How do I filter SQL Server traffic between app and DB servers using Wireshark?

sql-server filter wireshark
scott8035 picture scott8035 · Apr 1, 2010 · Viewed 40.7k times · Source

I'm trying to identify the source of some ill-timed connection resets. I'm trying to use Wireshark to capture the traffic that goes between the application server and database server. How do I set up a filter for this in Wireshark?

Answer

Andomar picture Andomar · Apr 1, 2010

Wireshark has display filters and capture filters. The capture filter captures only certain packets, resulting in a small capture file. Capture filters are set in Capture Options (ctrl-K). An example to capture SQL Server traffic would be:

host <sql-server-ip> and port <sql-server-port>

A display filter is set in the toolbar. A display filter does not reduce the size of the capture. You can change a display filter while the capture is running. An example display filter:

 ip.addr == <sql-server-ip> && tcp.port == <sql-server-port>

The default SQL Server port is 1433.

Related questions

Datetime in where clause

How can I select 12/20/2008 in where clause of sql? The server is SQL server 2005. select * from tblErrorLog where errorDate = '12/20/2008'

Read More
How do I UPDATE from a SELECT in SQL Server?

In SQL Server, it is possible to insert rows into a table with an INSERT.. SELECT statement: INSERT INTO Table (col1, col2, col3) SELECT col1, col2, col3 FROM other_table WHERE sql = 'cool' Is it also possible to update a …

Read More
How do I perform an IF...THEN in an SQL SELECT?

How do I perform an IF...THEN in an SQL SELECT statement? For example: SELECT IF(Obsolete = 'N' OR InStock = 'Y' ? 1 : 0) AS Saleable, * FROM Product

Read More