blocks|key|321619|text|您提到的问题是如何证明流量是加密的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|321620|所以他们使用wireshark来显示你不能阅读它。|321621|在SQL+server的早期版本上，加密很弱，但我认为解密SQL+Server+2005通信并不容易。|321622|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

The question that you are refering to is how to prove that the traffic is encrypted.

So they were using wireshark to show that you could not read it.

The encryption was weak on earlier versions of SQL server, but I don't think that it is easy to decrypt SQL Server 2005 traffic.

blocks|key|3283500|text|当您了解协议(和层)时，Wireshark会对捕获的数据进行解码并向您显示。这意味着捕获的数据不会被加密。如果数据是加密的(+SSL，即)，WS将只显示SSL握手和原始数据。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3283501|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Wireshark decodes and shows you captured data when understand the protocol (and layer). That means the captured data isn't encripted.
If the data is encripted (SSL, ie), WS will only show SSL handshakes and raw data.

blocks|key|3283676|text|编辑(2017-05-02)：微软网络监视器-已被Microsoft+Message+Analyzer取代-它具有相同的目的。另请参阅此答案下面的注释或更下面的答案，了解如何使用它！|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3283677|注意：+Microsoft消息分析器was+deprecated+in+late+2019，不再提供下载。|style|BOLD|3283678|原始答案|3283679|微软自己还有一个被低估的工具：“Microsoft+Network+Monitor”。基本上，这与wireshark非常相似，除了一些特定的MS协议具有比wireshark本身更好的解析器和可视化支持，显然它只能在windows下运行;-)。|3283680|这个工具已经很旧了，看起来已经被废弃了(到目前为止还没有看到新的版本)，但仍然做得很好，定义新协议的语法非常整洁/有趣-所以它在未来仍然有很大的威力。|3283681|📷|atomic|3283682|​|3283683|分析示例-记录被过滤为TDS+-因此其他数据包主要被丢弃：|3283684|3283685|3283686|3283687|对于sql+server连接也是如此。MNM甚至可以通过网络可视化结果集-非常整洁。尽管如此，如上所述的wireshark足以在线路本身上验证加密和应用的证书。这意味着它可以完全理解TDS-Protocoll。|3283688|处理TLS|3283689|还有一个扩展(所谓的专家)+'NmDecrypt‘和正确的证书(包括私钥)-可以解密协议-对于在TDS中使用TLS的TDS来说非常好-难怪-还没有人真正实现它作为wireshark的完全支持的协议;)|3283690|到目前为止，关于MSSQL-Traffic+-或者更精确的TDS-Protocol，这是我迄今为止遇到的最好的工具。Wireshark很酷--但在这种情况下，MNM更“好”。有phun！;)|3283691|这些工具的链接：|3283692|微软网络监视器：http://www.microsoft.com/en-us/download/details.aspx?id=4865|3283693|NMDecrypt：http://nmdecrypt.codeplex.com/releases/view/85581|unordered-list-item|3283694|
+|3283695|3283696|3283697|entityMap|0|LINK|mutability|MUTABLE|url|https://www.microsoft.com/en-us/download/details.aspx?id=44226|1|https://archive.ph/hPdKB|2|IMAGE|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/5fc259f2d90a95a943526370af6e642c.png|imageAlt|3|https://ask.qcloudimg.com/http-save/yehe-900000/3147a246742825325a3748069f931cb4.png|4|http://www.microsoft.com/en-us/download/details.aspx?id=4865|5|http://nmdecrypt.codeplex.com/releases/view/85581^0|P|Q|0|0|0|3|I|R|1|0|0|0|0|0|1|2|0|0|0|0|0|1|3|0|0|0|0|5|0|0|0|5|3|0|8|1O|4|0|A|1D|5|0|0|0|0^^$0|@$1|2|3|4|5|6|7|22|8|@]|9|@$A|23|B|24|1|25]]|C|$]]|$1|D|3|E|5|6|7|26|8|@$A|27|B|28|F|G]]|9|@$A|29|B|2A|1|2B]]|C|$]]|$1|H|3|I|5|6|7|2C|8|@]|9|@]|C|$]]|$1|J|3|K|5|6|7|2D|8|@]|9|@]|C|$]]|$1|L|3|M|5|6|7|2E|8|@]|9|@]|C|$]]|$1|N|3|O|5|P|7|2F|8|@]|9|@$A|2G|B|2H|1|2I]]|C|$]]|$1|Q|3|R|5|6|7|2J|8|@]|9|@]|C|$]]|$1|S|3|T|5|6|7|2K|8|@]|9|@]|C|$]]|$1|U|3|R|5|6|7|2L|8|@]|9|@]|C|$]]|$1|V|3|O|5|P|7|2M|8|@]|9|@$A|2N|B|2O|1|2P]]|C|$]]|$1|W|3|R|5|6|7|2Q|8|@]|9|@]|C|$]]|$1|X|3|Y|5|6|7|2R|8|@]|9|@]|C|$]]|$1|Z|3|10|5|6|7|2S|8|@$A|2T|B|2U|F|G]]|9|@]|C|$]]|$1|11|3|12|5|6|7|2V|8|@]|9|@]|C|$]]|$1|13|3|14|5|6|7|2W|8|@]|9|@]|C|$]]|$1|15|3|16|5|6|7|2X|8|@$A|2Y|B|2Z|F|G]]|9|@]|C|$]]|$1|17|3|18|5|6|7|30|8|@]|9|@$A|31|B|32|1|33]]|C|$]]|$1|19|3|1A|5|1B|7|34|8|@]|9|@$A|35|B|36|1|37]]|C|$]]|$1|1C|3|1D|5|6|7|38|8|@]|9|@]|C|$]]|$1|1E|3|-4|5|1B|7|39|8|@]|9|@]|C|$]]|$1|1F|3|-4|5|6|7|3A|8|@]|9|@]|C|$]]|$1|1G|3|-4|5|6|7|3B|8|@]|9|@]|C|$]]]|1H|$1I|$5|1J|1K|1L|C|$1M|1N]]|1O|$5|1J|1K|1L|C|$1M|1P]]|1Q|$5|1R|1K|1S|C|$1T|1U|1V|-4]]|1W|$5|1R|1K|1S|C|$1T|1X|1V|-4]]|1Y|$5|1J|1K|1L|C|$1M|1Z]]|20|$5|1J|1K|1L|C|$1M|21]]]]

