Ask Your Question

What is the differences between USBPcap1 and USBPcap2?

asked 2021-03-27 14:33:32 +0000

Domestic Diagnose gravatar image

I have 3 USB slots in my notebook, but in Wireshark I only have USBPcap1 and USBPCap2, and I don't have USBPCap3.

In fact, all 3 slots have USB devices plugged in, but only USBPCap2 has continuing packets traffic. Each time when I tried to capture packets for USBPCap1, I can only capture 25 packets and then the traffic stops growing.

I also tried to remove all USB devices from all 3 slots, and then the packets traffic of USBPCap2 will stop.

For the 3 slots (I called them A, B and C), no matter I plugged in A only (i.e. no USB devices at B and C), or plugged in B only, or plugged in C only, USBPCap2 would still have continuing packets traffic.

Why? What am I actually capturing for USBPcap1 and USBPCap2? Thanks.

image description

edit retag flag offensive close merge delete


You have to provide hardware details in order to get answer this question. Make sure to include chipset model and version/revision.

desowin gravatar imagedesowin ( 2021-03-28 04:46:13 +0000 )edit

Also it might be worthwile to post capture from USBPcap1 as that might be descriptors for embedded devices (e.g. camera, card reader)

desowin gravatar imagedesowin ( 2021-03-28 04:48:03 +0000 )edit

Your capture points might be capturing ALL USB traffic. Multiple ports can be part of 1 USB hub in your machine. So if you capture that hub you get them all.

hugo.vanderkooij gravatar imagehugo.vanderkooij ( 2021-03-29 07:38:58 +0000 )edit

@desowin Thanks for your reply. Below is the chipset info, is that sufficient?

"IDE ATA/ATAPI Controllets" = "Intel(R) 9 Series Chipset Family SATA AHCI Controller" Driver Date: 8/22/2014 Driver version =

Domestic Diagnose gravatar imageDomestic Diagnose ( 2021-03-29 15:56:44 +0000 )edit

No, you provided SATA chipset info. What would be better is EHCI or xHCI. Notebook model number might be helpful as well.

desowin gravatar imagedesowin ( 2021-03-30 18:03:51 +0000 )edit

1 Answer

Sort by » oldest newest most voted

answered 2021-04-02 17:07:24 +0000

desowin gravatar image

updated 2021-04-02 18:54:53 +0000

Since the asker didn't provide exact hardware details, I am going to answer this based on a system that has three USBPcap interfaces (USBPcap1, USBPcap2, USBPcap3). Basically there is one USBPcap instance for each host controller present in the system.

Lenovo Y50-70 laptop has three external USB Type A receptacles. This laptop features Intel 8 series/C220 Series Chipset Family Platform Controller Hub (PCH) which includes xHCI host controller and two legacy EHCI host controllers. Table 2-2. USB Interface Signals lists pins and their possible connection. In this particular case, basically all USB 2.0 signal pairs can be router to xHCI or one of the EHCI (each pair has strictly defined to which of the two EHCI it can be routed) through software. For example USB2p0 and USB2n0 can be routed to xHCI or EHCI Controller 1.

When Windows runs, on this particular laptop with the drivers that I have currently installed, all USB devices, both internal (bluetooth, camera) and external ones (connected to external Type A receptacles) are routed to xHCI. This turns out to be USBPcap3. It is number 3 because this is the order the hardware gets probed on that particular machine with the installed drivers. In general, this can vary between machines, but should be stable on any particular one (that is, if device appears on USBPcap3 it will keep appearing there).

The reason behind EHCI controlling is mostly to facilitate installation of older operating systems that do not support xHCI. White Paper for the EHCI Removal from the 6th Generation Intel® Core™ Processor Family Platform Controller Hub discusses the implications of EHCI removal. New systems based on Intel no longer have EHCI controllers, the example is Dell Latitude 7490 that has only the xHCI controller, and thus only USBPcap1.

Note that if you have Thunderbolt capable laptop and a Thunderbolt docking station, it is likely that after connecting the docking station a new USBPcap interface will appear. This is the case atleast with Dell docking station and CalDigit USB-C Pro Dock. In this case, repeatedly disconnecting and connecting of the docking station will result in disappearing of USBPcapN interface and appearance of USBPcapN+1. All devices connected to the docking station will appear on the new (docking station) interface, while devices connected to the laptop directly will appear on USBPcap1 (in case of Dell Latitude 7490).

For more general information about USB you can check out USB Analysis 101 from SharkFest'20 Virtual.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-03-27 14:33:32 +0000

Seen: 1,729 times

Last updated: Apr 02 '21