INTERNAL
For information: I run the same query 4x and changed tcpdump logging levels
(basic, -v, -vv, -vvv). tcpdump -v, -vv, and -vvv made no difference in this
case. So there is a basic dump and a verbose dump.
tcpdump 'tcp and port 3306'
listening on ens192, link-type EN10MB (Ethernet), snapshot length 262144 bytes
10:01:47.596092 IP CLIENT.54760 > PROXY.mysql: Flags [S], seq 3405779001, win
64240, options [mss 1460,sackOK,TS val 2060637408 ecr 0,nop,wscale 7], length 0
10:01:47.596133 IP PROXY.mysql > CLIENT.54760: Flags [S.], seq 1346294803, ack
3405779002, win 65160, options [mss 1460,sackOK,TS val 1452809140 ecr
2060637408,nop,wscale 7], length 0
10:01:47.596222 IP CLIENT.54760 > PROXY.mysql: Flags [.], ack 1, win 502,
options [nop,nop,TS val 2060637408 ecr 1452809140], length 0
10:01:47.596395 IP PROXY.47996 > PERCONA.mysql: Flags [S], seq 2657131732, win
64240, options [mss 1460,sackOK,TS val 1038192193 ecr 0,nop,wscale 7], length 0
10:01:47.596538 IP PERCONA.mysql > PROXY.47996: Flags [S.], seq 2362279714, ack
2657131733, win 65160, options [mss 1460,sackOK,TS val 1688432743 ecr
1038192193,nop,wscale 7], length 0
10:01:47.596551 IP PROXY.47996 > PERCONA.mysql: Flags [.], ack 1, win 502,
options [nop,nop,TS val 1038192194 ecr 1688432743], length 0
10:01:47.596578 IP PROXY.47996 > PERCONA.mysql: Flags [P.], seq 1:50, ack 1,
win 502, options [nop,nop,TS val 1038192194 ecr 1688432743], length 49
10:01:47.596637 IP PERCONA.mysql > PROXY.47996: Flags [.], ack 50, win 509,
options [nop,nop,TS val 1688432743 ecr 1038192194], length 0
10:01:47.596849 IP PERCONA.mysql > PROXY.47996: Flags [P.], seq 1:82, ack 50,
win 509, options [nop,nop,TS val 1688432743 ecr 1038192194], length 81
10:01:47.596855 IP PROXY.47996 > PERCONA.mysql: Flags [.], ack 82, win 502,
options [nop,nop,TS val 1038192194 ecr 1688432743], length 0
10:01:47.596878 IP PERCONA.mysql > PROXY.47996: Flags [P.], seq 82:119, ack 50,
win 509, options [nop,nop,TS val 1688432743 ecr 1038192194], length 37
10:01:47.596881 IP PROXY.47996 > PERCONA.mysql: Flags [.], ack 119, win 502,
options [nop,nop,TS val 1038192194 ecr 1688432743], length 0
10:01:47.596888 IP PERCONA.mysql > PROXY.47996: Flags [F.], seq 119, ack 50,
win 509, options [nop,nop,TS val 1688432743 ecr 1038192194], length 0
10:01:47.596891 IP PERCONA.mysql > PROXY.47996: Flags [R.], seq 120, ack 50,
win 509, options [nop,nop,TS val 1688432743 ecr 1038192194], length 0
10:01:47.596902 IP PROXY.mysql > CLIENT.54760: Flags [P.], seq 1:82, ack 1, win
510, options [nop,nop,TS val 1452809141 ecr 2060637408], length 81
10:01:47.596914 IP PERCONA.mysql > PROXY.47996: Flags [R], seq 2362279796, win
0, length 0
10:01:47.596928 IP PROXY.mysql > CLIENT.54760: Flags [F.], seq 82:119, ack 1,
win 510, options [nop,nop,TS val 1452809141 ecr 2060637408], length 37
10:01:47.596944 IP CLIENT.54760 > PROXY.mysql: Flags [.], ack 82, win 502,
options [nop,nop,TS val 2060637409 ecr 1452809141], length 0
