USB Sniffer (protocol analyzer) using Wireshark

[tubekiddo]

Hi,
While troubleshooting a USB device I came across a low cost USB Sniffer (protocol analyser) which uses Wireshark Capture program.
I want to share with the community.

I myself built two units which work like a charm. The soldering is a bit challenging because of high density SMD part population on the PCB but it is possible to hand solder everything. I ordered the PCB from JLCPCB and parts from mouser and LCSC (China). All parts are readily available and all software/firmware is available free of charge (incl. sources!).

I want to thank again Alex who made this available for free. Professional USB protocol analyzer are costing thousands of $.

Links:
GitHub project: https://github.com/ataradov/usb-sniffer
A video of building a unit, very helpful: https://www.downtowndougbrown.com/2023/08/building-alex-taradovs-open-source-usb-sniffer/
Hackaday article: https://hackaday.com/2023/06/13/cheap-usb-sniffer-has-wireshark-interface/
Hardware obsolete: https://github.com/ataradov/usb-sniffer/issues/7

Also read the discussions in GitHub since it contains some value information about obsolete parts and building the software from the sources (incl. executable for MacOS)

 

[bohrok2610]

So what is the benefit over Wireshark USB capture?
https://wiki.wireshark.org/CaptureSetup/USB

 

[quadtech]

Alex's project is a true capture "on the wire".
Wireshark USB capture seems to depend on the OS (usbmon / usbpcap)
for the capture and some limitations are listed on the link provided by you.

 

[bohrok2610]

I have been using Wireshark USB capture for some time in both Windows and Linux. Not stumbled on the limitations. The sniffer in OP also has limitations.

 

[tubekiddo]

Low level protocol analysis, like the ADDRESS REQUEST. This is not possible via usbpcap. Also with the unit you are setting up a man-in-the-middle scenario full transparent capture an USB stream of a separate device which can be a play console or any other USB supporting device like a smart TV, where you can’t use wireshark on the target. Host and target can be separate devices, like host a Linux/MacOS/Windows PC with wireshark capture and the target a smart TV or play console with a Joystick.

The usefulness over sole wireshark depends on the scenario. If you’re troubleshooting firmware issues of USB gadgets it’s a must. If you haven’t come across limitations in your scenarios you’ll probably won’t need it…

 

[phofman]

IMO this sniffer would be useful for capturing Android and iOS USB hosts too. Eventhough android runs linux kernel, it may be easier to build this HW sniffer than building a custom kernel with the usbmon module for an Android device, especially if not rooted.

 

[tubekiddo]

Absolutely, because of the specific man-in-the-middle approach it’s useful to observe USB traffic upto HS (High Speed) on any target, no matter of the operating system of the target, even a Smart watch running Tizen OS (or a PS or XBOX).