usb sniffing with wireshark

Question

at the moment I am using usbmon to sniff usb. for better understandability I want to use wireshark. I've used wireshark before for sniffing ethernet packets. But what to capture to sniff USB Packets ? I meant I need to start by selecting which interface to capture in wireshark. but what wold I select there for usb ?

Answer 1

@przemo_li You want to filter by device address to see the communication from both the host and the device. The filter for that is usb.device_address ==.

Answer 2

Have you taken a look at the documentation for that on the Wireshark website?

In libpcap 1.0.x, the devices for capturing on USB have the name usbn, where n is the number of the bus. In libpcap 1.1.0 and later, they have the name usbmonn.

Answer 3

Grab newest wireshark. Use lsusb before and after plugin in device so You know which usb bus its plugged into.

type in terminal:

su -c "modprobe usbmon" && su -c "wireshark"

(First load kernel module that allow for usb sniffing for root, second load wireshark as root)

Than select usbmonX, where X stand for usb bus number (lsusb show those numbers).

After than you still need to filter packets for device / vendor id, or something else device specific, as wireshark will show all packets from all devices plugged into that bus. (Again lsusb before/after plugging you device will help).

Answer 4

a quick notice since I just started using wireshark to sniff usb packets on linux. as I understand you need usbmon module loaded (which if you are using it should be). Additionally I seem to recall that while wireshark can be setup to let non root users sniff ethernet packets, some limitation required root access for usb packs (at least at the time of writting). Similar to what others have said, on my system, Ubuntu 12.10, the usb interfaces have names like "usbmon1 USB bus number 1" and so forth. (you might look at http://biot.com/blog/usb-sniffing-on-linux) the link listed has an image showing a filter which can be used to select only traffic to from a device number (from lsusb).

I hope thats helpful