wireshark的应用

使用MySQL client连接到MySQL server, 请求简单的Select, 而后断开, 在其过程中抓包, 解释如下内容:

主机名

ip地址

对象

端口

liu-03

10.186.64.137

server

3306

liu-04

10.186.64.138

client

server开启tcpdump

client连接服务器并进行select

[root@liu03 ~]# tcpdump tcp -i eth0 -t -s 0 -c 100 and port 3306  -w ./server.cap

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

^C54 packets captured

56 packets received by filter

0 packets dropped by kernel

[root@liu03 ~]#

[root@liu04 ~]# mysql -h10.186.64.137 -P3306 -utest -p123456 -S /usr/local/mysql/data/mysql.sock

mysql: [Warning] Using a password on the command line interface can be insecure.

Welcome to the MySQL monitor.  Commands end with ; or g.

Your MySQL connection id is 17

Server version: 8.0.15 MySQL Community Server - GPL

Copyright (c) 2000, 2019, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its

affiliates. Other names may be trademarks of their respective

owners.

Type 'help;' or 'h' for help. Type 'c' to clear the current input statement.

mysql> use employees;select * from departments limit 1;

Reading table information for completion of table and column names

You can turn off this feature to get a quicker startup with -A

Database changed

+---------+------------------+

| dept_no | dept_name        |

+---------+------------------+

| d009    | Customer Service |

+---------+------------------+

1 row in set (0.00 sec)

mysql> quit

Bye

[root@liu04 ~]#

(1)TCP的握手/断开

 

看图中syn和ack的信息连接看出对应的TCP的握手和断开

(2)MySQL连接的握手过程

 

a)  服务端往客户端发送握手初始化包(Handshake Initialization Packet)

b)  客户端往服务端发送验证包(Client Authentication Packet)

c)  服务端往客户端发送成功包

 

MySQL-8.04的图,从MySQL5.7开始密码加密已经开始使用SHA256(password)。

d)  server发送一个20字节的salt给client;

e)  client读取server的公钥,事先导入给client的;

f)  client计算password与salt的哈希值,并通过server的公钥加密发送给server;

g)  server用过RSA私钥解密,并通过scramble和password的hash进行比较认证。

原文地址:https://www.cnblogs.com/5945yang/p/12720671.html