MySQL Error 2013 at the initial handshake means the client lost its connection before authentication and session setup began. Start by proving that the server is listening on the expected address and port, then test TCP reachability from the application network. Check that you are using the classic protocol on port 3306 rather than X Protocol on 33060, investigate DNS and host-cache blocks, and only then increase connect_timeout for a demonstrably slow link.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What ERROR 2013 means at the initial handshake
A normal MySQL connection has several stages: the client resolves a hostname, opens a TCP connection, receives the server’s initial handshake packet, negotiates capabilities and TLS if applicable, authenticates, and creates a session. The message ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet' or 'waiting for initial communication packet' identifies a failure in the early part of that sequence. The connection disappeared before ordinary username, password, and database-grant checks could complete.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That timing changes the troubleshooting order. A bad password normally produces an authentication error after the handshake. Error 2013 at this stage more often indicates an unreachable listener, a filtered or misrouted port, a protocol mismatch, DNS delay, a host-cache block, a proxy/backend failure, or a timeout that is too short for the initial response. MySQL documentation describes lost-connection errors as usually related to connectivity and notes that a short connect_timeout can matter when the loss occurs during the initial connection.
Use the symptom to choose the first check
| Observed result | Most likely layer | First action |
|---|---|---|
| TCP test is refused immediately | No process is accepting that address and port, or a firewall is actively rejecting it | Confirm mysqld is running, the port, bind_address, and firewall rules |
| TCP test times out | Routing, security-group, firewall, tunnel, or proxy filtering | Trace the path and inspect filtering at every hop |
| TCP opens, but the MySQL client reports 2013 immediately | Wrong protocol/port, proxy or backend failure, malformed early traffic, or host policy | Verify classic protocol on 3306 and inspect server/proxy logs |
| Only remote clients fail; local clients work | Loopback-only bind, disabled networking, remote firewall, DNS, or grants | Test the same host, port, and protocol used by the application |
| Connection eventually succeeds after retries | Slow DNS, congested path, overloaded proxy, or an overly small timeout | Measure initial-response time, then tune connect_timeout if reachability is already proven |
| One client address fails after many interrupted attempts | Host-cache blocking or connection-error threshold | Inspect performance_schema.host_cache and clear the block administratively |
Step 1: Confirm the server endpoint and listener
Verify that mysqld is running
On a systemd-based Linux host, an administrator can check the service with sudo systemctl status mysql or the distribution’s equivalent service name. A stopped service, crash loop, or startup failure must be fixed before any client-side change. Read the MySQL error log for the startup result and the configured network settings.
#1 Best Overall
From an administrative MySQL session, inspect the effective values rather than relying only on a configuration file:
SHOW VARIABLES WHERE Variable_name IN ('port','bind_address','skip_networking','connect_timeout','skip_name_resolve');The conventional classic-protocol port is 3306. A nonstandard port is valid, but every client, firewall rule, tunnel, container mapping, and proxy must use the same value.
Check whether TCP networking is disabled
If skip_networking is enabled, mysqld accepts local socket connections but no TCP/IP connections. Remote clients will therefore fail regardless of credentials. Remove or disable that setting only when TCP access is required, restart according to your change procedure, and verify the listener afterward.
Check the bind address
bind_address=127.0.0.1 (or an equivalent loopback-only setting) accepts connections from the server itself but not from another machine. Bind to the specific server interface that should receive database traffic, or to an appropriate all-interface address when your security design permits it. Narrow the firewall and grants to trusted networks; changing the bind address alone should not expose a database to the internet.
Confirm the actual listening socket with the operating system’s network tools, for example ss -ltnp | grep 3306 on Linux. The output should show mysqld listening on the address and port your client is meant to reach, not merely on loopback.
Step 2: Test TCP reachability from the client network
Run the test from the same host, container, virtual network, or office network where the failing application runs. Testing from the database server itself can hide a route or firewall problem.
nc -vz DB_HOST 3306If netcat is unavailable, use telnet DB_HOST 3306 or an equivalent platform TCP check. Replace DB_HOST and 3306 with the exact endpoint configured in the application.
Rank #2
- Connection refused: the address is reachable, but no service is accepting that port or an active rule is rejecting it. Check mysqld status, the effective port, bind address, and host firewall.
- Connection timed out: packets are being dropped or misrouted. Check cloud security groups, network ACLs, firewalls, VPN routes, container publishing, and intermediate proxies.
- Connection succeeds: TCP is open, so continue with protocol, DNS, host-cache, proxy, and timeout checks. A successful TCP probe does not prove that the MySQL handshake is being forwarded correctly.
Do not treat these interpretations as proof by themselves. Correlate the result with server, firewall, load-balancer, and proxy logs at the same timestamp.
