USB sniffing in linux

posted Mar 19th 2009 11:30am by
filed under: classic hacks, pcs hacks, peripherals hacks

sniffer

[Robert] sent in this tutorial on how to set up USB sniffing in linux. Useful for seeing exactly what is being communicated to and from your USB devices, this ability is built into linux. [Bert], the author, shows us the steps involved and how to filter it to get the data we desire. You can specify exactly which device to capture data from. His example, shown above, is a session with an Arduino.

tagged: , , ,


15 Responses to USB sniffing in linux

  • Robert Liesenfeld says:
    March 19, 2009 at 11:38 am

    Actually this is mis-attributed, it should be attributed to Bert Vermuelen, as he’s the one who actually put together the writeup!

    Reply Report comment
  • Caleb Kraft says:
    March 19, 2009 at 12:22 pm

    That has been fixed. thanks.

    Reply Report comment
  • Tim says:
    March 19, 2009 at 1:15 pm

    Ah never realised wireshark can do USB. A while ago I tried to reverse engineer the craft robo protocol using some command line scripts (I forget the name).

    I did actually manage to work out a decent amount of the protocol and I wrote a simple test program to draw a Koch curve. Then I got distracted.

    Reply Report comment
  • Greg says:
    March 19, 2009 at 1:18 pm

    I was trying this out and I had some issues. At the cat /sys/kernel/debug/usbmon/lu I get a “cat: lu: No such file or directory” so I went and check and the file is indeed there, I even moved to that folder and did a cat lu and same deal. Im not an advanced linux user so any help with this would be appreciated

    Reply Report comment
  • cde says:
    March 19, 2009 at 1:34 pm

    @ Greg, first, do a ls -halF in that directory, and tell us the permissions for the file.

    Then, do you have a usb device plugged in?

    Reply Report comment
  • Greg says:
    March 19, 2009 at 2:00 pm

    ah i figured it out i thought 1u (one u) was lu (L u) stupid mistake on my part. Thanks for the help though

    Reply Report comment
  • dan says:
    March 19, 2009 at 2:46 pm

    usb sniffing? is this like kitty huffing?

    Reply Report comment
  • Ynynymys says:
    March 19, 2009 at 3:59 pm

    another useful command line tool is lsusb. that came in handy while getting my touchscreen working on my eeepc

    Reply Report comment
  • lowkey says:
    March 19, 2009 at 8:26 pm

    Thanks for this – been looking for a how-to to sniff USB in order to get my Windows-driver-only USB scrolling LED marquee device working under Linux.

    Reply Report comment
  • joe57005 says:
    March 20, 2009 at 8:29 am

    I can’t see how this can be useful to do on linux, don’t get me wrong, i love linux, but the only use i can see for this is reverse engineering proprietary usb devices/protocols, and most if not all proprietary devices run solely on windows. the device needs to be running like normal to understand how it communicates, and for that it requires winblows.

    Reply Report comment
  • thought says:
    March 20, 2009 at 9:14 am

    I’m thinking the same thing as joe57005. It would be very useful if there was a way to get the device to run normally…issue a command w/proprietary app and watch the packets sent/received to/from the device. of course, you’d still need windows to run the proprietary app in most cases.

    The only other thing I can think of where this would be useful is if you are designing a USB device yourself. It could be extremely valuable as a debug tool during the software development phase.

    Reply Report comment
  • Doktor Jeep says:
    March 20, 2009 at 10:44 am

    Hmph – no wireshark for suse linux. but the command lines work. very nice.

    wish i knew what i was looking at :-(

    Reply Report comment
  • andrei says:
    March 20, 2009 at 11:06 am

    wouldn’t that work to sniff usb traffic between a connected device and a virtual box running windows ?

    Reply Report comment
  • blah says:
    March 20, 2009 at 3:13 pm

    are these only compatible with injection…or worth it without it.

    Reply Report comment
  • iblis says:
    March 20, 2009 at 7:30 pm

    Hmm, this might be handy for hacking out a way to communicate with my phone in Linux. It’s Motorola, but moto4lin, bitpim, and p2k all fail to talk to it.

    While Windows might be required for the initial reverse engineering, there’s always VMWare. :D

    Reply Report comment

    • Leave a Reply

    XHTML: You can use these tags: <a href="" title="" rel=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <pre> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

    Hack a Day serves up fresh hacks each day, every day from around the web as well as hacking related news.

    Send us your hacks










         



    Hacks

    Resources