Comments on: Gathering queries from a server with Maatkit and tcpdump

By: Baron Schwartz

Baron Schwartz — Fri, 16 Oct 2009 02:01:41 +0000

Ronald, 65535 is the max the TCP/IP protocol can possibly hold, but typically it’s MUCH smaller than that in practice, so try something like 2000. (1500 is the max most networks do as I recall).

By: Ronald Bradford

Ronald Bradford — Thu, 15 Oct 2009 21:52:48 +0000

I was unable to get this functional on a CentOS 5.3 server. I tried -s 65535, 32767 and even 0, all with the same error.

tcpdump: invalid snaplen 65535 # number being what was passed.

Command used was.

$ /usr/sbin/tcpdump -i eth1 port 3306 -s 65535 -x -n -q -tttt | /home/rbradfor/maatkit-4790/bin/mk-query-digest –type tcpdump

By: horse

horse — Mon, 31 Aug 2009 06:54:34 +0000

Why always remind me that the packets don’t come from mysql server?

the command on server(192.168.84.22)：
tcpdump host 192.168.84.22 and 192.168.84.146 -x -n -q -tttt > tcp.dmp

I run a few querie on client(192.168.84.146), quit, and cancel tcpdump,Now I’ve got a file(tcp.dmp) and I’m ready to analyze it

$ mk-query-digest –type=tcpdump –limit 1 tcp.dmp

result：
Packet is not to or from MySQL server: $VAR1 = {
ack => 3333564724,
complete => 1,
data => ‘110000000373656c656374202a2066726f6d207070′,
data_len => 21,
dgram_len => 61,
dst_host => ‘192.168.84.22′,
dst_port => ‘4333′,
ip_hlen => 5,
pos_in_log => 13193,
raw_packet => ‘2009-08-31 14:26:13.120420 IP 192.168.84.146.2557 > 192.168.84.22.4333: tcp 21
0×0000: 4500 003d d341 4000 4006 3d80 c0a8 5492
0×0010: c0a8 5416 09fd 10ed 23c2 198d c6b2 2934
0×0020: 5018 f884 6145 0000 1100 0000 0373 656c
0×0030: 6563 7420 2a20 6672 6f6d 2070 70′,
seq => 599923085,
src_host => ‘192.168.84.146′,
src_port => ‘2557′,
tcp_hlen => 5,
ts => ‘2009-08-31 14:26:13.120420′
};

why ???Please help me ~~~

By: Baron Schwartz

Baron Schwartz — Thu, 09 Jul 2009 10:10:03 +0000

Thanks Mark. By the way, anyone using this might be interested in the –tcpdump-errors option, which will write out all TCP sessions it can’t make any sense of. Then you can use that to submit bug reports or sponsor the tool to make it better

By: Mark Callaghan

Mark Callaghan — Thu, 09 Jul 2009 00:45:30 +0000

Wow! Someone just showed me some output from this and it is really, really nice. This is a very good week – first the faster recovery patch and now this.

By: Nick Le Mouton

Nick Le Mouton — Thu, 02 Jul 2009 23:40:01 +0000

Thanks Jeremy that did it

By: Jeremy Zawodny

Jeremy Zawodny — Thu, 02 Jul 2009 22:46:05 +0000

Nick:

If you change from localhost to using the IP address of your box, it’ll work (assuming the MySQL grants allow for this).

By: Nick Le Mouton

Nick Le Mouton — Thu, 02 Jul 2009 22:40:32 +0000

I’m trying to run tcpdump on my local dev server, but as far as I can see no packets are going through interface lo. Although mysql is connecting to localhost via PHP, I think it’s trying to use the unix socket rather than tcp/ip. Is there anyway to sniff packets from the socket to use the same query analysis tool?

By: Baron Schwartz

Baron Schwartz — Thu, 02 Jul 2009 21:57:39 +0000

Hi LenZ, no offense, no hard feelings! Point well spoken and taken. “Quietly” is just one of those accidental words.

By: LenZ

LenZ — Thu, 02 Jul 2009 21:52:34 +0000

Baron, it was not my intention to offend you or imply that any of the work was done in secret. *I* certainly know this was not the case (as I follow the mailing lists), but to the uninitiated a comment like yours *could* be misinterpreted like it was. Hence my suggestion to be careful with formulating it as you did. Sorry if my comment sounded misleading or offensive.