Step 3: Match the client protocol to the port
MySQL has separate classic and X Protocol listeners. The traditional mysql command-line client speaks the classic protocol and normally connects to port 3306. X Protocol normally uses port 33060. They are not interchangeable.
Using a classic-protocol client against an X Protocol port can produce Error 2013 while reading the initial communication packet because the two protocols expect different connection initialization. Conversely, an X Protocol client pointed at the classic listener will fail for the same fundamental reason.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check the complete client command, not just the hostname:
mysql --protocol=TCP --host=DB_HOST --port=3306 --user=DB_USER -pThe explicit --protocol=TCP option is useful during diagnosis because it prevents the client from silently selecting a local Unix socket. Use the X Protocol port only with a client and driver designed for X Protocol.
Step 4: Eliminate the localhost and socket trap
On many systems, mysql -h localhost uses a Unix socket rather than TCP. A local socket can work while every remote TCP attempt fails because networking is disabled, mysqld is bound only to loopback, or a firewall blocks the port. That is not contradictory; it is a different transport.
For a meaningful comparison, force TCP and use the same endpoint as the application:
mysql --protocol=TCP --host=127.0.0.1 --port=3306 --user=DB_USER -pThen repeat from the remote network with the production hostname or IP. Keep the host, port, protocol, TLS options, and user equivalent between tests. A successful local socket login does not validate the remote path.
Step 5: Check DNS resolution and grant matching
Understand the lookup path
For non-localhost TCP clients, MySQL may perform reverse and forward DNS lookups. A slow or broken lookup can delay the handshake; inconsistent forward and reverse records can also affect host-based grant matching. Test name resolution from both the client and server networks with your platform’s DNS tools, and compare the result with the address shown in connection logs.
Use skip_name_resolve deliberately
The skip_name_resolve setting disables DNS host-name lookups. MySQL documentation states that it must be enabled at server startup. When it is enabled, grant-table Host values must use IP addresses (or appropriate network patterns), not DNS host names.
Before changing this setting, inventory accounts and their host columns:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsSELECT User, Host FROM mysql.user ORDER BY User, Host;Convert or create the required IP-based grants through your normal access-change process, test a least-privileged account, and only then enable the setting if it solves a measured DNS problem. Otherwise, you can replace a handshake delay with a new access-denied failure.
If DNS is the actual cause, repairing resolver configuration or adding a controlled hosts-file entry may be safer than changing global name-resolution behavior. Document any static mapping and its renewal responsibility.
Step 6: Inspect and clear host-cache blocks
MySQL tracks connection errors by client address in its host cache. Repeated interrupted handshakes can cause a legitimate host to be blocked after the configured connection-error threshold is exceeded. Inspect the cache for the affected client IP, validation state, and error counters:
SELECT IP, HOST, HOST_VALIDATED, SUM_CONNECT_ERRORS, COUNT_HOST_BLOCKED_ERRORS, COUNT_NAMEINFO_TRANSIENT_ERRORS, COUNT_ADDRINFO_TRANSIENT_ERRORS, COUNT_FCRDNS_ERRORS FROM performance_schema.host_cache WHERE IP = 'CLIENT_IP';Column availability can vary by MySQL version, so select the columns present in your server’s performance_schema.host_cache table. The error log and the Connection_errors_* status variables provide additional context.
After correcting the underlying network or handshake fault, an administrator can clear host-cache state with:
mysqladmin -u ADMIN_USER -p flush-hostsUse the documented SQL or administrative host-cache flush mechanism supported by your version if that command is unavailable. The current MySQL 9.7 reference documents a default max_connect_errors value of 100. Raising that value alone does not repair a broken route, malformed traffic, or a host that should not be connecting; treat it as a policy decision only after connectivity is healthy.
Step 7: Tune connect_timeout only after reachability is proven
connect_timeout controls how long the server waits for a client connection packet during the initial exchange. It is a targeted remedy when the server is reachable but a long-distance, congested, or otherwise slow path cannot complete the initial response within the current value. MySQL guidance suggests trying 10 seconds or more for long-distance or slow links.
Inspect the current value:
SHOW VARIABLES LIKE 'connect_timeout';Change it using the scope and persistence method supported by your MySQL version and change policy. For a temporary test on versions that permit dynamic changes:
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11SET GLOBAL connect_timeout = 10;Reconnect from the same client network and compare the timing and Aborted_connects counter before and after. Persist the setting only if the test demonstrates a slow-but-valid path. A larger timeout cannot open a closed port, correct a wrong protocol, bypass a firewall, or make an unhealthy proxy reach its backend; it can instead make failed clients wait longer.
Step 8: Read the server evidence
Status counters
Capture counters before a controlled retry, then capture them again:
Best Value
SHOW GLOBAL STATUS LIKE 'Aborted_connects';
SHOW GLOBAL STATUS LIKE 'Connection_errors%';Aborted_connects records failed initial connection attempts seen by the server. The Connection_errors_* family helps separate address, permission, handshake, and internal connection failures. A rising counter during each test confirms that the server is receiving and rejecting or losing attempts; an unchanged counter while the client times out suggests the traffic is not reaching mysqld.
