Wireshark-users: [Wireshark-users] mysql statistics
From: Ryan Lovett <ryan@xxxxxxxxxxxxxxxxx>
Date: Mon, 12 Mar 2007 10:56:00 -0700
I run tshark as 'tshark -q -z io,phs' to view packet statistics and it
shows highly nested mysql frames:

(frame/eth/ip/tcp/)
        mysql                            frames:372 bytes:92940
          mysql                          frames:31 bytes:15168
            mysql                        frames:31 bytes:15168
              mysql                      frames:31 bytes:15168
                mysql                    frames:29 bytes:14970
                  mysql                  frames:17 bytes:13650
                    mysql                frames:17 bytes:13650
                      mysql              frames:17 bytes:13650
                        mysql            frames:17 bytes:13650
                          mysql          frames:17 bytes:13650
                            mysql        frames:17 bytes:13650
                              mysql      frames:17 bytes:13650
                                mysql    frames:7 bytes:9136
                                ...mysql frames:7 bytes:9136
                                ...mysql frames:7 bytes:9136
                                ...mysql frames:7 bytes:9136
                                ...mysql frames:7 bytes:9136
                                ...mysql frames:7 bytes:9136
                                ...mysql frames:7 bytes:9136
                                ...mysql frames:7 bytes:9136
                                ...mysql frames:6 bytes:8556
                                ...mysql frames:6 bytes:8556
[snip]
        tcp.segments                     frames:3 bytes:2099
          mysql                          frames:3 bytes:2099
            mysql                        frames:3 bytes:2099
              mysql                      frames:3 bytes:2099
                mysql                    frames:3 bytes:2099
                  mysql                  frames:3 bytes:2099
                    mysql                frames:3 bytes:2099
                      mysql              frames:3 bytes:2099
                        mysql            frames:3 bytes:2099
                          mysql          frames:3 bytes:2099
                            mysql        frames:3 bytes:2099
                              mysql      frames:3 bytes:2099
                                mysql    frames:2 bytes:1815
                                ...mysql frames:2 bytes:1815
                                ...mysql frames:2 bytes:1815
                                ...mysql frames:2 bytes:1815
                                ...mysql frames:2 bytes:1815
                                ...mysql frames:2 bytes:1815
                                ...mysql frames:2 bytes:1815
[snip]

What does this mean? Is the mysql protocol hierarchy fragmented into minor
mysql protocols?

Ryan