URBs to/from all endpoints of a device) using usb.bus_id = m and usb.device_address = n. There, you can use the full usb addresses of the endpoints of the devices ( usb.addr = "m.n.e" where e is the endpoint id) to see only the packets (actually, URBs, it is a difference!) to/from a particular endpoint of a particular device, or you can filter for m and n combination only (i.e.
So your only chance is to use a display filter. unless you start capturing on the proper root hub before plugging the device in), you won't capture the VID and PID at all. So unless you capture the enumeration phase (i.e. The VID and PID (vendor ID and product ID) are only used to identify the device and choose a proper driver for it during the so-called enumeration phase. In your case with a single root hub, m will always be 1. If you unplug a device and plug it again to the same physical port, it will keep the m but get a new n. So in your case, as tsharks returns just a single USB interface to capture at, there is just a single root hub in the PC.ĭuring USB enumeration phase, each USB device detected is assigned an ID like m.n, where m is the root hub number and n is the order number of the device to be identified. This number translates into a capturing interface name if you use the extcap API to control the USBPcap, which is what you seem to be doing as you've provided a tshark. Simply put, there is no capture filter available for usb capturing, except the root hub (or "bus") number.
0 kommentar(er)
