How to capture USB traffic with Wireshark in OSX Catalina (10.15)

问题

I am trying to get Wireshark USB captures working. Apparently the trick prior to Catalina was to just bring the interface up so that Wireshark could see it.

https://forums.developer.apple.com/thread/95380

However, this does not work in Catalina because the USB hubs are not shown as interfaces any longer. Is there another known way to "bring up" these interfaces in OSX? Perhaps a new system policy setting? How would one go about finding such a thing?

It might just be broken now. I imagine Wireshark and ifconfig use the same API to gather info about the interfaces.

回答1:

You need to disable SIP first

1. Restart your Mac
2. Hold down Command-R to reboot into Recovery Mode
3. Click Utility->Terminal, type "csrutil disable", click Enter.
4. Restart your Mac

then you can use "sudo ifconfig XHC20 up" command

来源：https://stackoverflow.com/questions/58523496/how-to-capture-usb-traffic-with-wireshark-in-osx-catalina-10-15