What does port 3306 mean?port 3306 是什么意思？
port 3306 identifies a specific part of the path applications use to reach MySQL. A successful low-level test proves only that one stage responded. A usable database session also requires correct name resolution, route, 3306, the MySQL client/server protocol, compatible client software, TLS trust, authentication, database selection and permission for the intended operation.port 3306 标识应用程序访问 MySQL 连接路径中的特定组成部分。低层测试成功只证明一个阶段有响应。可用数据库会话还需要正确的名称解析、路由、3306、协议、兼容客户端、TLS 信任、认证、数据库选择以及目标操作权限。
Treat 3306 as the default MySQL classic-protocol port, not as proof that every MySQL client should use it or that a login will work. From the failing workload, capture the resolved endpoint, configured port, MySQL and connector versions, TCP result, SSL mode, server certificate outcome, account host pattern and exact MySQL error number without exposing credentials.应把 3306 视为 MySQL classic protocol 的默认端口，而不是所有 MySQL 客户端都必须使用的端口，也不能据此证明登录成功。从失败工作负载记录解析端点、配置端口、MySQL 与连接器版本、TCP 结果、SSL 模式、服务器证书结果、账户 host 匹配模式和准确 MySQL 错误号，但不要暴露凭据。
Follow the MySQL protocol beyond port 3306沿着 MySQL 协议继续检查 port 3306
A TCP connection to port 3306 is only the opening event in a MySQL session. After the socket is accepted, the server sends an initial handshake that identifies the protocol version, server capabilities, default character set and an authentication challenge. The client responds with its own capability flags, the account name, authentication data and—when requested—the target database. A failure at any of these points can occur after a port checker reports success.TCP 成功连接 port 3306 只是 MySQL 会话的开始。套接字被接受后，服务器会发送初始握手，其中包含协议版本、服务器能力、默认字符集和认证挑战。客户端随后返回自己的能力标志、账户名、认证数据，并在需要时提供目标数据库。以上任一阶段都可能在端口检查显示成功之后失败。
This distinction matters when comparing clients. A current MySQL client may negotiate TLS and a modern authentication plugin correctly, while an older connector reaches the same listener but cannot complete authentication. Record the client library, exact version, runtime architecture and authentication plugin before changing the network. If one client works and another does not from the same host, the most useful next comparison is usually the handshake and client capability set—not another firewall test.比较不同客户端时，这一区别非常关键。新版本 MySQL 客户端可能能够正确协商 TLS 和现代认证插件，而旧连接器虽然到达同一监听器，却无法完成认证。修改网络之前，应记录客户端库、准确版本、运行时架构和认证插件。如果同一主机上一个客户端成功、另一个失败，下一步最有价值的比较通常是握手与客户端能力，而不是再次测试防火墙。
| Observed result观察结果 | What is already proven已经证明 | What to inspect next下一步检查 |
|---|---|---|
| TCP timeoutTCP 超时 | No usable transport path was established.尚未建立可用的传输路径。 | DNS answer, route, security group, firewall and listener address.DNS 结果、路由、安全组、防火墙和监听地址。 |
| Server greeting appears收到服务器问候包 | The endpoint speaks the MySQL client/server protocol.端点正在使用 MySQL 客户端/服务器协议。 | TLS mode, authentication plugin and client capability compatibility.TLS 模式、认证插件与客户端能力兼容性。 |
| Access denied访问被拒绝 | Transport and enough protocol negotiation completed to evaluate identity.传输和足够的协议协商已经完成，可进入身份判断。 |
The matched user@host account, secret,
plugin and account state.实际匹配的
user@host
账户、密钥、插件及账户状态。
|
| Unknown database未知数据库 | The session reached database selection.会话已经到达数据库选择阶段。 | Database spelling, deployment environment and account visibility.数据库名称拼写、部署环境与账户可见范围。 |
Diagnose MySQL account and host matching诊断 MySQL 账户与主机匹配
MySQL does not authenticate a username in isolation. It selects an account row using both the user name and the client host, then applies that row’s authentication plugin, credential state and privileges. This is why a service may connect from a developer laptop but receive an access-denied response from a container, a new subnet or a failover node. The two clients can present the same user name yet match different account rows—or fail to match an intended row at all.MySQL 并不是只根据用户名进行认证。它会同时使用用户名和客户端主机选择账户记录，然后应用该记录的认证插件、凭据状态和权限。因此，同一个服务可能从开发者电脑连接成功，却在容器、新子网或故障切换节点中收到访问拒绝。两个客户端即使提供相同用户名，也可能匹配不同账户记录，或者根本没有匹配到预期记录。
