CODEWITHSUNDEEP
windowsusbsniffingusbserial
dpavlin
dpavlin

Reputation: 1430

How to sniff a USB port under Windows?

From time to time, I need to dump USB traffic under Windows, mostly to support hardware under Linux, so my primary goal is to produce dump files for protocol analysis.

For USB traffic, it seems that SniffUsb is the clear winner... It works under Windows XP (but not later) and has a much nicer GUI than earlier versions. It produces huge dump files, but everything is there.

However, my device is in fact a USB serial device, so I turned to Portmon which can sniff serial port traffic without the USB overhead.

Upvotes: 54

Views: 127727

Answers (6)

Renat
Renat

Reputation: 8962

Microsoft Message Analyzer was able to capture USB traffic, with Device and Log File parser from MS: link

Update: as mentioned by @facetus, MS Message Analyzer has been retired on November 25 2019.

Upvotes: 2

jamkomo
jamkomo

Reputation: 167

  1. Since people don't seem to realize it, Wireshark does monitor USB traffic and has a parser for it; but the catch is it only works under Linux. Wireshark on Windows will not do this.

  2. It may be possible to plug the USB device you want to monitor, along with a Linux machine (with Wireshark running) and your Windows machine and just use the USB device under Windows.

  3. Problem with the above? I don't know how the Linux machine or the Windows machine will detect each other.

Upvotes: 15

Kurt Fitzner
Kurt Fitzner

Reputation: 635

Busdog, an open source project hosted on github, has worked well for me. It has a driver it installs to allow it to monitor USB communications. The config window allows you to reinstall or remove the device at any time.

You can select the USB device you want from an enumerated list. A nice feature is to have it automatically trace a new device that is plugged in:

Enumerated USB devices

Data communications to and from an SWR analyzer I was reverse engineering were captured flawlessly:

USB-to-serial port communications captured

Upvotes: 7

gbjbaanb
gbjbaanb

Reputation: 52669

USBSnoop works too - and is free.

Or, you could buy a USB to Ethernet converter and use whatever network sniffer you prefer to see the data.

Upvotes: 6

albfan
albfan

Reputation: 12940

After five years waiting, now it's possible to sniff usb packets on windows

See http://desowin.org/usbpcap/tour.html for a quick tour. It works pretty well

Upvotes: 22

Charles Duffy
Charles Duffy

Reputation: 295363

Personally, I'd use QEMU or KVM and instrument their USB passthrough code, and then use libusb to prototype the replacement driver in user space (this latter bit I've done before; writing USB device drivers in Python is fun!).

Upvotes: 3

Related Questions