USB Debugging with wireshark

June 02, 2023

Wireshark can be used to capture traces for usb devices.

To setup wireshark, follow the directions from the wireshark wiki. On linux make sure you're user is in the wireshark group, the usbmon module is enabled and give your user permission to capture on the usbmon devices using setfacl.

After doing this open wireshark and you should see several usbmon interfaces. Choose one that shows packets in the mini plot.

Wireshark usbmon

Start a capture and plug in the device, open it and/or send whatever commands you want to capture a trace of then stop the capture.

To see only packets from your device either use dmesg and watch when the device connects or run lsusb and take note of the device's bus and device number.

From dmesg

[2848337.033890] usb 1-5.2: new full-speed USB device number 76 using xhci_hcd
[2848337.188727] usb 1-5.2: New USB device found, idVendor=5316, idProduct=1004, bcdDevice= 1.00

From lsusb

Bus 001 Device 076: ID 5316:1004 CodeLV Vac Controller

In this case it is device 76. Apply this as a filter in wireshark with usb.device_address == 76 to see only packets to that device.

Wireshark usb capture

The last number in the source/destination columns map to the endpoint number.

The rest is analyzing the packets. Hope it helps, cheers!