While troubleshooting a MySQL issue, I came across this command at commandlinefu:

tshark -i any -T fields -R mysql.query -e mysql.query

I am trying to understand it before I actually use it. Looking at the man page helped me understand the options used. The MySQL filter documentation was also helpful. However, how can I actually see what the filter looks like? I'm assuming all the filters are saved in a directory somewhere. Is this assumption incorrect?

link|improve this question

feedback

1 Answer

up vote 1 down vote accepted

On CentOS they're all compiled into /usr/lib/libwireshark.so

All of the filters are called dissectors within the source code and are located in epan/dissectors.

The MySQL dissector is epan/dissectors/packet-mysql.c

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.