AwesomeREA.org

Tool

USBPcap

Tomasz Moń's open-source USB packet capture for Windows. A filter driver installed in the Windows USB device stack records the USB Request Blocks (URBs) exchanged with devices on each root hub, and USBPcapCMD writes them to pcap files in the LINKTYPE_USBPCAP format, which Wireshark dissects. Since 1.2.0.0 the project has recommended running USBPcapCMD as a Wireshark extcap: each root hub then appears as a capture interface, with options to capture selected, all or newly connected devices and to add the descriptors of devices that are already attached.

Targets
Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: 1.5.4.0, published 2020-05-22, with a digitally signed USBPcapSetup installer for x86 and x64 Windows 7, 8 and 10 and a source archive that includes debug symbols. The reviewed master commit (2025-01-25) adds two unreleased driver fixes on top of it, one marked critical, for kernel buffer reallocation and the order of read completions. The installer refuses Windows versions older than 7 (1.5.3.0 was the last release for XP and Vista) and Windows To Go, asks Windows 7 users to install a SHA-2 update (KB3033929 or KB4474419) first, and requires a reboot after installation.
  • Capture runs on the analyst's own Windows machine. Either run USBPcapCMD.exe to choose a root-hub filter instance and an output file, or copy it into Wireshark's global or personal extcap folder; USBPcap support has been in Wireshark since 1.10.0rc1. The README notes that there is no capture engine DLL. The project's tour recommends capturing newly connected devices, or reconnecting a device after capture starts, so that its descriptors appear in the capture for Wireshark's dissectors.
  • Per the README, source builds use Windows Driver Kit 7.1.0 for the Windows 7 driver, or Visual Studio 2013 with WDK 8.1 Update for the Windows 8 build. Release drivers are attestation-signed through Microsoft's Hardware Dev Center with the author's own, non-public certificate. Self-built drivers are signed with the committed test certificate (certificates/USBPcapTestCert.*) and, as the README explains, load on 64-bit Windows only with test signing enabled. The only other committed binaries are the NSIS SysRestore.dll installer plugin and two public CA cross-certificates.
  • The project's capture-limitations page says USBPcap records URBs passed between the stack's functional and physical device objects. It therefore does not show bus states, packet IDs, split transactions, wire timing or transfer speed, nor the enumeration that happens before a device has its address; the page says those appear only in a hardware USB sniffer. Interpreting the captured payloads remains the analyst's own protocol work in Wireshark or another dissector.
  • The README and SPDX headers license the driver under GPL-2.0 and USBPcapCMD under BSD-2-Clause. GitHub detects no license because there is no license file at the repository root; the texts are in nsis/ and wix/. No driver was built or installed, and no USB traffic was captured.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README GitHub · desowin/usbpcap · Revision 477b6ed
  2. USBPcapCMD/cmd.c#L1118-L1182 GitHub · desowin/usbpcap · Revision 477b6ed
  3. USBPcapDriver/USBPcap.inx GitHub · desowin/usbpcap · Revision 477b6ed
  4. USBPcapDriver/USBPcapMain.c#L1-L5 GitHub · desowin/usbpcap · Revision 477b6ed
  5. nsis/USBPcap.nsi#L84-L125 GitHub · desowin/usbpcap · Revision 477b6ed
  6. config.bat GitHub · desowin/usbpcap · Revision 477b6ed
  7. certificates GitHub · desowin/usbpcap · Revision 477b6ed
  8. nsis/gpl-2.0.txt GitHub · desowin/usbpcap · Revision 477b6ed
  9. nsis/bsd-2clause.txt GitHub · desowin/usbpcap · Revision 477b6ed
  10. https://github.com/desowin/usbpcap/releases/tag/1.5.4.0
  11. https://desowin.org/usbpcap/
  12. https://desowin.org/usbpcap/tour.html
  13. https://desowin.org/usbpcap/capture_limitations.html
  14. https://desowin.org/usbpcap/captureformat.html

More in Protocols

All 66 entries in Protocols