Progress Report - MySQL Auditing Software - Traffic Analyzer Component

[Warren Kenny]

Step 1 in the construction of the Traffic Analyzer module has been
completed. The current prototype can capture traffic passively and display
their contents and/or dump to a file. More details on the requirements for
step 1 can be found here:

http://code.google.com/p/soc2007-mysql-auditing-software/issues/detail?id=1&can=1&q=

Currently I am working on a class for decoding MySQL-specific commands from
packet payloads using the information on the MySQL Forge site's MySQL
Internals documentation as a basis

http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol

Additionally I am implementing classes for tracking sessions based on
connection information and decoded user credentials in initial connection
packets.

http://forge.mysql.com/wiki/MySQL_Internals_ClientServer_Protocol#Client_Authentication_Packet

Once I've implemented these features I intend to begin work porting the code
to the Windows branch, using winpcap instead of libpcap and making whatever
other changes are necessary.

Regards,
Warren