This isn’t really a feature we should brag about, because it’s a bug that took us a while to figure out, but we believe in sharing the bad as well as the good. There’s a lot to learn from TCP reassembly and protocol reverse engineering!
We received a request from a customer to help track down the user
that was sending some queries to their database. Normally we can
find this information easily: the user is one of the properties
of query samples, and we can just click on a sample and see it.
But for this particular customer, the user was always
unknown_user.
This means we weren’t able to figure out what database user was issuing the query. Normally there are two ways we can figure out what the user is:
- We see the connection handshake and capture the username from there.
- We see a
COM_CHANGE_USERpacket and capture it from that (rare).
Our theory was that …
[Read more]