Investigate the effective source as MySQL sees it. NAT, proxies and managed database gateways can make that source different from the application’s local address. Compare the intended account definition with the account actually selected, but do not solve the problem by creating a broad wildcard host or granting global privileges. A safer correction is a narrowly scoped runtime account for the approved source range, the required authentication method and only the schema permissions the workload needs.排查时应确认 MySQL 实际看到的来源。NAT、代理和托管数据库网关可能使该来源不同于应用本地地址。把预期账户定义与实际选中的账户进行比较，但不要通过创建宽泛的通配主机或授予全局权限来解决问题。更安全的做法是为获准来源范围创建范围明确的运行账户，使用所需认证方法，并只授予工作负载需要的 Schema 权限。
Evidence to retain: sanitized account name, observed source class, server version, authentication plugin, TLS mode, selected database and exact MySQL error number. Never capture the password hash, plaintext secret or complete production URI.建议保留的证据：脱敏账户名、观察到的来源类别、服务器版本、认证插件、TLS 模式、所选数据库和准确的 MySQL 错误编号。不要记录密码哈希、明文密钥或完整生产 URI。
Use MySQL errors to choose the next test根据 MySQL 错误选择下一项测试
The error text and number narrow the failing layer more reliably than the phrase “database connection failed.” Client error 2003 commonly means the client could not establish the expected network connection to the named host and port; error 2002 often appears with a local socket or local connection path. Server error 1045 indicates that the request progressed far enough for the server to reject authentication or account matching. Preserve the exact code before retry libraries wrap it in a generic exception.与“数据库连接失败”相比，准确的错误文本和编号更能缩小故障层级。客户端错误 2003 通常表示无法与指定主机和端口建立预期网络连接；错误 2002 常见于本地套接字或本地连接路径；服务器错误 1045 则表明请求已经到达服务器身份判断阶段，但认证或账户匹配被拒绝。应在重试库把错误包装成通用异常之前保存原始编号。
| Signal信号 | Do first优先操作 | Avoid避免操作 |
|---|---|---|
| 2003 / connection timed out2003 / 连接超时 | Resolve the host in the failing runtime and run a bounded TCP test to the resolved address.在失败运行时解析主机，并对解析地址执行有时间上限的 TCP 测试。 | Rotating credentials; authentication has not started.轮换凭据；此时认证尚未开始。 |
| 1045 / access denied1045 / 访问被拒绝 | Check the matched account host, plugin, account state and secret delivery.检查匹配的账户主机、插件、账户状态和密钥交付。 | Opening the firewall more broadly; the server already answered.扩大防火墙开放范围；服务器已经响应。 |
| Certificate identity failure证书身份校验失败 | Compare the requested DNS name with certificate identities and the active trust store.比较请求 DNS 名称、证书身份和实际使用的信任库。 | Permanently disabling identity verification.永久关闭身份校验。 |
| Too many connections连接数过多 | Inspect active sessions, pool limits, leak behavior and admission control.检查活动会话、连接池上限、泄漏行为和准入控制。 | Raising the server limit without a memory and workload review.未评估内存和负载就直接提高服务器上限。 |
Change a port 3306 path without losing evidence在保留证据的前提下变更 port 3306 路径
A MySQL endpoint change affects more than a firewall rule. Long-lived pools may continue using old sessions, replicas may accept a different operation set, DNS caches may retain old addresses, and certificate identity may change before every client trust store is ready. Define success as a complete application transaction through the new path, not as a green socket check. Test a fresh connection, pooled reuse, a bounded read, the required write path when approved, and reconnection after a controlled interruption.MySQL 端点变更影响的不只是防火墙规则。长连接池可能继续使用旧会话，副本可能只接受不同范围的操作，DNS 缓存可能保留旧地址，而证书身份也可能在所有客户端信任库准备完成之前发生变化。成功标准应是通过新路径完成完整应用事务，而不是端口测试变绿。应测试新建连接、连接池复用、有界只读操作、获准情况下的必要写入路径，以及受控中断后的重新连接。
