In libpcap 1.0.x, the devices were named usbX. On Linux 2.6.22 and later, the special 'usbmon0' interface receives a combined stream of events from all USB buses. In libpcap 1.1.0 and later, the devices on which you can capture are named usbmonX, where X is the USB bus number. Use uname -r to check your kernel version. With a 2.6.23 or later kernel, and libpcap 1.1.0 and later, that size limitation is removed. With Linux kernels prior to 2.6.23, you will also need to run this command as root:Īnd, with those kernels, the usbmon mechanism's protocol limits the total amount of data captured for each raw USB block to about 30 bytes. See CaptureSetup/CapturePrivileges: Most UNIXes. On some Linux distributions (Arch Linux, Debian, Ubuntu, possibly others), the above command may not be necessary if you already belong to the wireshark group. To give regular users privileges, make the usbmonX device(s) readable: If it is not loaded yet, run this command as root: To dump USB traffic on Linux, you need the usbmon kernel module.

The next two commands may need to be re-run after every reboot: Then ensure that non-superusers are allowed to capture packets in wireshark. To add yourself to the wireshark group, run the below command, then logout and login.

(If there are other active USB devices, the raw USB traffic will include traffic to and from those devices, so it will obviously have higher volume than Ethernet traffic.) LinuxĬapturing USB traffic on Linux is possible since Wireshark 1.2.0, libpcap 1.0.0, and Linux 2.6.11, using the Linux usbmon interface.įirst, check if you belong to the wireshark group with: The USB bus will add additional overhead, so the raw USB traffic will have higher volume than the network traffic, even if the only active USB devices on the system are network adapters.

the network device for 'normal' network packets.

the USB device for raw USB traffic (if supported).

Ethernet packets) and provides a network interface that looks like an ordinary network interface. The operating system 'converts' the raw USB packets into the network traffic (e.g. A special case are network interfaces connected to a host computer through an USB cable.

Wireshark usb filter