10:01:47.596966 IP PERCONA.mysql > PROXY.47996: Flags [R], seq 2362279833, win
0, length 0
10:01:47.596968 IP CLIENT.54760 > PROXY.mysql: Flags [P.], seq 1:37, ack 120,
win 502, options [nop,nop,TS val 2060637409 ecr 1452809141], length 36
10:01:47.596973 IP PROXY.mysql > CLIENT.54760: Flags [.], ack 37, win 510,
options [nop,nop,TS val 1452809141 ecr 2060637409], length 0
10:01:47.616816 IP CLIENT.54760 > PROXY.mysql: Flags [P.], seq 37:359, ack 120,
win 502, options [nop,nop,TS val 2060637429 ecr 1452809141], length 322
10:01:47.616837 IP PROXY.mysql > CLIENT.54760: Flags [R], seq 1346294923, win
0, length 0
10:01:47.616851 IP CLIENT.54760 > PROXY.mysql: Flags [F.], seq 359, ack 120,
win 502, options [nop,nop,TS val 2060637429 ecr 1452809141], length 0
10:01:47.616858 IP PROXY.mysql > CLIENT.54760: Flags [R], seq 1346294923, win
0, length 0
10:01:47.616864 IP CLIENT.54760 > PROXY.mysql: Flags [R.], seq 360, ack 120,
win 502, options [nop,nop,TS val 2060637429 ecr 1452809141], length 0
^C
26 packets captured
26 packets received by filter
0 packets dropped by kernel
tcpdump: listening on ens192, link-type EN10MB (Ethernet), snapshot length
262144 bytes
10:10:53.149329 IP (tos 0x0, ttl 64, id 7123, offset 0, flags [DF], proto TCP
(6), length 60)
CLIENT.45588 > PROXY.mysql: Flags [S], cksum 0x9372 (correct), seq
3076748161, win 64240, options [mss 1460,sackOK,TS val 2061182961 ecr
0,nop,wscale 7], length 0
10:10:53.149363 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6),
length 60)
PROXY.mysql > CLIENT.45588: Flags [S.], cksum 0x2d1b (incorrect -> 0xdbef),
seq 2036954378, ack 3076748162, win 65160, options [mss 1460,sackOK,TS val
1453354693 ecr 2061182961,nop,wscale 7], length 0
10:10:53.149438 IP (tos 0x0, ttl 64, id 7124, offset 0, flags [DF], proto TCP
(6), length 52)
CLIENT.45588 > PROXY.mysql: Flags [.], cksum 0x074f (correct), seq 1, ack
1, win 502, options [nop,nop,TS val 2061182961 ecr 1453354693], length 0
10:10:53.149613 IP (tos 0x0, ttl 64, id 37818, offset 0, flags [DF], proto TCP
(6), length 60)
PROXY.34772 > PERCONA.mysql: Flags [S], cksum 0x2d3e (incorrect -> 0x996a),
seq 3232371183, win 64240, options [mss 1460,sackOK,TS val 1038737747 ecr
0,nop,wscale 7], length 0
10:10:53.149752 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6),
length 60)
PERCONA.mysql > PROXY.34772: Flags [S.], cksum 0x42a5 (correct), seq
2602143710, ack 3232371184, win 65160, options [mss 1460,sackOK,TS val
1688978296 ecr 1038737747,nop,wscale 7], length 0
10:10:53.149764 IP (tos 0x0, ttl 64, id 37819, offset 0, flags [DF], proto TCP
(6), length 52)
PROXY.34772 > PERCONA.mysql: Flags [.], cksum 0x2d36 (incorrect -> 0x6e04),
seq 1, ack 1, win 502, options [nop,nop,TS val 1038737747 ecr 1688978296],
length 0
10:10:53.149776 IP (tos 0x0, ttl 64, id 37820, offset 0, flags [DF], proto TCP
(6), length 101)
PROXY.34772 > PERCONA.mysql: Flags [P.], cksum 0x2d67 (incorrect ->
0x38f9), seq 1:50, ack 1, win 502, options [nop,nop,TS val 1038737747 ecr
