mysql over TCP and far out PIDs

[Darryl Moore]

coool, I never knew about ss. Thx.

Using it I see:
# ss -l -n -p | grep mysql
LISTEN  0   50    *:3306          *:*      users:(("mysqld",9248,10))

Which matches the PID and shows mysql is listening
# ps ax | grep mysql
 9248 ?        Ssl    0:02 /usr/sbin/mysqld
 9310 pts/1    S+     0:00 tail -f /var/log/mysql/error.err
10691 pts/2    S+     0:00 grep --color=auto mysql

Yeah.

But I still get that error when I try to log in via TCP

It's not a mysql user permission issue. Besides the fact that all
servers are set up the same, I can telnet into that port with two very
different results.

# telnet 127.0.0.1 3306
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Connection closed by foreign host.

Boom. She dies right away on my broken machines, but on the one that
works, get this:

telnet localhost 3306
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
[
5.5.35-0ubuntu0.12.04.2T�JL{J?>X�6/(vA~wZ;Z2+mysql_native_password

...so it wants a password which is what I world expect.


So why does mysql listen on the port but then immediately close the
connection?

Looking further with tcpdump I see the following on the server that works.

16:21:16.372558 IP localhost.42173 > localhost.mysql: Flags [S], seq
983586562, win 32792, options [mss 16396,sackOK,TS val 415356790 ecr
0,nop,wscale 7], length 0
16:21:16.372593 IP localhost.mysql > localhost.42173: Flags [S.], seq
3147658381, ack 983586563, win 32768, options [mss 16396,sackOK,TS val
415356790 ecr 415356790,nop,wscale 7], length 0
16:21:16.372615 IP localhost.42173 > localhost.mysql: Flags [.], ack 1,
win 257, options [nop,nop,TS val 415356790 ecr 415356790], length 0
16:21:16.373238 IP localhost.mysql > localhost.42173: Flags [P.], seq
1:96, ack 1, win 256, options [nop,nop,TS val 415356790 ecr 415356790],
length 95
16:21:16.373302 IP localhost.42173 > localhost.mysql: Flags [.], ack 96,
win 257, options [nop,nop,TS val 415356790 ecr 415356790], length 0
16:21:16.373766 IP localhost.42173 > localhost.mysql: Flags [P.], seq
1:94, ack 96, win 257, options [nop,nop,TS val 415356791 ecr 415356790],
length 93
16:21:16.373831 IP localhost.mysql > localhost.42173: Flags [.], ack 94,
win 256, options [nop,nop,TS val 415356791 ecr 415356791], length 0
16:21:16.374034 IP localhost.mysql > localhost.42173: Flags [P.], seq
96:107, ack 94, win 256, options [nop,nop,TS val 415356791 ecr
415356791], length 11

--------------------------------

and on a server that does not:



tcpdump -i lo tcp port 3306
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lo, link-type EN10MB (Ethernet), capture size 65535 bytes
16:22:14.546133 IP localhost.44016 > localhost.mysql: Flags [S], seq
2958095828, win 32792, options [mss 16396,sackOK,TS val 6771500 ecr
0,nop,wscale 7], length 0
16:22:14.546171 IP localhost.mysql > localhost.44016: Flags [S.], seq
1106978560, ack 2958095829, win 32768, options [mss 16396,sackOK,TS val
6771500 ecr 6771500,nop,wscale 7], length 0
16:22:14.546195 IP localhost.44016 > localhost.mysql: Flags [.], ack 1,
win 257, options [nop,nop,TS val 6771500 ecr 6771500], length 0
16:22:14.546619 IP localhost.mysql > localhost.44016: Flags [F.], seq 1,
ack 1, win 256, options [nop,nop,TS val 6771500 ecr 6771500], length 0
16:22:14.547104 IP localhost.44016 > localhost.mysql: Flags [F.], seq 1,
ack 2, win 257, options [nop,nop,TS val 6771500 ecr 6771500], length 0
16:22:14.547140 IP localhost.mysql > localhost.44016: Flags [.], ack 2,
win 256, options [nop,nop,TS val 6771500 ecr 6771500], length 0

----------------------------

The first difference I see is this [F.] flags (bad server) and the [P.]
flags (good server)in the output. Guess I'll figure out what this means,
or port a complete transcript into wireshark.

Very baffling. Thanks for all the responses so far, and the corrections
on using netstat. I'll continue looking into this. Any other insights
would be most welcome.


On 14-02-19 01:31 PM, Neil Watson wrote:
> Also consider netstat's replacement 'ss'.
> 
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists