But best of all: wireshark, the all-singing all-dancing network analyzer that uses tcpdump capture files, has USB support as well.

Libpcap on linux supports usbmon sniffing, which means you can use tcpdump to sniff a USB port and write this to a capture file. It’s great, I’ve used it before (in capstats) and it’s very easy to use. The heavy duty lifting is done by libpcap, not least by providing a cross-platform API for sniffing devices, something that is otherwise non-standard and different on every platform.

Tcpdump is not much more than a command line parser and pretty-printer of various network protocols. Libpcap is the power behind the throne of the venerable tcpdump tool. More info in the usbmon documentation.īut while it’s all easily parsed if you need it, there aren’t really any tools around that do it for you. Every USB bus also has a device file where you can sniff the raw packets straight off the wire. It all comes out in an ASCII dump format which is easily parsed. Simply mount debugfs and insmod the usbmon module: mount -t debugfs none_debugs /sys/kernel/debugmodprobe usbmon Then you can just cat USB traffic like this: cat /sys/kernel/debug/usbmon/1u It’s been in there for ages, and the output is really easy to collect, even from the command line shell.

The linux kernel has a facility called “usbmon” which can be used to sniff the USB bus.

Wireshark usb ubuntu