Use a canary workload that has the same driver, authentication mode and pool configuration as production. Monitor connection creation latency, authentication errors, rejected sessions, pool wait time and representative query outcomes by endpoint. Keep the old path available only for a defined overlap window, establish an explicit rollback trigger, and remove temporary accounts or network rules once traffic evidence shows that every consumer has migrated.灰度工作负载应与生产使用相同驱动、认证模式和连接池配置。按端点监控连接创建延迟、认证错误、被拒会话、连接池等待时间和代表性查询结果。旧路径只能在明确的重叠窗口内保留，同时设置清晰回滚触发条件；当流量证据证明所有消费者均已迁移后，应删除临时账户和网络规则。
Prove the port 3306 path with session evidence使用会话证据证明 port 3306 路径
Close the investigation with evidence from the same workload identity that originally failed. Record the resolved endpoint, server version, current database, encrypted-session state and a read-only identity check. Then run one bounded query representative of the application’s normal access pattern and capture elapsed time without customer data. This establishes that the client reached the intended MySQL service, completed authentication, entered the right database and received a usable result.调查结束时，应使用最初失败的同一工作负载身份保留证据。记录解析端点、服务器版本、当前数据库、加密会话状态和只读身份检查。然后执行一条代表应用正常访问模式的有界查询，并在不包含客户数据的情况下记录耗时。这样可以证明客户端到达目标 MySQL 服务、完成认证、进入正确数据库并获得可用结果。
Repeat the check after one pool lifetime and after a controlled reconnect. A result obtained only on the first connection can miss DNS rotation, expired credentials, certificate renewal and stale pooled sessions. Define an owner for every follow-up action, attach the sanitized error and before/after evidence to the change record, and state exactly what remains untested—for example write permission, replica failover or production-scale concurrency. Evidence with explicit scope is more useful than the unsupported statement “port 3306 is fixed.”应在一个连接池生命周期后以及受控重连后重复检查。只在首次连接获得的结果可能遗漏 DNS 轮换、凭据过期、证书续期和池中陈旧会话。为每项后续动作指定负责人，把脱敏错误及变更前后证据附到变更记录，并明确说明尚未测试的内容，例如写权限、副本切换或生产规模并发。具有明确范围的证据，比“port 3306 已修复”这一缺少限定的结论更有价值。
Correlate each acceptance attempt with the MySQL server log using a precise timestamp and connection source. This confirms that the expected server—not an unintended proxy or replica—processed the session and provides a durable reference if the symptom returns.使用准确时间戳和连接来源，把每次验收尝试与 MySQL 服务器日志关联。这样可以确认处理会话的是预期服务器，而不是非预期代理或副本，并在问题复发时提供可追溯依据。
A repeatable port 3306 diagnostic workflow可重复的 port 3306 诊断流程
Move from observed runtime context to the first failing stage, then validate the smallest safe correction.从实际运行上下文定位首个失败阶段，再验证最小安全修正。
- Capture the exact context捕获准确上下文Record time, runtime identity, source network, driver/version, sanitized configuration, endpoint, database and error.记录时间、运行身份、来源网络、驱动/版本、脱敏配置、端点、数据库和错误。
- Resolve the effective destination解析实际目标Verify DNS answers, route, proxy and the exact 3306 used by the process.验证 DNS 答案、路由、代理以及进程实际使用的 3306。
- Test transport and TLS测试传输与 TLSMeasure socket and handshake stages separately; verify trust chain and server identity.分别测量套接字与握手阶段，验证信任链和服务器身份。
- Test identity and target scope测试身份与目标范围Validate MySQL account host matching, authentication plugin and privileges, database or service selection and effective permissions.验证 MySQL account host matching, authentication plugin and privileges、数据库或服务选择以及有效权限。
- Run a minimal safe operation运行最小安全操作Use a deterministic, bounded, read-only operation before representative workload testing.先运行确定性、有界、只读操作，再进行代表性工作负载测试。
- Correct, retest and monitor修正、重测与监控Change one controlled variable, preserve rollback, retest from the failing context and watch recurrence.一次只改变一个受控变量，保留回滚，从失败上下文重测并观察复发。
Prepare port 3306 evidence for compatibility review为兼容性审查准备 port 3306 证据