1688978296], length 49
10:10:53.149847 IP (tos 0x0, ttl 64, id 28480, offset 0, flags [DF], proto TCP
(6), length 52)
PERCONA.mysql > PROXY.34772: Flags [.], cksum 0x6dcc (correct), seq 1, ack
50, win 509, options [nop,nop,TS val 1688978296 ecr 1038737747], length 0
10:10:53.150071 IP (tos 0x0, ttl 64, id 28481, offset 0, flags [DF], proto TCP
(6), length 133)
PERCONA.mysql > PROXY.34772: Flags [P.], cksum 0x8bff (correct), seq 1:82,
ack 50, win 509, options [nop,nop,TS val 1688978297 ecr 1038737747], length 81
10:10:53.150078 IP (tos 0x0, ttl 64, id 37821, offset 0, flags [DF], proto TCP
(6), length 52)
PROXY.34772 > PERCONA.mysql: Flags [.], cksum 0x2d36 (incorrect -> 0x6d81),
seq 50, ack 82, win 502, options [nop,nop,TS val 1038737747 ecr 1688978297],
length 0
10:10:53.150088 IP (tos 0x0, ttl 64, id 3732, offset 0, flags [DF], proto TCP
(6), length 133)
PROXY.mysql > CLIENT.45588: Flags [P.], cksum 0x2d64 (incorrect -> 0x257a),
seq 1:82, ack 1, win 510, options [nop,nop,TS val 1453354694 ecr 2061182961],
length 81
10:10:53.150118 IP (tos 0x0, ttl 64, id 28482, offset 0, flags [DF], proto TCP
(6), length 89)
PERCONA.mysql > PROXY.34772: Flags [P.], cksum 0x6088 (correct), seq
82:119, ack 50, win 509, options [nop,nop,TS val 1688978297 ecr 1038737747],
length 37
10:10:53.150124 IP (tos 0x0, ttl 64, id 37822, offset 0, flags [DF], proto TCP
(6), length 52)
PROXY.34772 > PERCONA.mysql: Flags [.], cksum 0x2d36 (incorrect -> 0x6d5c),
seq 50, ack 119, win 502, options [nop,nop,TS val 1038737747 ecr 1688978297],
length 0
10:10:53.150128 IP (tos 0x0, ttl 64, id 7125, offset 0, flags [DF], proto TCP
(6), length 52)
CLIENT.45588 > PROXY.mysql: Flags [.], cksum 0x06fc (correct), seq 1, ack
82, win 502, options [nop,nop,TS val 2061182962 ecr 1453354694], length 0
10:10:53.150131 IP (tos 0x0, ttl 64, id 3733, offset 0, flags [DF], proto TCP
(6), length 89)
PROXY.mysql > CLIENT.45588: Flags [P.], cksum 0x2d38 (incorrect -> 0xfa02),
seq 82:119, ack 1, win 510, options [nop,nop,TS val 1453354694 ecr 2061182961],
length 37
10:10:53.150132 IP (tos 0x0, ttl 64, id 28483, offset 0, flags [DF], proto TCP
(6), length 52)
PERCONA.mysql > PROXY.34772: Flags [F.], cksum 0x6d54 (correct), seq 119,
ack 50, win 509, options [nop,nop,TS val 1688978297 ecr 1038737747], length 0
10:10:53.150138 IP (tos 0x0, ttl 64, id 7126, offset 0, flags [DF], proto TCP
(6), length 88)
CLIENT.45588 > PROXY.mysql: Flags [P.], cksum 0xa308 (correct), seq 1:37,
ack 82, win 502, options [nop,nop,TS val 2061182962 ecr 1453354694], length 36
10:10:53.150142 IP (tos 0x0, ttl 64, id 3734, offset 0, flags [DF], proto TCP
(6), length 52)
PROXY.mysql > CLIENT.45588: Flags [.], cksum 0x2d13 (incorrect -> 0x06ab),
seq 119, ack 37, win 510, options [nop,nop,TS val 1453354694 ecr 2061182962],
length 0
10:10:53.150151 IP (tos 0x0, ttl 64, id 28484, offset 0, flags [DF], proto TCP
(6), length 52)
PERCONA.mysql > PROXY.34772: Flags [R.], cksum 0x6d50 (correct), seq 120,
