I've set up a Raspbian Jessie on a Raspberry Pi Zero to use USB OTG with the dwc2 module. What I'd like to do now is sniff incoming USB traffic on the peripheral side. I found and tested the usbmon kernel module, but it (apparently, to the extent of my limited knowledge) doesn't seem to work: nothing is recorded.

For testing purposes, I tried the exact same thing on the host side (another computer on Linux) and I can successfully trace USB data with usbmon. Unfortunately, this is not what I need.

In conclusion: is it possible ? And if yes, how? Can I use usbmon or do I have do to something else (e.g. recompile kernel with specific options)?


3 Answers 3


the tool USBMon is unfinished

there is a kernel module with the same name which is up to date

make sure that the kernel module usbmon is available load it (modprobe usbmon) and the you can sniff USB traffic using

see also http://discussions.flightaware.com/ads-b-flight-tracking-f21/monitoring-usb-utilization-on-raspberry-pi-t20691.html

  • Thanks for your answer. To clarify, I'm using the ubmon kernel module, not the tool. I did follow the instructions from kernel.org (maybe I should've mentionned it. My problem is that I can't use Wireshark or any similar tool because usbmon is not sniffing anything, apparently because the USB port is in device mode (and not host mode). Also, your last link seems interesting, but it seems broken?
    – wismna
    Jan 11, 2017 at 14:56
  • yes link was broken, sorry. did you load the usbmon module with modprobe ? if yes install and run dumpcap -D as root to see the interfaces you can capture on. dumpcap is in the tshark package. in general until you know where the error is run everything as root...
    – ralf htp
    Jan 11, 2017 at 16:17

As I don't have a RPi at hand, I cannot say for sure it this will work for you or not, but I've successfully managed monitoring USB traffic on a remote machine using the tcpdump and wireshark, with the following command:

$ ssh user@remotehost 'tcpdump -U -i usbmon2 -w -' | wireshark -k -i -

Here, usbmon2 the 2 is for the Bus ID where your USB device is connected on. You can get this with lsusb.

  • This is very interesting, but unfortunately not what I'm looking for at the moment... I need to sniff USB traffic on the device side (the Rpi), before any network connection is made, mainly because the Rpi is later configured to be an Ethernet gadget, and without having any specific knowledge of the host I connect the Rpi to.
    – wismna
    Jan 11, 2017 at 15:07

After a lot of digging around, it doesn't seem possible (or if it is, I just can't find any information anywhere) to trace USB traffic when the controller is in device (or peripheral) mode. It's only possible when the controller is configured as a host.

As no trace is generated by usbmon, I unfortunately can't use any tools (Wireshark, dumpcap...) because they need that trace in the first place.

So what I'll be trying to do now is to either modify the libcomposite kernel module to add debugging information or even write a specific module designed for sniffing (but this is way above my current knowledge in the matter at the moment).

  • Did you have any progress with that since you asked the question? Dec 10, 2019 at 22:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .