This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to analyse a conventional SCSI over USB stream (from a USB DVD drive, using Ubuntu 12.04). I have captured the trace using tcpdump, and Wireshark correctly displays the traffic at the USB command level, however in every case the SCSI payload is shown simply as 'leftover capture data'. On inspection this data is clearly the wanted SCSI payload.

I have tried both the latest 1.8 and also 1.9 code (wireshark-1.8.0rc2, wireshark-1.9.0-SVN-44445) with identical outcome.

Any suggestions?

asked 12 Aug '12, 03:46

hdb3's gravatar image

hdb3
1111
accept rate: 0%


Unfortunately, without seeing the capture, we can't really tell what the underlying problem is. The USB dissector will report stuff as "Leftover Capture Data" if:

  1. the URB says it's a "bulk transfer", "interrupt", or "control" packet, and it doesn't find an appropriate dissector for it;
  2. the URB says it's an "isochronous" packet;
  3. the URB doesn't say it's any of those.

It might be failing to find an appropriate dissector due to a dissector bug.

Please file a bug at the Wireshark Bugzilla, and, if you can, attach a capture that shows the problem.

permanent link

answered 12 Aug '12, 20:13

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Did you start the capture before connecting device to your computer? One reason for leftover capture data would be lack of USB descriptors in capture file.

permanent link

answered 31 Jul '13, 09:55

desowin's gravatar image

desowin
262
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×69
×6

question asked: 12 Aug '12, 03:46

question was seen: 5,302 times

last updated: 31 Jul '13, 09:55

p​o​w​e​r​e​d by O​S​Q​A