This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

USB capture on Linux: Are these packets raw?

0

I have some packets like this one, captured from /dev/usbmon*:

Frame 46199: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 4
    Interface id: 4 (usbmon5)
    Encapsulation type: USB packets with Linux header and padding (115)
    Arrival Time: Jul 27, 2015 22:29:15.245268000 EDT
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1438050555.245268000 seconds
    [Time delta from previous captured frame: 0.001355000 seconds]
    [Time delta from previous displayed frame: 0.002407000 seconds]
    [Time since reference or first frame: 41.736743000 seconds]
    Frame Number: 46199
    Frame Length: 64 bytes (512 bits)
    Capture Length: 64 bytes (512 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: usb]
USB URB
    URB id: 0xffff8802bb061b40
    URB type: URB_SUBMIT ('S')
    URB transfer type: URB_BULK (0x03)
    Endpoint: 0x85, Direction: IN
        1... .... = Direction: IN (1)
        .000 0101 = Endpoint value: 5
    Device: 50
    URB bus id: 5
    Device setup request: not relevant ('-')
    Data: not present ('<')
    URB sec: 1438050555
    URB usec: 245268
    URB status: Operation now in progress (-EINPROGRESS) (-115)
    URB length [bytes]: 18944
    Data length [bytes]: 0
    [Response in: 55738]
    [bInterfaceClass: Vendor Specific (0xff)]
    Unused Setup Header
    Interval: 0
    Start frame: 0
    Copy of Transfer Flags: 0x00000200
    Number of ISO descriptors: 0
0000   40 1b 06 bb 02 88 ff ff 53 03 85 32 05 00 2d 3c  @.......S..2..-<
0010   fb e8 b6 55 00 00 00 00 14 be 03 00 8d ff ff ff  ...U............
0020   00 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 00  .J..............
0030   00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00  ................

What I'm wondering is if this info/hex dump is the raw data that was sent over the wire, or if the kernel has added/processed some fields? In particular I notice many of the packets have an URB Length of 18944 (0x4A00) but a data length of 0 - is this normal?

asked 29 Jul '15, 17:44

RenaKunisaki's gravatar image

RenaKunisaki
6112
accept rate: 0%