Wireshark usb sniffer linux

Содержание

usb sniffing with wireshark
4 Answers 4
Related
Hot Network Questions
Subscribe to RSS
USB capture setup
Table of contents
USB attached network interfaces
Linux
Simple MITM hardware with Linux
macOS
Windows
A word of warning about USBPcap
Discussion
See Also

usb sniffing with wireshark

at the moment I am using usbmon to sniff usb. for better understandability I want to use wireshark. I’ve used wireshark before for sniffing ethernet packets. But what to capture to sniff USB Packets ? I meant I need to start by selecting which interface to capture in wireshark. but what wold I select there for usb ?

Wireshark can only sniff USB on Linux. The easiest way to sniff packets is to use vmware. vusb-analyzer.sourceforge.net/tutorial.html

4 Answers 4

Grab newest wireshark. Use lsusb before and after plugin in device so You know which usb bus its plugged into.

su -c "modprobe usbmon" && su -c "wireshark"

(First load kernel module that allow for usb sniffing for root, second load wireshark as root)

Than select usbmonX , where X stand for usb bus number ( lsusb show those numbers).

After than you still need to filter packets for device / vendor id, or something else device specific, as wireshark will show all packets from all devices plugged into that bus. (Again lsusb before/after plugging you device will help).

Running wireshark as root can be dangerous, better to set up additional wireshark user. It’s done automatically on standard distributions like Fedora and Ubuntu. So installing wireshark with package manager would be the easiest solution, anyway you may come across problems with permissions like ‘Can’t open USB bus file /sys/kernel/debug/usb/usbmon/2t: Permission denied’ this can be easily solved by setting few permissions to files. Manual here: ludovicrousseau.blogspot.com/2014/10/…

Have you taken a look at the documentation for that on the Wireshark website?

In libpcap 1.0.x, the devices for capturing on USB have the name usbn, where n is the number of the bus. In libpcap 1.1.0 and later, they have the name usbmonn.

Sorry But I still didn’t understand. I want to listen to the conversation with My Pen Drive, or with my USB Keyboard. There are 3 options to start capturing etc0, ppp0, lo, then how can I get the USB Conversation

Upgrade to the latest version of libpcap (and/or probably your Linux distribution), and then use Wireshark to capture on the interfaces with names similar to «usbmon1».

a quick notice since I just started using wireshark to sniff usb packets on linux. as I understand you need usbmon module loaded (which if you are using it should be). Additionally I seem to recall that while wireshark can be setup to let non root users sniff ethernet packets, some limitation required root access for usb packs (at least at the time of writting). Similar to what others have said, on my system, Ubuntu 12.10, the usb interfaces have names like «usbmon1 USB bus number 1» and so forth. (you might look at http://biot.com/blog/usb-sniffing-on-linux) the link listed has an image showing a filter which can be used to select only traffic to from a device number (from lsusb).

Читайте также: Install mariadb in linux

@przemo_li You want to filter by device address to see the communication from both the host and the device. The filter for that is usb.device_address == .

Hot Network Questions

To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

Источник

USB capture setup

This page is about capturing raw USB traffic, e.g. the packets a USB mouse will generate on the Universal Serial Bus.

USB attached network interfaces

A special case are network interfaces connected to a host computer through an USB cable. The operating system «converts» the raw USB packets into the network traffic (e.g. Ethernet packets) and provides a network interface that looks like an ordinary network interface. So you can capture from:

the USB device for raw USB traffic (if supported)
the network device for «normal» network packets

The USB bus will add additional overhead, so the raw USB traffic will have higher volume than the network traffic, even if the only active USB devices on the system are network adapters. (If there are other active USB devices, the raw USB traffic will include traffic to and from those devices, so it will obviously have higher volume than Ethernet traffic.)

Linux

Capturing USB traffic on Linux is possible since Wireshark 1.2.0, libpcap 1.0.0, and Linux 2.6.11, using the Linux usbmon interface.

First, check if you belong to the wireshark group with:

To add yourself to the wireshark group, run the below command, then logout and login.

sudo adduser $USER wireshark

Then ensure that non-superusers are allowed to capture packets in wireshark. Select in the below prompt:

sudo dpkg-reconfigure wireshark-common

The next two commands may need to be re-run after every reboot:

To dump USB traffic on Linux, you need the usbmon kernel module. If it is not loaded yet, run this command as root:

To give regular users privileges, make the usbmonX device(s) readable:

sudo setfacl -m u:$USER:r /dev/usbmon*

On some Linux distributions (Arch Linux, Debian, Ubuntu, possibly others), the above command may not be necessary if you already belong to the wireshark group. See CaptureSetup/CapturePrivileges: Most UNIXes.

With Linux kernels prior to 2.6.23, you will also need to run this command as root:

mount -t debugfs none /sys/kernel/debug

and, with those kernels, the usbmon mechanism’s protocol limits the total amount of data captured for each raw USB block to about 30 bytes. With a 2.6.23 or later kernel, and libpcap 1.1.0 and later, that size limitation is removed. Use uname -r to check your kernel version.

