# mysql-sniffer

**Repository Path**: gezzr/mysql-sniffer

## Basic Information

- **Project Name**: mysql-sniffer
- **Description**: MySQL Sniffer 是一个基于 MySQL 协议的抓包工具，实时抓取 MySQLServer 端或 Client 端请求，并格式化输出。输出内容包括访问时间、访问用户、来源 IP、访问 Database、命令耗时、返回数据行数、执行语句等。有批量抓取多个端口，后台运行，日志分割等多种使用方式，操作便捷，输出友好。
- **Primary Language**: C
- **License**: MIT
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 49
- **Created**: 2021-10-09
- **Last Updated**: 2021-10-09

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# MySQL Sniffer [中文介绍](https://github.com/Qihoo360/mysql-sniffer/blob/master/README_CN.md)
MySQL Sniffer is a network traffic analyzer tool for MySQL, it is developed by Qihoo DBA and infrastructure team. This commandline tool captures and analyzes packets destined for a MySQL 
server or Client, and outputs them in a standard log format including access time, users, IP, database, query_time, rows number and query.

MySQL Sniffer also analyzer Atlas's network traffic. Atlas is a MySQL protocol-based database middleware project，github：[https://github.com/Qihoo360/Atlas](https://github.com/Qihoo360/Atlas)

# System requirements:
- Certified to run on CentOS v6 
- Commandline access to the server with root privileges

# Usage
```
./mysql-sniffer -h
Usage mysql-sniffer [-d] -i eth0 -p 3306,3307,3308 -l /var/log/mysql-sniffer/ -e stderr
         [-d] -i eth0 -r 3000-4000
         -d daemon mode.
         -s how often to split the log file(minute, eg. 1440). if less than 0, split log everyday
         -i interface. Default to eth0
         -p port, default to 3306. Multiple ports should be splited by ','. eg. 3306,3307
            this option has no effect when -f is set.
         -r port range, Don't use -r and -p at the same time
         -l query log DIRECTORY. Make sure that the directory is accessible. Default to stdout.
         -e error log FILENAME or 'stderr'. if set to /dev/null, runtime error will not be recorded
         -f filename. use pcap file instead capturing the network interface
         -w white list. dont capture the port. Multiple ports should be splited by ','.
         -t truncation length. truncate long query if it's longer than specified length. Less than 0 means no truncation
         -n keeping tcp stream count, if not set, default is 65536. if active tcp count is larger than the specified count, mysql-sniffer will remove the oldest one
```
# Install
```
git clone git@github.com:Qihoo360/mysql-sniffer.git
cd mysql-sniffer
mkdir proj
cd proj
cmake ../
make
cd bin/
```
# Dependence 
glib2-devel、libpcap-devel、libnet-devel

# Install

```
git clone git@github.com:Qihoo360/mysql-sniffer.git
cd mysql-sniffer
mkdir proj
cd proj
cmake ../
make
cd bin/
```

# More
More MySQL Sniffer information, Atlas and some other technology please pay attention to our Hulk platform official account or QQ:104180820 

<img src="http://i.imgur.com/pL4ni57.png" width = "500" alt="2">

# Thanks
Thanks for the contributions [yihaoDeng](https://github.com/yihaoDeng) and [winkyao](https://github.com/winkyao) have made for MySQL Sniffer