This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

usbmon0 missing in interface list

0

I have usbmon installed and /sys/kernel/debug/usb/usbmon has entries for 0 to 4. If I cat 0u, I see transactions when I run an application I want to debug. Therefore, I think usbmon is working.

Note that permissions on all are rw for root. All things I have tried run with sudo including enabled usbmon and wireshark.

Wireshark 1.10.6 lists usbmon1-4, none of which see traffic.

I assume there should be a usbmon0 in the interface list, but it is not listed.

Can someone confirm that there should be a usbmon0, and are there any ideas on how to make wireshark list it?

Or if the numbers aren't supposed to align, like 0s/u is really usbmon1 in wireshark, how do I debug the problem?

Ubuntu 14.X LTS

asked 31 Jul '15, 17:42

Proclivis's gravatar image

Proclivis
6●1●1●2
accept rate: 0%

Libpcap provides a usbmonN device for each entry in /sys/bus/usb/devices with a name of the form usbN. What does ls /sys/bus/usb/devices print?

(31 Jul '15, 23:49) Guy Harris ♦♦

One Answer:

0

Modern kernels (with the usbmon module loaded) also create a /dev/usbmonX device which is first probed for by Wireshark (actually, libpcap). When you run Wireshark as non-root user, it will not be able to capture from those devices. In that case, make sure that your user is allowed to read from it (write access is unnecessary):

sudo setfacl -m u:$USER:r /dev/usbmon1
# Alternatively, if you do not have setfacl installed:
sudo chgrp $USER /dev/ubsmon1 && sudo chmog g+t /dev/usbmon1

See also https://wiki.wireshark.org/CaptureSetup/USB

answered 03 Aug '15, 02:41

Lekensteyn's gravatar image

Lekensteyn
2.2k●3●7●24
accept rate: 30%