I've set up a Raspbian Jessie on a Raspberry Pi Zero to use USB OTG with the dwc2 module. What I'd like to do now is sniff incoming USB traffic on the peripheral side. I found and tested the usbmon kernel module, but it (apparently, to the extent of my limited knowledge) doesn't seem to work: nothing is recorded.

For testing purposes, I tried the exact same thing on the host side (another computer on Linux) and I can successfully trace USB data with usbmon. Unfortunately, this is not what I need.

In conclusion: is it possible ? And if yes, how? Can I use usbmon or do I have do to something else (e.g. recompile kernel with specific options)?


the tool USBMon is unfinished

there is a kernel module with the same name which is up to date

make sure that the kernel module usbmon is available load it (modprobe usbmon) and the you can sniff USB traffic using

see also http://discussions.flightaware.com/ads-b-flight-tracking-f21/monitoring-usb-utilization-on-raspberry-pi-t20691.html

|improve this answer|||||
  • Thanks for your answer. To clarify, I'm using the ubmon kernel module, not the tool. I did follow the instructions from kernel.org (maybe I should've mentionned it. My problem is that I can't use Wireshark or any similar tool because usbmon is not sniffing anything, apparently because the USB port is in device mode (and not host mode). Also, your last link seems interesting, but it seems broken? – wismna Jan 11 '17 at 14:56
  • yes link was broken, sorry. did you load the usbmon module with modprobe ? if yes install and run dumpcap -D as root to see the interfaces you can capture on. dumpcap is in the tshark package. in general until you know where the error is run everything as root... – ralf htp Jan 11 '17 at 16:17

As I don't have a RPi at hand, I cannot say for sure it this will work for you or not, but I've successfully managed monitoring USB traffic on a remote machine using the tcpdump and wireshark, with the following command:

$ ssh user@remotehost 'tcpdump -U -i usbmon2 -w -' | wireshark -k -i -

Here, usbmon2 the 2 is for the Bus ID where your USB device is connected on. You can get this with lsusb.

|improve this answer|||||
  • This is very interesting, but unfortunately not what I'm looking for at the moment... I need to sniff USB traffic on the device side (the Rpi), before any network connection is made, mainly because the Rpi is later configured to be an Ethernet gadget, and without having any specific knowledge of the host I connect the Rpi to. – wismna Jan 11 '17 at 15:07

After a lot of digging around, it doesn't seem possible (or if it is, I just can't find any information anywhere) to trace USB traffic when the controller is in device (or peripheral) mode. It's only possible when the controller is configured as a host.

As no trace is generated by usbmon, I unfortunately can't use any tools (Wireshark, dumpcap...) because they need that trace in the first place.

So what I'll be trying to do now is to either modify the libcomposite kernel module to add debugging information or even write a specific module designed for sniffing (but this is way above my current knowledge in the matter at the moment).

|improve this answer|||||
  • Did you have any progress with that since you asked the question? – Tomasz Grobelny Dec 10 '19 at 22:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.