To save time, does anyone know of a Wireshark forum? I found their wiki, but Google does not reveal a robust forum such as this where you can ask questions.
That having been said, would you please help me sort this out:
How to get Wireshark to see usbmon0? ls -l /dev/usbmon* shows
crw-r–r-- 1 root root 248, 0 Jan 10 14:50 /dev/usbmon0
crw-r–r-- 1 root root 248, 1 Jan 10 14:50 /dev/usbmon1
crw-r–r-- 1 root root 248, 2 Jan 10 14:50 /dev/usbmon2
but Wireshark only sees the latter two.
We have a piece of boat gear (RayMarine C120W) that bridges NMEA 0183 (ASCII) and EtherNet (“SeaTalk-HS”) data for transmission to Windows software (RayTech Navigation System—RNS). The bridged data are wired to a DB-9F chassis connector near the laptop. We did have a Serial to Ethernet cable that connected to an older laptop running the software that had an Ethernet Socket. It worked fine.
We have not touched the boat wiring, but have lost the cable and necessarily moved the software to a new laptop (openSUSE Leap 42.1 Linux) that does not have an Ethernet socket, only USB.
We have a Gigaware 2603487 USB-A to Serial Cable. It is recognized by the laptop and connected to ttyUSB0. We can read that port at the command line interface—CLI—with cat /dev/ttyUSB0 and see the NMEA 0183 ASCII sentences but not the Ethernet stream.
3.1 I understand that the EtherNet traffic is higher frequency and multiplexed, yada yada, so will address that aspect (“EtherNet over USB”) in due course, but first we need Wireshark to see the basic USB data that we can see on the CLI (presumably on usbmon0) to ensure that Wireshark is reading the USB connection.
5.1 After a new modprobe usbmon after a reboot ls -l /dev/usbmon* returns
crw-r–r-- 1 root root 248, 0 Jan 10 14:50 /dev/usbmon0
crw-r–r-- 1 root root 248, 1 Jan 10 14:50 /dev/usbmon1
crw-r–r-- 1 root root 248, 2 Jan 10 14:50 /dev/usbmon2
so others (user, wireshark group) should be able to read.
5.2 So indeed usbmon0 exists but it does not appear in Wireshark. Wireshark only shows usbmon1 and usbmon2.
Neither has any interesting traffic, certainly not the ASCII stream that we can see on the CLI.
We have attempted using a USB connected EtherNet to USB adapter with a Serial to Ethernet cable. It is recognized by the OS and
Wireshark sees it as eth0 but there is zero traffic on it.
We can proceed further with EtherNet over USB once we have determined that Wireshark can read usbmon0 (ttyUSB0).
How to get Wireshark to see usbmon0?
Thanks in advance. Thank you again for this excellent forum. Happy New Year.
4.1 Sorted out usbmon. It needs to be restarted after each reboot (modprobe usbmon), a PITA we’ll address later.
Load it at boot via custom file in /etc/modprobe.d/ directory eg 30-usbmon.conf
This might be helpful…
Modern kernels (with the usbmon module loaded) also create a /dev/usbmonX device which is first probed for by Wireshark (actually, libpcap). When you run Wireshark as non-root user, it will not be able to capture from those devices. In that case, make sure that your user is allowed to read from it (write access is unnecessary):
sudo setfacl -m u:$USER:r /dev/usbmon1
Alternatively, if you do not have setfacl installed:
If you find yourself unable to resolve your Wireshark sniffing USB problem,
An alternative is to use USBMon and tcpdump to capture your traffic (That should be pretty easy) to file,
Then open the file in Wireshark for analysis.
Google “tcpdump usb” and you’ll get plenty of hits on setting up and capturing.
BTW - Have you tried just pointing Wireshark to each one of the USB ports it recognizes and see if there’s any traffic?
Might be that there’s just some labeling issue, but functionality is there.
We tried these again, same result:
Wireshark sees usbmon1 and usbmon2 but not usbmon0.
So there is something about usbmon0 that continues to evade me.
I’m sure we shall solve it in due course. Thank you again.
Kind regards, Andy
=========================================================
sudo setfacl -m u:$USER:r /dev/usbmon*
results in
[INDENT=2] andy@spectre:~> ls -l /dev/usbmon*
crw-r–r–+ 1 root root 248, 0 Jan 12 17:39 /dev/usbmon0
crw-r–r–+ 1 root root 248, 1 Jan 12 17:39 /dev/usbmon1
crw-r–r–+ 1 root root 248, 2 Jan 12 17:39 /dev/usbmon2
[/INDENT]
But no joy. Wireshark still can see usbmon1 and usbmon2 but not usbmon0:
, I’ve spent some time reading about sticky bits (+). They can be removed with
[INDENT=2]setfacl -b /dev/usbmon*
[/INDENT]
