0

I'm trying to capture some packets for a USB device which works in a MS Virtual Machine, so that I can try to write some Linux support.

I am using libpcap and wireshark to capture the USB packets. There are 4 listed USB interfaces. How can I determine which interface has my device?

WireShark interface select

Here is the info I know about the device from dmesg:

$dmesg
...
[17040.312102] usb 1-1.4: new full-speed USB device number 15 using ehci-pci
[17040.407100] usb 1-1.4: New USB device found, idVendor=08f7, idProduct=0009
[17040.407114] usb 1-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[17040.407116] usb 1-1.4: Product: SpectroVis
[17040.407118] usb 1-1.4: Manufacturer: Vernier Software & Technology
[17040.407120] usb 1-1.4: SerialNumber: CKSxxx
[17040.409046] hid-generic 0003:08F7:0009.0106: hiddev0,hidraw2: USB HID v1.01 Device [Vernier Software & Technology SpectroVis] on usb-0000:00:1a.0-1.4/input0

I also know the device occupies /dev/usb/hiddev0

I suspect that usbmon1 is my mouse / keyboard, because every time I move my mouse I get loads of packets.

j0h
  • 15,365

1 Answers1

1

At least the idVendor and idProduct can be spotted in the wireshark dumps. Then it can be tracked by id (which usually grows when reconnected).

Velkan
  • 3,681