ack 50, win 509, options [nop,nop,TS val 1688978297 ecr 1038737747], length 0
10:10:53.150154 IP (tos 0x0, ttl 64, id 3735, offset 0, flags [DF], proto TCP
(6), length 52)
PROXY.mysql > CLIENT.45588: Flags [F.], cksum 0x2d13 (incorrect -> 0x06aa),
seq 119, ack 37, win 510, options [nop,nop,TS val 1453354694 ecr 2061182962],
length 0
10:10:53.150187 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6),
length 40)
PERCONA.mysql > PROXY.34772: Flags [R], cksum 0xc2c8 (correct), seq
2602143792, win 0, length 0
10:10:53.150196 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6),
length 40)
PERCONA.mysql > PROXY.34772: Flags [R], cksum 0xc2a3 (correct), seq
2602143829, win 0, length 0
10:10:53.153428 IP (tos 0x0, ttl 64, id 3736, offset 0, flags [DF], proto TCP
(6), length 52)
PROXY.mysql > CLIENT.45588: Flags [F.], cksum 0x2d13 (incorrect -> 0x06a6),
seq 119, ack 37, win 510, options [nop,nop,TS val 1453354698 ecr 2061182962],
length 0
10:10:53.153460 IP (tos 0x0, ttl 64, id 7127, offset 0, flags [DF], proto TCP
(6), length 64)
CLIENT.45588 > PROXY.mysql: Flags [.], cksum 0xf2c0 (correct), seq 37, ack
120, win 502, options [nop,nop,TS val 2061182965 ecr 1453354694,nop,nop,sack 1
{119:120}], length 0
10:10:53.169752 IP (tos 0x0, ttl 64, id 7128, offset 0, flags [DF], proto TCP
(6), length 374)
CLIENT.45588 > PROXY.mysql: Flags [P.], cksum 0xbe20 (correct), seq 37:359,
ack 120, win 502, options [nop,nop,TS val 2061182982 ecr 1453354694], length 322
10:10:53.169758 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6),
length 40)
PROXY.mysql > CLIENT.45588: Flags [R], cksum 0xd509 (correct), seq
2036954498, win 0, length 0
10:10:53.169767 IP (tos 0x0, ttl 64, id 7129, offset 0, flags [DF], proto TCP
(6), length 52)
CLIENT.45588 > PROXY.mysql: Flags [F.], cksum 0x055b (correct), seq 359,
ack 120, win 502, options [nop,nop,TS val 2061182982 ecr 1453354694], length 0
10:10:53.169772 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6),
length 40)
PROXY.mysql > CLIENT.45588: Flags [R], cksum 0xd509 (correct), seq
2036954498, win 0, length 0
10:10:53.169777 IP (tos 0x0, ttl 64, id 7130, offset 0, flags [DF], proto TCP
(6), length 52)
CLIENT.45588 > PROXY.mysql: Flags [R.], cksum 0x0557 (correct), seq 360,
ack 120, win 502, options [nop,nop,TS val 2061182982 ecr 1453354694], length 0
^C
29 packets captured
29 packets received by filter
0 packets dropped by kernel
From: Илья Шипицин <[email protected]>
Sent: Wednesday, June 24, 2026 9:25 AM
To: Marc Hoppins <[email protected]>
Cc: [email protected]
Subject: Re: [EXT]Re: HAProxy and Percona
[External Sender]
I had Fedora linux available, but no package of Percona server.
once I'll install Ubuntu, I'll give it a try
ср, 24 июн. 2026 г. в 08:44, Marc Hoppins
<[email protected]<mailto:[email protected]>>:
INTERNAL
I managed to get this out of the general_log. I am unable to determine if the
proxy sent incorrect session information or the percona just refuses to accept
it.
