USB Packet Sniffer Project - Page 1
Forum section: electronics / projects

author: aaamod
author_rank: Newbie
timestamp: March 27, 2014, 04:48:48 am
content: Hi EEVBlog,I've been given a project to design a USB packet sniffer as my final year design project. Given time/technical restraints, I've set my design objective to sniff packets at a full speed 12Mbit rate (similar to the Beagle USB 12).I'm only at the early design stage of my project, but am having trouble grasping some concepts and different design options in which I have been discussing with other academics.Would using a FPGA (with a UPLI or MAX3421E) be my best choice? I've looked into the option of using a microcontroller, but figured there would be too much added complexity with the uC (clock issues etc).At this stage, i'm feeling quite lost as the majority of my knowledge/skillset is quite far from this area that the project covers, but am quite keen to learn more and hopefully be able to get a satisfactory outcome.Is anybody able to clarify if my choice so far? Or is there any viable option that I may have missed.Thanks.

author: ve7xen
author_rank: Super Contributor
timestamp: March 27, 2014, 06:55:10 am
content: You may find some useful information from this project:http://openvizsla.org/I recall they had some videos or Kickstarter updates about their early design decisions which touch on some of the requirements to properly pass-through USB. Apparently it is not a very easy feature to do, as most chips include the MAC and PHY - or something. Poke around their documentation and you may avoid some traps for young players.

author: aaamod
author_rank: Newbie
timestamp: March 27, 2014, 09:30:01 am
content: Thank you, i'll have a look into it.With what you were saying about the difficulty of this project, i've been told by many academics that this is not a simple project, and that's what has me worried the most. I come from a network engineering background, and I was allocated this project. Hopefully i'll be able to at least get a satisfactory mark by the end of the year.

author: hlavac
author_rank: Frequent Contributor
timestamp: March 27, 2014, 05:00:31 pm
content: Is it intended as a USB debug tool with devices potentially violating the porotocol due to bugs to be found or does it expect perfect compliance with USB standard in the stuff it listens to?Is it going to store all the data (reverse engineering device protocol) or just a little (steal passwords typed on keyboard?)Is it going to communicate with a PC to send the captured data? Realtime or batch download?Will it understand and decode the device protocols (and possibly trigger on device level events) or just capture the raw traffic?Does it have to be stealthy/indetectable by the communicating devices or can it simply present itself and act as a USB hub device, affecting the setup?Does it have to support the OTG hosts?The more of the first options the more you need an FPGA to do the job...

author: aaamod
author_rank: Newbie
timestamp: March 28, 2014, 01:06:50 am
content: The device is to be used to sit in the middle of the data communication completely undetectable by the communicating host/device. With the data being either A) dumped into an SD card or B) outputted directly to another connected PC in the form that a software can understand (lets say wireshark).My current understanding is that the device is to be able to detect and output data that software sniffers can't, the low level protocol information. No OTG hosts support is required, as it would just make it much more complex.I've gone with the FPGA option for my design proposal which I am currently writing up and started looking into what is needed, I just feel like i've hit a brick wall at this point now from where to start.

author: marshallh
author_rank: Unknown
timestamp: March 28, 2014, 04:51:39 am
content: FPGA + ULPI PHYDownload the UTMI and ULPI specs. Read them and know them well.Next download the USB 2.0 spec (600 pages) and read it as your bible.Use Altera FPGAs since they have free SignalTap (words cant describe how useful and invaluable this is, Xilinx charges for it)You can do this but it will be a big challenge, especially if you've not used FPGAs before. I would set aside at least 3-6 months for thisAlso you will need a way to get the packet data back to the PC... use a FT232H for this purpose

author: abyrvalg
author_rank: Frequent Contributor
timestamp: March 28, 2014, 03:01:10 pm
content: If you need just 12Mbps FS then this can be done relatively cheap (both in parts and time): pick a classic 16-bit UTMI PHY (i.e. Microchip USB3250), force it to FS nondriving mode, attach UTMI side to Cypress FX2 in synchronous slave FIFO mode (CLKOUT is IFCLK, RXVALID is SLWR, DATA is DATA). No FPGAs, no memories.

author: aaamod
author_rank: Newbie
timestamp: April 03, 2014, 04:23:14 am
content: Thanks for all the advice, been going through the ULPI specs trying to get my head around everything, just about finished my design proposal so i'll hopefully be able to get stuck into this project once i'm done with it.

author: cduranleau
author_rank: Newbie
timestamp: August 07, 2015, 03:00:43 pm
content: Hi all, I'm getting an old thread out of sleep, but I have almost the same solution to create which is a hardware solution to capture USB data between a host and a printer. My solution must be transparent. The abyrvalg's solution looks great, but I will need more informations. Since I'm new to hardware stuff like MCU and FPGA, I will need help to understand the solution. If it's possible to achieve my goal without an FPGA, it would be great since the learning curve will not fit my project timeline.Just to help you help me, here's what my device would need to do :1) Be connected between a USB printer and a host, so the device will contains a device USB port and a host USB port.2) The host/printer communication must be able to continue event if the device is off.3) The device must be able to get a 'copy' of the data packets and log it for future analysis.For now, my solution is to use a low speed USB hub in the device to slow down the communication and, since a hub will broadcast all host communications to all ports, listen to the USB communication from one of the hub's device port. The USB hub will continue to work even if the device is off.I've tried using something like an Arduino, but the NZRI encoding is too timing sensitive and it's not possible to get something useful without adding a layer of buffering and protocol conversion between the Arduino and the USB signals. The best would be something that can read the USB data, store it in a FIFO buffer that can be read using a serial protocol.Any software solution based on something like a Raspberry PI or a BeagleBone isn't what I'm searching for since running a Linux involves a slow startup and filesystem corruptions.Any help will be appreciated.Thanks!Carl

author: mazurov
author_rank: Frequent Contributor
timestamp: August 07, 2015, 09:02:22 pm
content: MAX3421E won't work as well as any other SIE with internal phy, if you want to see real bus signaling (you do if you're shopping for an analyzer, otherwise there is plenty of free PC routines doing ch9/class decoding). As far as speed, you want to be able to decode on the fly if you need triggers; budget enough fast memory for buffers/lookup tables.

author: lapm
author_rank: Frequent Contributor
timestamp: August 09, 2015, 05:46:14 am
content: Quote from: aaamod on March 27, 2014, 04:48:48 am12 Mbit? So its USB 1.1 bus then? Since USB 2 goes up to 480Mbit... And USB 3 even higher then that.

author: cduranleau
author_rank: Newbie
timestamp: August 10, 2015, 02:18:14 pm
content: USB 2.0 also supports 12Mbps speed like USB 1.1. It only uses a different protocol.