usbrevue icon indicating copy to clipboard operation
usbrevue copied to clipboard
verified publisher icon wcooley

Implement support for USBPcap link-type

Open CooperWhitlow opened this issue 10 years ago • 4 comments

Hi! I've found that pcap files captured on windows causes a runtime error.

CooperWhitlow avatar Oct 16 '15 02:10 CooperWhitlow

How are you capturing USB pcap on Windows? Can you share a sample with me?

wcooley avatar Oct 16 '15 18:10 wcooley

Sure! https://www.dropbox.com/s/cvytlc62yn7xq10/start.pcap?dl=1

CooperWhitlow avatar Oct 16 '15 19:10 CooperWhitlow

I'm guessing that you captured with USBPcap or something that captures to that format? The link-type of your capture is "USBPCAP", 249, whereas this tool supports "USB_LINUX_MMAPPED", 220.

I naively tried to change the link-type using pcapfix but the formats are non-trivially different. It would be possible to create a new packet format dictionary to decode it, but not without a bit of work.

The USBPcap format is documented at http://desowin.org/usbpcap/captureformat.html.

wcooley avatar Oct 21 '15 17:10 wcooley

I see.

A new format dictionary is beyond my ability to do myself. Perhaps at least I could include a mention to this in the "caveats" section of the usbreplay readme and submit a pull request?

CooperWhitlow avatar Oct 21 '15 20:10 CooperWhitlow