Ask Your Question

Revision history [back]

how to analyze usb frames

I have a simple custom usb device using bulk transfer output from libusb (MAC) with endpoint size of 64 bytes and output buffer size of 256 that continuously writes, one buffer after another.

Wireshark reports a continuous stream of output frames alternately sized 40 and 63 bytes.

Can someone suggest documentation I can use to decode this output?

how to analyze usb frames

I have a simple custom usb device using bulk transfer output from libusb (MAC) with endpoint size of 64 bytes and output buffer size of 256 that continuously writes, one buffer after another.

Wireshark reports a continuous stream of output frames alternately sized 40 and 63 bytes.

Can someone suggest documentation I can use to decode this output?

Here's output from two frames in question.

No. Time Source Destination Protocol Length Info 3914 45.765242 UNKNOWN 40 WTAP_ENCAP = 0

Frame 3914: 40 bytes on wire (320 bits), 40 bytes captured (320 bits) on interface 0 Data (40 bytes)

0000 01 01 28 00 40 04 00 00 00 00 00 00 00 00 00 00 ..(.@........... 0010 73 02 58 0e 00 00 00 00 00 00 63 14 01 09 82 02 s.X.......c..... 0020 ff 01 01 00 ac 05 8d 82 ........ Data: 010128004004000000000000000000007302580e00000000... [Length: 40]

No. Time Source Destination Protocol Length Info 3915 45.776454 UNKNOWN 63 WTAP_ENCAP = 0

Frame 3915: 63 bytes on wire (504 bits), 63 bytes captured (504 bits) on interface 0 Data (63 bytes)

0000 01 01 28 01 17 00 00 00 00 00 00 00 00 00 00 00 ..(............. 0010 73 02 58 0e 00 00 00 00 00 00 63 14 01 09 82 02 s.X.......c..... 0020 ff 01 01 00 ac 05 8d 82 0b 20 13 00 0f 00 41 00 ......... ....A. 0030 a1 29 00 00 01 6a ef 03 8f 0a c6 bd 17 72 42 .)...j.......rB Data: 010128011700000000000000000000007302580e00000000... [Length: 63]

how to analyze usb frames

I have a simple custom usb device using bulk transfer output from libusb (MAC) with endpoint size of 64 bytes and output buffer size of 256 that continuously writes, one buffer after another.

Wireshark reports a continuous stream of output frames alternately sized 40 and 63 bytes.

Can someone suggest documentation I can use to decode this output?

Here's output from two frames in question.

No.     Time        Source  Destination  Protocol Length Info
 3914  45.765242                       UNKNOWN   40  WTAP_ENCAP = 0

0 Frame 3914: 40 bytes on wire (320 bits), 40 bytes captured (320 bits) on interface 0 Data (40 bytes)

bytes) 0000 01 01 28 00 40 04 00 00 00 00 00 00 00 00 00 00 ..(.@........... 0010 73 02 58 0e 00 00 00 00 00 00 63 14 01 09 82 02 s.X.......c..... 0020 ff 01 01 00 ac 05 8d 82 ........ Data: 010128004004000000000000000000007302580e00000000... [Length: 40]

40] No. Time Source Destination Protocol Length Info 3915 45.776454 UNKNOWN 63 63 WTAP_ENCAP = 0

0 Frame 3915: 63 bytes on wire (504 bits), 63 bytes captured (504 bits) on interface 0 Data (63 bytes)

bytes) 0000 01 01 28 01 17 00 00 00 00 00 00 00 00 00 00 00 ..(............. 0010 73 02 58 0e 00 00 00 00 00 00 63 14 01 09 82 02 s.X.......c..... 0020 ff 01 01 00 ac 05 8d 82 0b 20 13 00 0f 00 41 00 ......... ....A. 0030 a1 29 00 00 01 6a ef 03 8f 0a c6 bd 17 72 42 .)...j.......rB Data: 010128011700000000000000000000007302580e00000000... [Length: 63]

63]