd like to be sure that I can only use the second configuration to elaborate the output with an ad hoc script to create records with the format mysql.user\tip.src\tmysql.query, or does it exist a tshark configuration to incorporate the action of this ad hoc script?

(25 Oct '16, 05:23) bilardi
1

are you sure that mysql.user and mysql.query exist in the same PDU? The thing is that the dissectors print fields of individual packets or reassembled PDUs, not from established sessions. So if a field is not present in a given packet (or a reassembled PDU), it is not printed for that packet/PDU even if the packet/PDU belongs to a session whose other packets do contain that field.

If a PDU is split into several packets, field of that PDU are printed for the last packet of the PDU.

(25 Oct '16, 08:55) sindy

Thank you @sindy: you confirmed me that only with an ad hoc script I can create one line mysql.user\tip.src\tmysql.query because the output data gives me two different lines: mysql.user\tip.src and \tip.src\tmysql.query.

(25 Oct '16, 09:35) bilardi
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×37
×12
×10

question asked: 24 Oct '16, 09:38

question was seen: 1,878 times

last updated: 26 Oct '16, 01:34

p​o​w​e​r​e​d by O​S​Q​A