tcpdump -i eth1 -s  -l -w - dst port  | strings | perl -e '

while(<>) { chomp; next if /^[^ ]+[ ]*$/;

    if(/^(SELECT|UPDATE|DELETE|INSERT|SET|COMMIT|ROLLBACK|CREATE|DROP|ALTER|CALL)/i)

    {

        if (defined $q) { print "$q\n"; }

        $q=$_;

    } else {

        $_ =~ s/^[ \t]+//; $q.=" $_";

    }

}'

#执行一分钟

tcpdump -i eth0 -A -s  port  > ~/sql.log

#上步结束后分析

grep 'update' ./sql.log | head