URB Function: URB_FUNCTION_CONTROL_TRANSFER (0x0008)

Time Source Destination Protocol Length InfoĦ00 67.997889 2.0 host USB 44 URB_CONTROL outįrame 600: 44 bytes on wire (352 bits), 44 bytes captured (352 bits) URB Function: URB_FUNCTION_CLASS_DEVICE (0x001a)

IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000) Time Source Destination Protocol Length Infoĥ99 67.996889 host 2.0 USB 36 URB_CONTROL outįrame 599: 36 bytes on wire (288 bits), 36 bytes captured (288 bits) but where is the data? Or there no data phase here? What is frame 600 then?ĭ)what is frame 601? a status ACK?… but then the data and ACK have the same source? No. So I could agree with the direction (host->device). At least,it does not match my expectations 🙂 … And the data part of the enumeration, hid report etc… seems sometimes to be displayed with the setup data (8 bytes) and sometime not… I don't really know what URB is… there is no mention of that in the usb protocol as far as I could see… It looks to me that wireshark/usbmon trace at a higher stack level and tries to deduce what would be on the wire from that…Īn example of what I can see is given below, what to we see here?.Ī)I could not even find bmtype=0x20 (of the setup, frame No=599)in the specs.ī)Because I have a HID device, I assumed this could be a report/feature config (the enumeration is passed at this stage).

The direction of the transaction is very strange as well (to/from fields).

I have looked at the usb protocol from What does wireshark show?ġ)One line per packet? (token, data, handshake)Ģ)One line per transaction? (token + + handshake) (my guess) I am trying to reverse engineer an usb (HID) device and cannot really figure out how what I see on wireshark (usbmon + wireshark on linux, or windows) relates to the usb protocol?.

Wireshark usb filter