How can I decode SQL Server traffic with wireshark?

user_3059 0
Viewed 43803

I can capture the packets using wireshark, but I can't decode the stream into anything intelligible.

This item in the WireShark bug database suggests that maybe this isn't possible in SQL Server 2005 or newer. But several people on Stack Overflow claimed this was a good method in answers to this question:

How to validate SQL Server traffic is encrypted?

Any help appreciated.

wireshark sql-server
4 Answers

Not wireshark, but for me the Microsoft Message Analyzer worked great for that.

To get all the sent commands

  1. Start a new session
  2. Add Live Trace as as Data Source
  3. Select Scenario (I chose Local Network Interfaces)
  4. Enter a session filter expression like *address == 10.1.2.129 to filter only traffic to your sql server.
  5. Click start
  6. Right click on column header in the massage table and select Add columns...
  7. Add TDS > SQLBatch > SqlBatchPacketData > SQLText

This should give you something like the following enter image description here

Unfortunately there is no autoscroll implemented at the moment, but you can sort by timestamp and have the new queries popping up at the top.

user_9362840

The question that you are refering to is how to prove that the traffic is encrypted.

So they were using wireshark to show that you could not read it.

The encryption was weak on earlier versions of SQL server, but I don't think that it is easy to decrypt SQL Server 2005 traffic.

user_866110
Related