I have a USB instrument, and I want to capture packets on it. I ran I see a -f <capture filter=""> Set the capture filter expression option, and some network examples but this doesn't include any USB packet capture examples. asked 07 Jul '16, 17:21 Eric Lovejoy edited 09 Jul '16, 12:11 sindy |
One Answer:
Simply put, there is no capture filter available for usb capturing, except the root hub (or "bus") number. This number translates into a capturing interface name if you use the extcap API to control the USBPcap, which is what you seem to be doing as you've provided a During USB enumeration phase, each USB device detected is assigned an ID like The VID and PID (vendor ID and product ID) are only used to identify the device and choose a proper driver for it during the so-called enumeration phase. So unless you capture the enumeration phase (i.e. unless you start capturing on the proper root hub before plugging the device in), you won't capture the VID and PID at all. So your only chance is to use a display filter. There, you can use the full usb addresses of the endpoints of the devices ( If you did capture the enumeration phase, a display filter A display filter can be used already during capture, but it only prevents the non-matching URBs from being displayed, not from being captured. So in Wireshark, you have to use answered 08 Jul '16, 15:41 sindy edited 09 Jul '16, 12:10 |