hoterran / tcpcollect

Watch sql base libpcap
141 stars 59 forks source link

load data local file protocol #37

Closed hoterran closed 11 years ago

hoterran commented 11 years ago
[root@alsdb_admin1a ~]# cat /root/ss.csv 
1,2
3,4

load data local infile '/root/ss.csv' into table test  fields terminated by ',' (@id,@name) set id=@id, name=@name;

T 172.18.111.21:58118 -> 42.120.126.31:3306 [AP]
  73 00 00 00 03 6c 6f 61    64 20 64 61 74 61 20 6c    s....load data l
  6f 63 61 6c 20 69 6e 66    69 6c 65 20 27 2f 72 6f    ocal infile '/ro
  6f 74 2f 73 73 2e 63 73    76 27 20 69 6e 74 6f 20    ot/ss.csv' into 
  74 61 62 6c 65 20 74 65    73 74 20 20 66 69 65 6c    table test  fiel
  64 73 20 74 65 72 6d 69    6e 61 74 65 64 20 62 79    ds terminated by
  20 27 2c 27 20 28 40 69    64 2c 40 6e 61 6d 65 29     ',' (@id,@name)
  20 73 65 74 20 69 64 3d    40 69 64 2c 20 6e 61 6d     set id=@id, nam
  65 3d 40 6e 61 6d 65                                  e=@name         

T 42.120.126.31:3306 -> 172.18.111.21:58118 [AP]
  0d 00 00 01 fb 2f 72 6f    6f 74 2f 73 73 2e 63 73    ...../root/ss.cs
  76                                                    v               

T 172.18.111.21:58118 -> 42.120.126.31:3306 [AP]
  08 00 00 02 31 2c 32 0a    33 2c 34 0a 00 00 00 03    ....1,2.3,4.....

T 42.120.126.31:3306 -> 172.18.111.21:58118 [AP]
  37 00 00 04 00 02 00 02    00 00 00 2f 52 65 63 6f    7........../Reco
  72 64 73 3a 20 32 20 20    44 65 6c 65 74 65 64 3a    rds: 2  Deleted:
  20 30 20 20 53 6b 69 70    70 65 64 3a 20 30 20 20     0  Skipped: 0  
  57 61 72 6e 69 6e 67 73    3a 20 30                   Warnings: 0   
hoterran commented 11 years ago

load data local file 的协议很特殊,所以我们这样处理,当发现 resultset packet 里返回的是 fb 则认为是 local file 协议,于是接下来的包都过滤掉,该连接不处理了.