This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi!

I am using Wireshark 1.12.7 on vivid and I captured a few hours of mouse movements and keyboard interrupts. One thing that really bothers me, is the wrong decoding of the value bInterfaceClass.
For some reason it never gets decoded properly (always bInterfaceClass: Unknown (0xffff)). For comparison I used sudo lsusb -v which results in:

Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0         8
  idVendor           0x04b3 IBM Corp.
  idProduct          0x3025 NetVista Full Width Keyboard
  bcdDevice            1.02
  iManufacturer           1 CHICONY
  iProduct                2 USB NetVista Full Width Keyboard
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           34
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      1 Boot Interface Subclass
      bInterfaceProtocol      1 Keyboard
      iInterface              0 
        HID Device Descriptor:
[...]

So it would actually have a "correct" class.

Is there anything I can do to make wireshark decode the interface class correctly?

asked 18 Sep '15, 04:26

Rolf's gravatar image

Rolf
6447
accept rate: 0%


To get usb.bInterfaceClass displaying the real value (and not 0xffff) you need to capture the USB enumeration procedure (as seen in this capture from Wiresahrk wiki for example).

permanent link

answered 18 Sep '15, 11:09

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k1060
accept rate: 30%

This was the problem :) thanks a lot!

(18 Sep '15, 14:02) Rolf
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×69
×15

question asked: 18 Sep '15, 04:26

question was seen: 2,997 times

last updated: 18 Sep '15, 14:10

p​o​w​e​r​e​d by O​S​Q​A