15:21:20.281473 IP CLIENT.55386 > PROXY.mysql: Flags [S], seq 961108031, win
64240, options [mss 1460,sackOK,TS val 1993410093 ecr 0,nop,wscale 7], length 0
15:21:20.281506 IP PROXY.mysql > CLIENT.55386: Flags [S.], seq 3122485353, ack
961108032, win 65160, options [mss 1460,sackOK,TS val 1385581826 ecr
1993410093,nop,wscale 7], length 0
15:21:20.281575 IP CLIENT.55386 > PROXY.mysql: Flags [.], ack 1, win 502,
options [nop,nop,TS val 1993410093 ecr 1385581826], length 0
15:21:20.281695 IP PROXY.32826 > PERCONA.mysql: Flags [S], seq 1728864001, win
64240, options [mss 1460,sackOK,TS val 970964879 ecr 0,nop,wscale 7], length 0
15:21:20.281853 IP PERCONA.mysql > PROXY.32826: Flags [S.], seq 2520953573, ack
1728864002, win 65160, options [mss 1460,sackOK,TS val 1621205428 ecr
970964879,nop,wscale 7], length 0
15:21:20.281865 IP PROXY.32826 > PERCONA.mysql: Flags [.], ack 1, win 502,
options [nop,nop,TS val 970964879 ecr 1621205428], length 0
15:21:20.281884 IP PROXY.32826 > PERCONA.mysql: Flags [P.], seq 1:50, ack 1,
win 502, options [nop,nop,TS val 970964879 ecr 1621205428], length 49
15:21:20.281968 IP PERCONA.mysql > PROXY.32826: Flags [.], ack 50, win 509,
options [nop,nop,TS val 1621205429 ecr 970964879], length 0
15:21:20.282196 IP PERCONA.mysql > PROXY.32826: Flags [P.], seq 1:82, ack 50,
win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 81
15:21:20.282200 IP PROXY.32826 > PERCONA.mysql: Flags [.], ack 82, win 502,
options [nop,nop,TS val 970964879 ecr 1621205429], length 0
15:21:20.282214 IP PROXY.mysql > CLIENT.55386: Flags [P.], seq 1:82, ack 1, win
510, options [nop,nop,TS val 1385581826 ecr 1993410093], length 81
15:21:20.282222 IP PERCONA.mysql > PROXY.32826: Flags [P.], seq 82:119, ack 50,
win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 37
15:21:20.282225 IP PROXY.32826 > PERCONA.mysql: Flags [.], ack 119, win 502,
options [nop,nop,TS val 970964879 ecr 1621205429], length 0
15:21:20.282230 IP PERCONA.mysql > PROXY.32826: Flags [F.], seq 119, ack 50,
win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 0
15:21:20.282232 IP PERCONA.mysql > PROXY.32826: Flags [R.], seq 120, ack 50,
win 509, options [nop,nop,TS val 1621205429 ecr 970964879], length 0
15:21:20.282246 IP PROXY.mysql > CLIENT.55386: Flags [F.], seq 82:119, ack 1,
win 510, options [nop,nop,TS val 1385581826 ecr 1993410093], length 37
15:21:20.282254 IP CLIENT.55386 > PROXY.mysql: Flags [.], ack 82, win 502,
options [nop,nop,TS val 1993410094 ecr 1385581826], length 0
15:21:20.282261 IP PERCONA.mysql > PROXY.32826: Flags [R], seq 2520953655, win
0, length 0
15:21:20.282273 IP PERCONA.mysql > PROXY.32826: Flags [R], seq 2520953692, win
0, length 0
15:21:20.282277 IP CLIENT.55386 > PROXY.mysql: Flags [P.], seq 1:37, ack 82,
win 502, options [nop,nop,TS val 1993410094 ecr 1385581826], length 36
15:21:20.282285 IP PROXY.mysql > CLIENT.55386: Flags [.], ack 37, win 510,
options [nop,nop,TS val 1385581826 ecr 1993410094], length 0