In libpcap 1.1.0 and later, the devices on which you can capture are named usbmonX , where X is the USB bus number. On Linux 2.6.22 and later, the special «usbmon0» interface receives a combined stream of events from all USB buses. In libpcap 1.0.x, the devices were named usbX .

Simple MITM hardware with Linux

If the USB host is a black-box device such as a game console and you cannot capture USB traffic on the host’s operating system, here are two DIY-projects that help you build a simple MITM device to intercept and relay USB messages on the USB cable.

SerialUSB is designed to intercept USB HID traffic. Originally made for the GIMX project (which lets you connect PC game controllers to the PS4 by converting the HID protocol messages). You will need a Linux computer to capture the HID messages and an Arduino-based USB dongle. Parts are cheap. If you don’t like soldering, you can buy ready-made «GIMX USB adapters» from the developer and from enthusiasts on eBay and elsewhere.
USBProxy intercepts USB traffic with a standalone Beaglebone Black, which is reconfigured to act as a USB gadget emulating the device connected to the 2nd USB port. Unlike SerialUSB, this solution works with higher-speed non-HID USB traffic as well (within the hardware limitations of the Beaglebone device).

macOS

Capturing USB traffic on macOS is possible since Wireshark 2.4.0, libpcap 1.9.0, and macOS High Sierra, using the XHC20 interface.

In order to capture on that interface, you will first have to run the command

as root, for example by running

Windows

You can capture raw USB traffic on Windows with USBPcap. The Tools page lists some other options for Windows USB capture.

A word of warning about USBPcap

There have been problems with using USBPcap in the past, and while these problems should be resolved now, you may wish to familiarize yourself with these earlier problems, in the event you are still affected by it.

Wireshark Bug 11766 — USBPcap prevents mouse and keyboard from working
USBPcap Issue #3 — Windows 7 — USB bus not recognized after restart after USBPcap installation
Microsoft Security Advisory 3033929 — Availability of SHA-2 Code Signing Support for Windows 7 and Windows Server 2008 R2

You can also capture and debug USB traffic on a virtual Windows machine under VirtualBox. In some ways this is more convenient than working with a separate Windows box.

In this example, an embedded Linux device running g_ether (RNDIS ethernet gadget) connects to Windows. e.g. an NSLU2 with a USB slave modification http://www.nslu2-linux.org/wiki/HowTo/AddDeviceSideUSBPort but it should work for almost any USB device.

With this method, Linux recognises the USB device (i.e. >lsusb will still show them), but VirtualBox hooks it into Windows but Wireshark on linux still gets to snoop on all the packets.

1. Install a VirtualBox Windows guest on your Linux host. Start up the virtual Windows session.

2. Plug-in the embedded slave device via a USB cable, which itself should be either a device Windows already knows about (or in this case it was running a valid g_ether gadget stack and needed a .inf file)

3. Run >lsusb and take a note of which bus the device connects.

e.g
«Bus 003 Device 003: ID 0525:a4a2 Netchip Technology, Inc. Linux-USB Ethernet/RNDIS Gadget»

4. On linux side,run >ifconfig usb0 down — this prevents both the linux system and the windows system from fighting over the device

5. On the Windows virtual machine, on VirtualBox menus click the checkbox

6. Now Windows should recognise the device and proceed with the «plug-and-pray» session for driver initialisation.

I worked from the instructions on http://docwiki.gumstix.org/index.php/Windows_XP_usbnet to install the driver.

7. In this example, I had to set up the networking options for IP address, Gateway etc on Windows to match the IP network on the gadget but for other USB device types there will be no extra setup. In any case this is just normal Windows behavior.

8. On Linux, startup Wireshark and using the Bus number given earlier from >lsusb command to sniff for packets.

Hints for developing something like a Windows native «USBPcap»: a kernel mode filter device driver has to be written. An older Driver Development Kit (DDK) is available which at least can compile kernel mode binaries. The most important functions to install the filter driver are CreateService() and SetupDiSetDeviceRegistryProperty() function with SPDRP_LOWERFILTERS parameter.

Discussion

Why was the note about inaccurate time stamps removed. — UlfLamping

The timestamps should be ok now since libpcap works around the issue by explicitly calling gettimeofday()- ronnie

Well, the inaccuracies I had in mind was about the «delta» involved between the data is received from the USB device and actually timestamped from the kernel. This delta will be substantially lower for e.g. PCI based nic’s than for USB ones — and should be mentioned. Or am I just wrong on this topic and this can be ignored — which should be mentioned then too? — UlfLamping

There’s «capturing on USB-attached networking interfaces» and there’s «capturing USB traffic»; this page is for the latter, but it sounds as if the time stamp delta is an issue for the former. — Guy Harris