22

Is there a way to sniff the USB port on a Mac? I've looked at libusb and #usblib but I can't find anything that works on the Mac.

2
  • Who told you libusb doesn't work on OS X?
    – user529758
    Dec 11, 2012 at 19:46
  • 2
    libusb works with OSX; I couldn't find a libusb-based sniffer.
    – vy32
    Dec 11, 2012 at 21:18

3 Answers 3

17

I found a way, you'll need Wireshark's nightly build (I am using V2.5.0rc0). After you install it, you'll need to bring up the USB "interface":

sudo ifconfig XHC20 up

And after that you can use wireshark to sniff all the traffic in the XHC20 interface. When you finish, remember to turn the interface down:

sudo ifconfig XHC20 down

Source: aud-ios.

3
  • 4
    Note: this requires macOS 10.13 (High Sierra). It does not work on macOS 10.12.6 or earlier.
    – rob mayoff
    Mar 11, 2018 at 16:01
  • 2
    I tried this recently with 10.13 High Sierra and a ~7 year old MacBook. There was no XHC20 interface. But with a bit of sleuthing tinkering, I figured out that the EHC36 and EHC38 interfaces were USB interfaces and I was able to capture USB traffic from them using both Wireshark and tcpdump -i EHC38
    – D. Woods
    Apr 19, 2020 at 4:29
  • 1
    You can still use sude ifconfig XCH20 up in MacOS 10.15+ by turning off System Integrity Protection 1. restarting in Recovery Mode (Command + R) 2. opening Terminal 3. typing csrutil disable 4. restarting Jan 10, 2021 at 12:07
5

Beware when installing IOUSBFamily log. It has not been updated in a few years. The OS X versions must match or else all usb devices including builtin touchpad/keyboard could not work. If that does happen you must reload the proper kext manually from recovery:

https://discussions.apple.com/message/20152486#20152486

Here is the steps to reload from recovery:

I had the same issue after installing USB Prober from a wrong OS version on my machine. It installed without any warnings but it turned out that this includes IOSUSBFamily.kext kernel module that's not going to work on my machine and this disabled all the USB devices (which includes laptop's own keyboard and trackpad).

Here's how I fixed it, but please be extremely careful not to break your machine:

1) Hold CTRL+R and turn on your machine, this will boot into the "Recovery mode"

2) Open Terminal

3) Find out where is your original IOUSBFamily kernel extension and the one on the Macintosh HD are. Mine were here:

Original: /System/Library/Extensions/IOUSBFamily.kext

New one (broken): /Volumes/Macintosh\ HD/System/Library/Extensions/IOUSBFamily.kext

4) Move the broken module away:

$ mkdir /Volumes/Macintosh\ HD/Users/recovery-backup
$ mv /Volumes/Macintosh\ HD/System/Library/Extensions/IOUSBFamily.kext /Volumes/Macintosh\ HD/Users/recovery-backup

5) Copy back the original:

$ cp -a /System/Library/Extensions/IOUSBFamily.kext /Volumes/Macintosh\ HD/System/Library/Extensions/IOUSBFamily.kext

Reboot and it should be fixed.

1
  • This is worse than Linux :D Sep 20, 2018 at 9:01
4

You can use IOUSBFamily log. If you are on OSX 10.8.2, you'd probably want to try USB Prober included in Hardware IO Tools for Xcode, February 2012 (Apple Developer account required for both links), since the latest version of IOUSBFamily is for OSX 10.9.4.

Even now (in 2018) there are no newer releases than for 10.9.4, and they don't work in newer macOS releases.

3
  • So I've tried using this plus the Prober and it seems I only get the first two DWORDS worth of data even if the length says there is more. For what I'm trying to accomplish this isn't enough information. Any other ideas?
    – jbh
    Feb 28, 2013 at 14:01
  • If you can get away with using Linux instead of Mac OS, Wireshark supports USB sniffing: wiki.wireshark.org/CaptureSetup/USB
    – alexgolec
    Jan 8, 2014 at 17:37
  • 1
    Apple don't provide IOUSBFamily log for El Capitan 10.11.5. It seems they stopped updating it a few years ago. They do publish the source: opensource.apple.com/tarballs/IOUSBFamily but was unable to compile the latest version in Xcode due to errors.
    – donturner
    Jul 15, 2016 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.