15:21:20.301595 IP CLIENT.55386 > PROXY.mysql: Flags [P.], seq 37:359, ack 120,
win 502, options [nop,nop,TS val 1993410113 ecr 1385581826], length 322
15:21:20.301605 IP PROXY.mysql > CLIENT.55386: Flags [R], seq 3122485473, win
0, length 0
15:21:20.301614 IP CLIENT.55386 > PROXY.mysql: Flags [F.], seq 359, ack 120,
win 502, options [nop,nop,TS val 1993410113 ecr 1385581826], length 0
15:21:20.301619 IP PROXY.mysql > CLIENT.55386: Flags [R], seq 3122485473, win
0, length 0
15:21:20.301623 IP CLIENT.55386 > PROXY.mysql: Flags [R.], seq 360, ack 120,
win 502, options [nop,nop,TS val 1993410113 ecr 1385581826], length 0
From: Илья Шипицин <[email protected]<mailto:[email protected]>>
Sent: Thursday, June 18, 2026 4:00 PM
To: Marc Hoppins <[email protected]<mailto:[email protected]>>
Cc: [email protected]<mailto:[email protected]>
Subject: [EXT]Re: HAProxy and Percona
[External Sender]
as a naive guess, maybe adding " mode tcp" to frontend will help
(you have that in "default" and likely it should be inherited, but I specify
explicitly)
ср, 17 июн. 2026 г. в 14:08, Marc Hoppins
<[email protected]<mailto:[email protected]>>:
INTERNAL
Hi,
I am trying to get source IP recognition sorted to a percona cluster.
Following a directive to configure the proxy/percona setup to correctly
identify client operations by source address, I reconfigured percona backends
with send-proxy. I now have:
source-host - proxy-node - percona node (8.4.7)
I installed mysql. If I connect to source to proxy-node:3306 I get:-
ERROR 2026 (HY000): SSL connection error: error:0A00010B:SSL routines::wrong
version number
I did try (from source) openssl s_client and gave path to the directory where
our certificates are. It is the same path on all installed hosts companywide
and contains the same base certificates, including our own self-signed one(s).
I do see
verify error:num=19:self-signed certificate in certificate chain
from the output but I am reluctant to admit this is the cause. I did try
removing (commenting out) the ssl bind options fro HAproxy config and
restarting but the same error (ERROR 2026) appears. I can find no 8.4.7 client
from percona.
HAPROXY for the front/back
defaults pxc_d2
log global
mode tcp
option tcplog
option dontlognull
retries 3
timeout connect 10s
timeout client 1h
timeout server 1h
frontend pxc-d2-frontend from pxc_d2
bind *:3306
use_backend pxc-d2-backend
backend pxc-d2-backend from pxc_d2
default-server inter 1001 rise 3 fall 3 on-marked-down shutdown-sessions
default-server port 9200 check send-proxy
balance roundrobin
server d2-db-node01 xx.xx.140.45:3306
server d2-db-node02 xx.xx.140.46:3306 backup
server d2-db-node03 xx.xx.140.47:3306 backup
Where would I see any access attempts from client to target? The haproxy.log
shows nothing, only regular Zabbix connections.
Initially I contacted percona thinking that it was a problem with TLS/SSL and
their interactions may be seen here
https://forums.percona.com/t/connecting-to-database-through-haproxy/40920
Any ideas would be helpful.
Marc
