This is a static archive of our old Q&A Site. Please post any new questions and answers at

Decode USB Interface Class correctly



I am using Wireshark 1.12.7 on vivid and I captured a few hours of mouse movements and keyboard interrupts. One thing that really bothers me, is the wrong decoding of the value bInterfaceClass.
For some reason it never gets decoded properly (always bInterfaceClass: Unknown (0xffff)). For comparison I used sudo lsusb -v which results in:

Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0         8
  idVendor           0x04b3 IBM Corp.
  idProduct          0x3025 NetVista Full Width Keyboard
  bcdDevice            1.02
  iManufacturer           1 CHICONY
  iProduct                2 USB NetVista Full Width Keyboard
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           34
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      1 Boot Interface Subclass
      bInterfaceProtocol      1 Keyboard
      iInterface              0 
        HID Device Descriptor:

So it would actually have a "correct" class.

Is there anything I can do to make wireshark decode the interface class correctly?

asked 18 Sep '15, 04:26

Rolf's gravatar image

accept rate: 0%

One Answer:


To get usb.bInterfaceClass displaying the real value (and not 0xffff) you need to capture the USB enumeration procedure (as seen in this capture from Wiresahrk wiki for example).

answered 18 Sep '15, 11:09

Pascal%20Quantin's gravatar image

Pascal Quantin
accept rate: 30%

This was the problem :) thanks a lot!

(18 Sep '15, 14:02) Rolf