Edit (2017-05-02): Microsoft Network Monitor - has been replaced by <a href="https://www.microsoft.com/en-us/download/details.aspx?id=44226" rel="nofollow noreferrer">Microsoft Message Analyzer</a> - which serves the same purpose. See also comment below this answer or the answer further down for how to use it!
Note: Microsoft Message Analyzer <a href="https://archive.ph/hPdKB" rel="nofollow noreferrer">was deprecated in late 2019</a>, and is no longer available for download.
<h2>Original Answer</h2>
There is another much underrated tool from Microsoft itself: 'Microsoft Network Monitor'. Basically this is very similar to wireshark with the exception that some specific MS protocols have better parser and visualisation support than wireshark itself and obviously it would only run under windows ;-).
The tool is quite old and looks abandoned (havn't seen a newer release so far) but still does an good job and the grammar for defining new protocols is quite neat/interesting - so this still possess a lot of power for the future.
<img src="https://i.stack.imgur.com/CQzpl.png" alt="mnm 3.4 about dialog" />
Analysis Example - Recording is filtered for TDS - so the other packets are discared mostly:
<img src="https://i.stack.imgur.com/G41fq.png" alt="Example Session for TDS (MSSQL)" />
This is also true for sql server connections. The MNM can even visualize the resultsets going over the wire - quite neat. Nonetheless wireshark as mentioned above would be sufficient to validate encryption and applied certificates on the wire itself. Means it can understand the TDS-Protocoll fully.
Handling TLS
Also with an extension (so called experts) 'NmDecrypt' and the right certificates (including private keys) - it is possible to decrypt protocolls - quite nice for TDS which uses TLS INSIDE of TDS - no wonder - no one has really implemented that yet as a fully supported protocoll for wireshark ;)
So far - regarding MSSQL-Traffic - or to be more precice TDS-Protocol this is the best tool I've come across so far. Wireshark is cool - but in this case MNM is 'better'. Have phun! ;)
Links for the tools:
<ul>
<li>Microsoft Network Monitor: <a href="http://www.microsoft.com/en-us/download/details.aspx?id=4865" rel="nofollow noreferrer">http://www.microsoft.com/en-us/download/details.aspx?id=4865</a></li>
<li>NMDecrypt: <a href="http://nmdecrypt.codeplex.com/releases/view/85581" rel="nofollow noreferrer">http://nmdecrypt.codeplex.com/releases/view/85581</a></li>
</ul>

