-
Capture some data using tcpdump:
tcpdump -enx -w cassandra-dump port 9160
-
Open the file with wireshark and find a packet where the data looks related to casandra e.g. it has
multiget_slice
or similar commands near the start of the data. -
In wireshark select the data part of the packet and right click -> copy -> bytes -> hex stream
-
Now you need a thrift library to decode the data. thobbs/phpcassa should work.
-
Write a script to decode the data:
//the phpcassa autoloader
require_once(dirname(__DIR__).'/lib/autoload.php');
$serialized = hex2bin("800100010000000..."); //paste the hex stream in here
$transport = new \Thrift\Transport\TMemoryBuffer($serialized);
$protocol = new \Thrift\Protocol\TBinaryProtocol($transport);
$rseqid = 0; $fname = null; $mtype = 0;
$protocol->readMessageBegin($fname, $mtype, $rseqid);
//this will contain the type of operation which dictates which class can decode the data
echo "$fname\n";
//in this case it's a multiget_slice
$result = new \cassandra\Cassandra_multiget_slice_args();
$result->read($protocol);
var_dump($result);