How do I filter SQL Server traffic between app and DB servers using Wireshark?
Solution 1
Wireshark has display filters and capture filters. The capture filter captures only certain packets, resulting in a small capture file. Capture filters are set in Capture Options (ctrl-K). An example to capture SQL Server traffic would be:
host <sql-server-ip> and port <sql-server-port>
A display filter is set in the toolbar. A display filter does not reduce the size of the capture. You can change a display filter while the capture is running. An example display filter:
ip.addr == <sql-server-ip> && tcp.port == <sql-server-port>
The default SQL Server port is 1433.
Solution 2
You can use only tds
to identify the traffic between SQL Server's client and server, this fill filter a lot of noise packet.
Or you can append the tds
with the and
or &&
operator after other filters if you want to filter more specific traffic.
scott8035
Updated on February 12, 2020Comments
-
scott8035 about 4 years
I'm trying to identify the source of some ill-timed connection resets. I'm trying to use Wireshark to capture the traffic that goes between the application server and database server. How do I set up a filter for this in Wireshark?