Wireshark: Filter SQL Traffic

Wireshark has display filters and capture filters. The capture filter captures only certain packets, resulting in a small capture file. Capture filters are set in Capture Options (ctrl-K). An example to capture SQL Server traffic would be:

host <sql-server-ip> and port <sql-server-port>

A display filter is set in the toolbar. A display filter does not reduce the size of the capture. You can change a display filter while the capture is running. An example display filter:

ip.addr == <sql-server-ip> && tcp.port == <sql-server-port>

The default SQL Server port is 1433.

You can use only tds to identify the traffic between SQL Server's client and server, this fill filter a lot of noise packet.

Or you can append the tds with the and or && operator after other filters if you want to filter more specific traffic.

Referensi

• http://stackoverflow.com/questions/2562682/how-do-i-filter-sql-server-traffic-between-app-and-db-servers-using-wireshark?rq=1