Wireshark GUI can be used to capture USB-traffic directly.ĭisplay filters with USB follow the notation Wireshark CLI $ tshark -i usbmon2 -w /var/tmp/usbmon2.pcap This will continue to write to the file until it is terminated. # cat /sys/kernel/debug/usb/usbmon/2u > /tmp/usbmon_out It's up to post processing to filter out irrelevant traffic to show the ones that are being analyzed. Capturing is done whole bus-wise, not by device. Integrated Rate Matching Hubīus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hubĭisplays two buses, 002 and 001. Integrated Rate Matching Hubīus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hubīus 001 Device 002: ID 8087:0020 Intel Corp. (formerly SMSC) USB 2.0 Hubīus 002 Device 003: ID 08e6:3437 Gemalto (was Gemplus) GemPC Twin SmartCard Readerīus 002 Device 002: ID 8087:0020 Intel Corp. (formerly SMSC) USB 2.0 Hubīus 002 Device 004: ID 0424:2514 Microchip Technology, Inc. (formerly SMSC)īus 002 Device 006: ID 0424:2640 Microchip Technology, Inc. 800dpi Optical Mouse w/ Scroll Pointīus 002 Device 009: ID 0424:4063 Microchip Technology, Inc. Illuminated Keyboardīus 002 Device 007: ID 04b3:3108 IBM Corp. To be able to capture right device from multiple others, the bus and device numbers must be known.īus 002 Device 011: ID 08e6:3437 Gemalto (was Gemplus) GemPC Twin SmartCard Readerīus 002 Device 012: ID 0590:0028 Omron Corp. In Fedora, debugging users should belong to usbmon group, and additionally wireshark group in order to have access to debugging device files. If directory /sys/kernel/debug/usb/usbmon/ has files in it, kernel support should be ready.Ĭrw-r- 1 root usbmon 244, 0 Dec 4 19:25 /dev/usbmon0Ĭrw-r- 1 root usbmon 244, 1 Dec 4 19:25 /dev/usbmon1Ĭrw-r- 1 root usbmon 244, 2 Dec 4 19:25 /dev/usbmon2 If it was compiled as module, it can be loaded into kernel: Hence it does not need, or can be loaded into running kernel. Shows that it was selected to be part of monolitic kernel, rather than module (CONFIG_USB_MON=m). Fedora should have it statically part of the kernel. USB module can be compiled into kernel statically, or it can be module that can be loaded into kernel.

Wireshark filter usb