Stream SQL to MySQL with Netcat

A SQL dump can be streamed into MySQL or MariaDB without storing it on the database host first. Netcat provides the transport while the MySQL client reads the incoming SQL from standard input. This is useful for a one-time transfer inside an isolated, trusted network where SSH is unavailable or its encryption overhead is deliberately being avoided.

Netcat provides no encryption, peer authentication, integrity protection, or application-level authorization. Anyone able to reach the listener can send input to the MySQL client. Prefer SSH for ordinary migrations; use this pattern only behind a firewall that restricts the source address, and remove the rule immediately afterward.

Store the Database Credentials

Do not put the password directly in the command line. On the receiving database host, create a MySQL login path interactively:

mysql_config_editor set \
  --login-path=netcat-import \
  --host=localhost \
  --user=importer \
  --password

The command prompts for the password and stores obfuscated credentials in the current user's mode-restricted ~/.mylogin.cnf. This keeps the password out of the process list and shell history, but it is not a substitute for protecting the operating-system account. The database account should have only the privileges required for the import.

Start the Receiver

On the database host, listen once on port 2222 and pipe the stream into the target database:

nc -l 2222 | mysql --login-path=netcat-import target_database

Restrict port 2222 to the sender's private IP before starting the listener. Some older Netcat variants use nc -l -p 2222; check nc -h on the receiving system rather than combining incompatible option styles.

Send the SQL Stream

With OpenBSD Netcat, including the version shipped by macOS, send the dump and close the socket after standard input reaches EOF:

nc -N db-private.example 2222 < query.sql

GNU Netcat commonly uses a short quit delay instead:

nc -q 1 db-private.example 2222 < query.sql

The receiver exits when the sender closes the connection. Do not use cat query.sql | nc ...; input redirection is simpler and preserves Netcat's exit status.

Compress the Transfer

For a large text dump, compress it on the sender:

gzip -c query.sql | nc -N db-private.example 2222

Then insert decompression between Netcat and the MySQL client on the receiver:

nc -l 2222 | gzip -dc | mysql --login-path=netcat-import target_database

Compression reduces network traffic but adds CPU work. It does not add confidentiality or authentication.

Verify the Import

A pipeline normally reports only the exit status of its final command. In Bash or Zsh, enable pipefail so a failed listener or decompressor also makes the receiver command fail:

set -o pipefail
nc -l 2222 | mysql --login-path=netcat-import target_database
exit_code=$?
printf 'import exit status: %s\n' "$exit_code"

Verify expected tables and row counts after the transfer, then delete the temporary firewall rule and remove the saved login path if it is no longer needed:

mysql_config_editor remove --login-path=netcat-import