Software USB Sniffer - Page 1
Forum section: electronics / general

author: jpanhalt
author_rank: Super Contributor
timestamp: June 06, 2025, 10:53:23 am
content: I am interested in trying a software usb sniffer as I work on getting my PIC16F1459 going. It is one of the few 8-bit PICs with hardware USB. Low speed is not a problem.Are there any safe, free, and simple sites you can recommend?I found two that seem attractive:https://freeusbanalyzer.com/https://desowin.org/usbpcap/Comments on either? Is a hardware solution better?

author: voltsandjolts
author_rank: Unknown
timestamp: June 06, 2025, 02:49:03 pm
content: Wireshark is free, uses a driver (USBPcap) to capture usb packets and gives a reasonable decode, including standard device classes.There is also an excellent hardware capture device from Alex, which is available pre-built on AliX;https://www.eevblog.com/forum/projects/low-cost-lsfshs-usb-sniffer-with-wireshark-interface/https://www.aliexpress.us/item/3256806174548913.html

author: voltsandjolts
author_rank: Unknown
timestamp: June 06, 2025, 02:52:24 pm
content: For a 16F usb stack, I can recommendhttps://github.com/signal11/m-stackThere is also vendor stuff, but IIRC I found it much harder to the code follow.

author: jpanhalt
author_rank: Super Contributor
timestamp: June 06, 2025, 03:53:18 pm
content: Thanks for the replies. I saw the stuff by Alex and recognized the name (and picture) immediately.This is just a tangent to another project that I built to provide an automatic stop while doing right-hand threading on a lathe. That requires you to thread toward the spindle and often to a shoulder. Of course, it can be used for other things too. Currently, the control has its own numeric keypad, which works fine for development, but in use, I don't like reaching across a lathe to press buttons. So, I am making a wireless keypad. XBee, which I had done before, and simple BT were my first thoughts, but all the inexpensive numeric keypads are either 2.4 GHz w/ dongle or more sophisticated BT, so I am focusing on using a dongle. Ultimately, I just want ASCII or equivalent data sent wirelessly.After posting, I came across the Maxim 3420E/3421E chips and BOB's, which might simplify things. Do you have experience with those?

author: amyk
author_rank: Super Contributor
timestamp: June 07, 2025, 03:38:40 am
content: I usedhttp://benoit.papillault.free.fr/usbsnoop/a long time ago, simple and unobtrusive, no idea if it works on newer Windows versions but it might.

author: RoGeorge
author_rank: Super Contributor
timestamp: June 07, 2025, 07:27:21 am
content: Wireshark for software only sniffer, most of the times this should be enough, or not even needed.If it must be a hardware sniffer, then any Logic Analyzer (hardware) compatible with Sigrok should be enough, including the cheap clones. Sigrok can decode USB.

author: Doctorandus_P
author_rank: Super Contributor
timestamp: June 07, 2025, 09:46:38 am
content: This approach does not work. At least, when you rely on the software stack of your operating system to handle USB. When you are starting with getting an uC with USB to work, then you are likely to generate a lot of invalid packets, and those don't get though the software stack of your PC, or even though the USB controller hardware itself.A long time ago I played a bit with the USB5 Logic Analyser and Sigrok / Pulseview and I have successfully captured raw low speed (1.5Mbps) data with it. Later I bought a more capable Kingst LA2016 Logic Analyser which also works with Pulseview.Pulseview has very nice decoders for low level USB. It shows you where T states are, keep alive packets, Checksums and whether they're valid and lots of other things. Logic analyzers also have many pins, and extra pins can be used for software debugging. For example:* One I/O pin is always toggling when the uC is Idle (It stops toggling when an ISR is triggered).* You can send out SPI or UART data (single byte) at a high baud rate as a sort "printf() debug statements. The LA also captures timing relative to other things. For example when you write a single byte to a uart data register each time an ISR is triggered you can keep track of 256 different ISR's and when they are triggered. Send a byte at start and end of an ISR and you know how long the ISR (or function or whatever) took to complete.

author: Doctorandus_P
author_rank: Super Contributor
timestamp: June 07, 2025, 10:02:17 am
content: In addition:I very much like the software USB stack from Obdev. It uses an AVR (Atmega(32)or similar, and it needs a 12MHz crystal. It also has serious software limitations because it bitbangs low-speed USB, and USB sends packets every ms.But the beauty of this lib is that it's quite well written C-code, (and a bit of assembly) The few pages of C code is much easier to digest then the gazillion pages of USB documentation. This USB firmware is most famous for being used in the USBasp programmer, which got cloned heavily by china. A working development board costs EUR 2 or something like that. Maybe the war is over now Microchip bought Atmel, and both uC's can live on your desk together. That way you can capture USB data from both, and compare and attempt to replicate, without knowing much about low-level USB. Of course you will need to read USB documentation and the datasheet of the USB peripheral too, but this hands-on approach is a good addition to reading long manuals.For actual projects, the obdev library is mostly obsolete, as many uC's have built in USB hardware, but for learning low level USB signalling, it's a great tutorial aid.

author: jpanhalt
author_rank: Super Contributor
timestamp: June 07, 2025, 11:07:34 am
content: I was totally ignorant about USB. After more reading, I am beginning to realize you always need a "host," and my original approach based on being able to assign master/slave won't work. Jan Axelson's USB Complete, 5th ed. (Amazon) arrived yesterday, and I have been trudging through it. In addition, a few enlightening threads on Microchip forums said flatly that PIC's (al least 8-bit ones) with USB could only be devices, not host.I ordered a MAX 3421E "Feather" (Adafruit) last night. It should be here mid-week, but I won't be able to touch it until the 18th. If that fails, I will go back to a non-USB solution. With so many low-priced and nice numeric keypads around, I am reluctant to do a DIY at the keypad, but will, if needed.

author: aeg
author_rank: Regular Contributor
timestamp: June 08, 2025, 12:32:21 am
content: If you want your microcontroller to be a USB host, the phrase to look for in the datasheet / parametric search is USB OTG (on-the-go).

author: jpanhalt
author_rank: Super Contributor
timestamp: June 08, 2025, 12:55:22 am
content: I just became familiar with that term before ordering the MAX 3421E BOB (Chapter 21 of Jan Axelson's book). I would have to graduate to the PIC 24F family to get that. The MAX 3421E datasheet doesn't use that term, but is does say "host." Unfortunately, I won't get to play with it until the middle of the week of June 16th.

author: 8goran8
author_rank: Contributor
timestamp: June 08, 2025, 05:20:03 pm
content: Microchip MLA has examples for a USB host HID keyboard for PIC24, dsPIC33 and PIC32 devices.https://www.microchip.com/en-us/tools-resources/develop/libraries/microchip-libraries-for-applications