blocks|key|320841|text|不是wireshark，但对我来说，Microsoft+Message+Analyzer在这方面做得很好。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|320842|获取所有已发送的命令|320843|sql+|320844|启动新的会话并将实时跟踪添加为数据源|unordered-list-item|320845|
|320846|选择方案(我选择了Local+Network+Interfaces)|320847|320848|Enter+a+session+filter+expression+like+*address+==+10.1.2.129以仅筛选到您的|320849|320850|的流量。sql|320851|
单击start<>H112右键单击消息表中的列标题，然后选择Add+sql+TDS+>+SqlBatchPacketData+>+SQLText|320852|这应该会给您类似于以下内容|320853|📷|atomic|320854|​|320855|不幸的是，目前还没有实现自动滚动，但您可以按时间戳排序，并在顶部弹出新的查询。|320856|entityMap|0|LINK|mutability|MUTABLE|url|https://www.microsoft.com/en-us/download/details.aspx?id=44226|1|IMAGE|IMMUTABLE|imageUrl|https://ask.qcloudimg.com/http-save/yehe-900000/61edb372f4c12cd08cef8a17418934c2.jpeg|imageAlt^0|I|Q|0|0|0|0|0|0|0|0|0|0|0|0|0|0|1|1|0|0|0^^$0|@$1|2|3|4|5|6|7|1J|8|@]|9|@$A|1K|B|1L|1|1M]]|C|$]]|$1|D|3|E|5|6|7|1N|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|1O|8|@]|9|@]|C|$]]|$1|H|3|I|5|J|7|1P|8|@]|9|@]|C|$]]|$1|K|3|L|5|6|7|1Q|8|@]|9|@]|C|$]]|$1|M|3|N|5|J|7|1R|8|@]|9|@]|C|$]]|$1|O|3|L|5|6|7|1S|8|@]|9|@]|C|$]]|$1|P|3|Q|5|J|7|1T|8|@]|9|@]|C|$]]|$1|R|3|L|5|6|7|1U|8|@]|9|@]|C|$]]|$1|S|3|T|5|J|7|1V|8|@]|9|@]|C|$]]|$1|U|3|V|5|6|7|1W|8|@]|9|@]|C|$]]|$1|W|3|X|5|6|7|1X|8|@]|9|@]|C|$]]|$1|Y|3|Z|5|10|7|1Y|8|@]|9|@$A|1Z|B|20|1|21]]|C|$]]|$1|11|3|12|5|6|7|22|8|@]|9|@]|C|$]]|$1|13|3|14|5|6|7|23|8|@]|9|@]|C|$]]|$1|15|3|-4|5|6|7|24|8|@]|9|@]|C|$]]]|16|$17|$5|18|19|1A|C|$1B|1C]]|1D|$5|1E|19|1F|C|$1G|1H|1I|-4]]]]

Not wireshark, but for me the <a href="https://www.microsoft.com/en-us/download/details.aspx?id=44226" rel="noreferrer">Microsoft Message Analyzer</a> worked great for that.

To get all the sent commands

<ol>
<li>Start a new session</li>
<li>Add Live Trace as as Data Source</li>
<li>Select Scenario (I chose Local Network Interfaces)</li>
<li>Enter a session filter expression like *address == 10.1.2.129 to filter only traffic to your sql server.</li>
<li>Click start</li>
<li>Right click on column header in the massage table and select Add columns...</li>
<li>Add TDS > SQLBatch > SqlBatchPacketData > SQLText</li>
</ol>

This should give you something like the following
<a href="https://i.stack.imgur.com/yT6zy.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/yT6zy.jpg" alt="enter image description here"></a>

Unfortunately there is no autoscroll implemented at the moment, but you can sort by timestamp and have the new queries popping up at the top.

I can capture the packets using wireshark, but I can't decode the stream into anything intelligible.
<a href="https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3098" rel="nofollow noreferrer">This item</a> in the WireShark bug database suggests that maybe this isn't possible in SQL Server 2005 or newer. But several people on Stack Overflow claimed this was a good method in answers to this question:
<blockquote>
<a href="https://stackoverflow.com/questions/907057/how-can-i-prove-my-sql-server-traffic-is-encrypted">How to validate SQL Server traffic is encrypted?</a>
</blockquote>
Any help appreciated.

How can I decode SQL Server traffic with wireshark?

SQL Server

数据库

我可以使用wireshark捕获数据包，但无法将流解码为任何可理解的内容。WireShark错误数据库中的表明，这在SQL Server2005或更高版本中可能是不可能的。但Stack Overflow上的一些人声称，这是回答这个问题的一个好方法： 感谢您的帮助。

问如何使用wireshark解码SQL Server流量？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何使用wireshark解码SQL Server流量？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何使用wireshark解码SQL Server流量？
EN