tcpdump抓包mysql输出sql语句我本地网卡是en0, 可通过ifconfig 查看网卡配置，确定自已网卡的名称

环境：MAC

命令：

sudo tcpdump -i en0 -s 0 -l -w - dst port 3306 | strings

我本地网卡是en0, 可通过ifconfig 查看网卡配置，确定自已网卡的名称。

输出效果如下：
…是代表非assic字符，所以经过strings转换输出乱码，过滤掉不关心。

sudo tcpdump -i en0 -s 0 -l -w - dst port 3306 | strings
Password:
tcpdump: listening on en0, link-type EN10MB (Ethernet), capture size 262144 bytes
...
Dmysql_native_password
osx10.10
_client_name
libmysql
_pid
_client_version
10.1.21
_platform
x86_64
SET NAMES utf8mb4
...
SHOW VARIABLES LIKE 'lower_case_%'
...
SHOW DATABASES
...
SHOW TABLE STATUS
...
SHOW CREATE TABLE `t_agreement`
...
SELECT action_order, event_object_table, trigger_name, event_manipulation, event_object_table, definer, action_statement, action_timing FROM information_schema.triggers WHERE BINARY event_object_schema = 'tiger' AND BINARY event_object_table = 't_agreement' ORDER BY event_object_table
...
SELECT * FROM `tiger`.`t_agreement` LIMIT 0, 1000
...
SHOW COLUMNS FROM `tiger`.`t_agreement`
...
SHOW TABLE STATUS LIKE 't_agreement'
...
SHOW CREATE TABLE `t_agreement`
...
SELECT action_order, event_object_table, trigger_name, event_manipulation, event_object_table, definer, action_statement, action_timing FROM information_schema.triggers WHERE BINARY event_object_schema = 'tiger' AND BINARY event_object_table = 't_agreement' ORDER BY event_object_table

请添加图片描述

navicat具体功能对应sql
左侧菜单用到：
show databases;

show db.tables;

中间主体窗口用到：
show table status
show columns from db.table
select action_order, event_object_table, trigger_name … from information_schame.triggers where BINARY event_object_schema=AND BINARY event_object_table=

右侧边栏用到：
show create table xxx

总结
tcpdump 结合strings 把3306端口包以字符串转出，可见执行sql的语句
一些新手对sql不熟悉，可使用tcpdump+strings 了解 navicat 使用哪些sql语句支持它界面端的功能。