Logs and packet path
Review the MySQL error log around the exact retry time. When enabled, the general query log can show connection activity, although a handshake failure may occur before a normal query is logged. Also inspect host-firewall logs, cloud security-group flow logs, container ingress logs, SSH tunnel output, and proxy/router logs. A proxy can accept the client’s TCP socket and still fail to reach the database backend, yielding a misleading handshake-stage 2013.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use timestamps, source IP, destination IP, destination port, and connection ID where available. This prevents a common mistake: fixing one server while the application is actually resolving a different address or traversing a different proxy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Fixes compared by failure layer
| Failure layer | Typical remedy | Who can perform it | Reversibility and risk |
|---|---|---|---|
| Service or listener | Start mysqld; correct port; disable unintended skip_networking; bind to the required interface |
Server administrator | Usually reversible; widening the bind address increases exposure unless firewall rules are restrictive |
| Network or firewall | Allow the client subnet and destination port; repair routes, VPNs, security groups, or container publishing | Network or infrastructure administrator | Reversible; over-broad rules create security risk |
| Protocol or port | Use classic client with 3306, or an X Protocol client with 33060 | Application or database administrator | Low risk and immediately reversible |
| DNS and grants | Repair DNS, use a controlled hosts entry, or enable skip_name_resolve after converting grants to IP hosts |
Database and DNS administrators | DNS repair is low risk; changing name-resolution mode can cause access failures if grants are not migrated |
| Host-cache block | Fix repeated handshake failures, inspect performance_schema.host_cache, then flush hosts |
Database administrator | Reversible; flushing without fixing the cause causes the block to return |
| Initial timeout | Increase connect_timeout for a measured slow path |
Database administrator | Reversible; excessive values consume waiting resources and mask outages |
| Proxy or tunnel backend | Verify each hop and backend health; correct listener, route, credentials, or health-check configuration | Infrastructure administrator | Depends on the proxy; changing the client alone will not repair a dead backend |
Remote, container, tunnel, and proxy-specific checks
Containers and virtual networks
Verify that the database port is published from the container to the host and that the application is using the service name and internal port appropriate to its network. A host port mapping can differ from the container’s listening port. Test from inside the application container as well as from the host; these paths can have different DNS, routes, and firewall policies.
SSH tunnels
Confirm the local forwarded port, remote destination, and tunnel process. The client should connect to the local tunnel endpoint, while the tunnel itself must reach the database’s classic listener. A tunnel that is established but forwards to the wrong port can produce a handshake error instead of a clear authentication message.
Database proxies and routers
Test the proxy endpoint and the backend endpoint separately when permitted. Check whether the proxy accepted the socket, selected a healthy backend, and forwarded the initial bytes without protocol conversion. Review health-check and backend-selection logs; a healthy client-to-proxy TCP test does not prove proxy-to-database connectivity.
Recommended Free Tools
Quick Recap
A controlled verification procedure
- Record the application’s exact hostname, resolved address, port, protocol, TLS mode, and source network.
- Capture the current
Aborted_connects, relevantConnection_errors_*values, and the affected IP’s host-cache row. - Confirm mysqld is running and listening on the expected interface and port.
- Run a TCP probe from the application network and save whether it is refused, timed out, or accepted.
- Run the classic client with explicit
--protocol=TCPand the intended port; do not substitute a local socket test. - If TCP is open but the handshake fails, verify 3306 versus 33060, proxy forwarding, DNS behavior, and host-cache state in that order.
- Apply one minimal change, retry once, and compare counters and logs with the baseline.
- Only after a reachable but slow path is demonstrated, test a larger
connect_timeout; persist it only when the evidence supports the change. - After recovery, repeat the test from the real application process and document the final endpoint, firewall rule, grant host, and configuration values.
Common mistakes that prolong the outage
- Changing passwords first: authentication has not started when the initial packet is lost, so credential changes do not address this stage.
- Testing only localhost: a Unix socket can succeed while remote TCP is impossible.
- Pointing the classic client at 33060: the X Protocol listener is not a drop-in replacement for the classic listener.
- Raising
max_connect_errorsas a cure: it may postpone host blocking while leaving the network fault untouched. - Increasing timeouts before testing reachability: a firewall drop remains a firewall drop, just with a longer wait.
- Enabling
skip_name_resolvewithout changing grants: hostname-basedHostentries may stop matching. - Assuming a proxy is transparent: the proxy can accept a socket while its backend route or health check is broken.
- Changing several layers at once: one-change-at-a-time testing is essential for knowing which setting restored the handshake and for avoiding an accidental security exposure.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