Prepare sanitized engine and version, client runtime, driver and version, source environment, endpoint, 3306, database or service, TLS mode, authentication method, effective non-secret properties, exact error, first failing stage and recent changes. Never include passwords, tokens, private keys or unredacted production strings.准备脱敏后的引擎与版本、客户端运行时、驱动与版本、来源环境、端点、3306、数据库或服务、TLS 模式、认证方法、有效非密钥属性、准确错误、首个失败阶段和近期变更。不要包含密码、令牌、私钥或未脱敏生产字符串。
Review port 3306 compatibility审查 port 3306 兼容性
Use the InfiniSynapse DB Compatibility Checker to review the MySQL server family, client connector, classic-protocol endpoint and TLS requirements from sanitized inputs. Then connect with the real connector or MySQL client using the intended SSL mode and account context; a compatibility review cannot evaluate host-specific account matching or live grants.可使用 InfiniSynapse DB Compatibility Checker 根据脱敏输入检查 MySQL 服务系列、客户端连接器、classic protocol 端点和 TLS 要求。随后应使用真实连接器或 MySQL 客户端，按目标 SSL 模式和账户上下文连接；兼容性检查无法判断按 host 匹配的账户或实时授权。
Open DB Compatibility Checker打开 DB Compatibility Checkerport 3306 FAQport 3306 常见问题
What uses port 3306?什么服务使用 3306 端口？
Port 3306 is the default TCP port for the classic MySQL client/server protocol. Administrators and managed services can choose another port, and MySQL X Protocol commonly uses a different endpoint, so always read the actual application or service configuration.3306 是 MySQL 经典客户端/服务器协议的默认 TCP 端口。管理员和托管服务可以选择其他端口，MySQL X Protocol 通常也使用不同端点，因此必须以实际应用或服务配置为准。
How do I test a MySQL service on port 3306?如何测试 3306 端口上的 MySQL 服务？
Test TCP from the failing runtime, then use an approved MySQL client or the application connector with the exact host, port and intended SSL mode. Complete authentication and a minimal SELECT 1; a raw socket or greeting only proves that something answered on the port.先从失败运行时测试 TCP，再使用获准 MySQL 客户端或应用连接器，按准确主机、端口和目标 SSL 模式连接。完成认证并执行最小 SELECT 1；原始套接字或握手问候只能证明端口上有服务响应。
Why is port 3306 reachable but MySQL login fails?为什么 3306 可达但 MySQL 登录失败？
MySQL can reject the matched user-and-host account, password, authentication plugin, TLS requirement or requested database after TCP succeeds. Error 1045 is an authentication and account-matching signal, not a closed-port result. Compare the connector source host and the server's intended account rule.TCP 成功后，MySQL 仍可能因匹配到的 user-and-host 账户、密码、认证插件、TLS 要求或目标数据库而拒绝连接。错误 1045 表示认证与账户匹配问题，不是端口关闭；应核对连接器来源主机与服务端预期账户规则。
Should MySQL port 3306 be open to the internet?MySQL 3306 端口应该向公网开放吗？
Normally no. Bind or route the MySQL endpoint privately and restrict source access to approved application networks. If an external path is unavoidable, require a reviewed gateway or narrow allowlist, VERIFY_IDENTITY-style certificate checks, strong accounts, monitoring and explicit risk approval.通常不应。MySQL 端点应通过绑定或路由保持私有，并把来源访问限制在获准应用网络。若确实无法避免外部路径，应采用经过评审的网关或严格允许列表、类似 VERIFY_IDENTITY 的证书校验、强账户、监控和明确风险批准。
What MySQL connection evidence is safe to share?哪些 MySQL 连接证据可以安全分享？
Share the MySQL and connector versions, anonymized endpoint class, configured port, SSL mode, certificate-verification result, error number, SQLSTATE and a redacted account host pattern. Never share passwords, authentication strings, private keys, tokens or a full production URI.可以分享 MySQL 与连接器版本、匿名化端点类型、配置端口、SSL 模式、证书验证结果、错误号、SQLSTATE 和脱敏账户 host 模式。切勿分享密码、authentication_string、私钥、令牌或完整生产 URI。
How do I change a MySQL port or endpoint safely?如何安全变更 MySQL 端口或端点？
Prepare the new listener or managed endpoint and its firewall, DNS, TLS and account rules before switching clients. Test representative connectors, canary selected pools, monitor MySQL errors and connection latency, keep the former endpoint for rollback, and retire it only after pooled sessions and scheduled jobs drain.切换客户端前，应准备好新监听器或托管端点及其防火墙、DNS、TLS 和账户规则。测试代表性连接器，灰度切换部分连接池，监控 MySQL 错误与连接延迟，保留旧端点用于回滚，并在连接池会话和计划任务排空后再下线。