MySQL wire protocol
The MySQL wire protocol is the TCP message format MySQL's own client libraries use to connect, authenticate and exchange queries with a mysqld server, normally on port 3306. AdminKit's guide to checking an exposed MySQL port explains why a reachable 3306 has been a documented ransomware target since 2017.
By AdminKit team, Netbase JSC · Updated
The MySQL wire protocol, documented in MySQL’s own developer reference, is the message format a client or driver uses to open a connection, authenticate, and run queries over TCP, normally on port 3306, which IANA registers for MySQL. It runs in two phases: a connection phase that negotiates capabilities, authentication method and optional TLS, then a command phase that carries queries and results. It’s MySQL-specific rather than a shared database standard, which is why a PostgreSQL or MongoDB driver can’t speak to a MySQL server directly — the same relationship this glossary’s PostgreSQL wire protocol entry describes for its own database. Whether this protocol is reachable from the internet at all depends entirely on which interface mysqld binds to, a setting separate from the authentication the protocol itself carries.