What (software) usb sniffers are available for windows? [closed]

回眸只為那壹抹淺笑 提交于 2019-11-29 19:51:54

Had decent luck with this tool many years ago. http://www.sysnucleus.com/

wgardiner

USBPCap + Wireshark is a great new open-source solution that I recommend.

I've had good results with Event Tracing in Windows (ETW), as described at (link) (part 1) and in part 2 of that post. I remember the setup being somewhat involved though.

USBlyzer and USBTrace are both good products but they come with a $200 price tag. They both offer demo versions though and I've had good results with them. They're very easy to set up and use.

For a list of other tools see: here

Here is a tutorial for installing and using a newer Windows 7 network monitor called Netmon.

http://blogs.msdn.com/b/usbcoreblog/archive/2009/12/04/etw-in-the-windows-7-usb-core-stack.aspx

I haven't tried it to see if it works. When I do, I will post an update saying whether it works with Windows 7 x64.

EDIT:

It worked on my Parallels Win7 x64 Virtual Machine.

The biggest downside was the massive amount of packets it logged. To help with this, the following filter can extract only the packets with your USB VID (vendor id), where the vid is 0xABCD.

// Following searches frame for hex data of 0xAB 0xCD

ContainsBin(FrameData, hex, "AB CD")

Note: As in the tutorial, to log usb packets, use the following commands in a cmd prompt run as an administrator:

Logman start Usbtrace -p Microsoft-Windows-USB-USBPORT -o usbtrace.etl -ets -nb 128 640 -bs 128

Logman update Usbtrace -p Microsoft-Windows-USB-USBHUB -ets

//Perform desired usb activities

Logman stop Usbtrace -ets

EDIT 2

UsbSnoop is another free option. I have confirmed that it works on my Win7 x64 machine.

http://www.pcausa.com/Utilities/UsbSnoop/

busdog: http://code.google.com/p/busdog/

You need to enable test signing for 64 bit however

USBPcap: http://desowin.org/usbpcap/ Works under XP, Vista, 7 and 8.

Still work in progress though so no end-user installer yet.

Take a look at WDMSniffer by Compuware. It supports IRP, USB, 1394 (Firewire), SCSI, NDIS and TDI.

johnny alpaca

Try SourceUSB from SourceQuest. They have a demo version too.

Windows web site has devon I think they call it.

Is that what you want?

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!