OSX USB Monitoring

Question

How can I monitor all USB traffic on OSX? I downloaded the USB monitoring extensions from the Apple Dev website and ran USB Prober. Nothing shows up when I start the monitoring, and there is data being sent to and from the USB device while monitoring.

I found 2 similar topics on this site, but neither gave an answer aside from using libusb. I was hoping I wouldn't have to write my own monitor from scratch using libusb. Seeing as the questions were asked in 2010, I'm hoping tools have been developed since then to accomplish this on OSX.

Solution 1

It's possible in high sierra (and maybe older versions), you'll need Wireshark's nightly build (I am using V2.5.0rc0). After you install it, you'll need to bring up the USB "interface":

sudo ifconfig XHC20 up

And after that you can use wireshark to sniff all the traffic in the XHC20 interface. When you finish, remember to turn the interface down:

sudo ifconfig XHC20 down

Source: aud-ios.

Solution 2

USB Prober doesn't log all USB traffic. It only logs USB/HID driver messages (diagnostic/info messages posted by USB/HID drivers).

I've never tried libusb for this but I suspect that it can't capture all USB traffic ether (but I could be wrong).

If you're at all serious about monitoring USB traffic you should consider a hardware USB Protocol Analyzer like the Beagle 12 from Total Phase: http://www.totalphase.com/products/beagle_usb12/

Or the USB Explorer 200 from Ellisys: http://www.ellisys.com/products/usbex200/index.php

You might be interested in contributing to this kickstarted project:

http://www.kickstarter.com/projects/bushing/openvizsla-open-source-usb-protocol-analyzer?ref=card

Solution 3

usbtracer is included in USB Prober.app: https://developer.apple.com/library/mac/qa/qa1370/_index.html

• no HTML anchors there, so search for "Where do I find the usbtracer tool and how can I use it?"
• i don't know if it shows all traffic or not, but at least in my case it shows something, and USB Prober shows nothing

Comments

[Admin]

$1200 is way out of my budget to monitor high speed. I know there are a lot of software options for Windows (Bushound, USBTrace, USB Analyzer, at least 10 others), but none for OSX? I read about the kickstarter project but a lot of people are suspicious its going to release anything since it achieved its funding goal over 2 years ago and no one's pleased with the last comment from May 10, 2012. Comments on project here: kickstarter.com/projects/bushing/…

[Admin]

It appears that the kickstarted project OpenVizsla has gone off the rails. It was funded in 2010 but based on recent feedback it has not progressed beyond the concept phase.

[AJP]

@JGG looks like he's shipped the KickStarter products successfully :)

[Graeme Gill]

The hardware shipped, but it's almost unusable because the software and fpga firmware is in such a primitive state.