How to increase capture length ("frame.cap_len") when using Wireshark for USB sniffing on Ubuntu?
I'm using Wireshark 3.2.3 and usbmon for capturing USB traffic on Ubuntu 20.04. All the required tools and packages were installed just a week ago, so they ought to be of recent versions.
The problem looks like this in the captured log (after exporting it as JSON):
"frame.len": "524352",
"frame.cap_len": "245824",
Only half of the actual data was captured by Wireshark. Since the payload can only be decoded as a single continuous stream, this makes it entirely impossible to actually decode and analyze anything from this point forward.
How can I increase this limit and capture ALL the payload?
Will it work to capture to a file then open it in Wireshark for analysis?
Try making a capture with
tcpdump
or dumpcap, specifying asnaplen
with the-s
option.If that works, a possible workaround to specifying a large
snaplen
is in issue 15389.