Ask Your Question

Revision history [back]

How to increase capture length ("frame.cap_len") when using Wireshark for USB sniffing on Ubuntu?

I'm using Wireshark 3.2.3 and usbmon for capturing USB traffic on Ubuntu 20.04. All the required tools and packages were installed just a week ago, so they ought to be of recent versions.

The problem looks like this in the captured log (after exporting it as JSON):

"frame.len": "524352",
"frame.cap_len": "245824",

Only half of the actual data was captured by Wireshark. Since the payload can only be decoded as a single continuous stream, this makes it entirely impossible to actually decode and analyze anything from this point forward.

How can I increase this limit and capture ALL the payload?