at the moment I am using usbmon to sniff usb. for better understandability I want to use wireshark. I've used wireshark before for sniffing ethernet packets. But what to capture to sniff USB Packets ? I meant I need to start by selecting which interface to capture in wireshark. but what wold I select there for usb ?
Asked
Active
Viewed 2.9k times
12
-
From what I can tell, this is not currently possible with wireshark on windows. – CWMan Feb 22 '11 at 15:23
-
Wireshark can only sniff USB on Linux. The easiest way to sniff packets is to use vmware. http://vusb-analyzer.sourceforge.net/tutorial.html – Orwellophile Dec 01 '13 at 17:25
4 Answers
11
Grab newest wireshark. Use lsusb before and after plugin in device so You know which usb bus its plugged into.
type in terminal:
su -c "modprobe usbmon" && su -c "wireshark"
(First load kernel module that allow for usb sniffing for root, second load wireshark as root)
Than select usbmonX, where X stand for usb bus number (lsusb show those numbers).
After than you still need to filter packets for device / vendor id, or something else device specific, as wireshark will show all packets from all devices plugged into that bus. (Again lsusb before/after plugging you device will help).
przemo_li
- 3,932
- 4
- 35
- 60
-
Running wireshark as root can be dangerous, better to set up additional wireshark user. It's done automatically on standard distributions like Fedora and Ubuntu. So installing wireshark with package manager would be the easiest solution, anyway you may come across problems with permissions like 'Can't open USB bus file /sys/kernel/debug/usb/usbmon/2t: Permission denied' this can be easily solved by setting few permissions to files. Manual here: http://ludovicrousseau.blogspot.com/2014/10/ccid-usb-spy-using-wireshark.html – Kamil Oct 10 '15 at 17:53
3
Have you taken a look at the documentation for that on the Wireshark website?
In libpcap 1.0.x, the devices for capturing on USB have the name usbn, where n is the number of the bus. In libpcap 1.1.0 and later, they have the name usbmonn.
Miles Strombach
- 308
- 1
- 11
-
Sorry But I still didn't understand. I want to listen to the conversation with My Pen Drive, or with my USB Keyboard. There are 3 options to start capturing etc0, ppp0, lo, then how can I get the USB Conversation – Neel Basu Feb 12 '11 at 10:52
-
1Upgrade to the latest version of libpcap (and/or probably your Linux distribution), and then use Wireshark to capture on the interfaces with names similar to "usbmon1". – Tyson Jul 23 '11 at 14:24
0
a quick notice since I just started using wireshark to sniff usb packets on linux. as I understand you need usbmon module loaded (which if you are using it should be). Additionally I seem to recall that while wireshark can be setup to let non root users sniff ethernet packets, some limitation required root access for usb packs (at least at the time of writting). Similar to what others have said, on my system, Ubuntu 12.10, the usb interfaces have names like "usbmon1 USB bus number 1" and so forth. (you might look at http://biot.com/blog/usb-sniffing-on-linux) the link listed has an image showing a filter which can be used to select only traffic to from a device number (from lsusb).
I hope thats helpful
dullfire
- 1
0
@przemo_li You want to filter by device address to see the communication from both the host and the device. The filter for that is usb.device_address ==.
