Is there a way to sniff the USB port on a Mac? I've looked at libusb and #usblib but I can't find anything that works on the Mac.
3 Answers
I found a way, you'll need Wireshark's nightly build (I am using V2.5.0rc0). After you install it, you'll need to bring up the USB "interface":
sudo ifconfig XHC20 up
And after that you can use wireshark to sniff all the traffic in the XHC20
interface. When you finish, remember to turn the interface down:
sudo ifconfig XHC20 down
Source: aud-ios.
-
4Note: this requires macOS 10.13 (High Sierra). It does not work on macOS 10.12.6 or earlier. Mar 11, 2018 at 16:01
-
2I tried this recently with 10.13 High Sierra and a ~7 year old MacBook. There was no XHC20 interface. But with a bit of sleuthing tinkering, I figured out that the
EHC36
andEHC38
interfaces were USB interfaces and I was able to capture USB traffic from them using bothWireshark
andtcpdump -i EHC38
– D. WoodsApr 19, 2020 at 4:29 -
1You can still use
sude ifconfig XCH20 up
in MacOS 10.15+ by turning off System Integrity Protection 1. restarting in Recovery Mode (Command + R) 2. opening Terminal 3. typingcsrutil disable
4. restarting Jan 10, 2021 at 12:07
Beware when installing IOUSBFamily log. It has not been updated in a few years. The OS X versions must match or else all usb devices including builtin touchpad/keyboard could not work. If that does happen you must reload the proper kext manually from recovery:
https://discussions.apple.com/message/20152486#20152486
Here is the steps to reload from recovery:
I had the same issue after installing USB Prober from a wrong OS version on my machine. It installed without any warnings but it turned out that this includes IOSUSBFamily.kext kernel module that's not going to work on my machine and this disabled all the USB devices (which includes laptop's own keyboard and trackpad).
Here's how I fixed it, but please be extremely careful not to break your machine:
1) Hold CTRL+R and turn on your machine, this will boot into the "Recovery mode"
2) Open Terminal
3) Find out where is your original IOUSBFamily kernel extension and the one on the Macintosh HD are. Mine were here:
Original: /System/Library/Extensions/IOUSBFamily.kext
New one (broken): /Volumes/Macintosh\ HD/System/Library/Extensions/IOUSBFamily.kext
4) Move the broken module away:
$ mkdir /Volumes/Macintosh\ HD/Users/recovery-backup
$ mv /Volumes/Macintosh\ HD/System/Library/Extensions/IOUSBFamily.kext /Volumes/Macintosh\ HD/Users/recovery-backup
5) Copy back the original:
$ cp -a /System/Library/Extensions/IOUSBFamily.kext /Volumes/Macintosh\ HD/System/Library/Extensions/IOUSBFamily.kext
Reboot and it should be fixed.
You can use IOUSBFamily log. If you are on OSX 10.8.2, you'd probably want to try USB Prober included in Hardware IO Tools for Xcode, February 2012 (Apple Developer account required for both links), since the latest version of IOUSBFamily is for OSX 10.9.4.
Even now (in 2018) there are no newer releases than for 10.9.4, and they don't work in newer macOS releases.
-
So I've tried using this plus the Prober and it seems I only get the first two DWORDS worth of data even if the length says there is more. For what I'm trying to accomplish this isn't enough information. Any other ideas?– jbhFeb 28, 2013 at 14:01
-
If you can get away with using Linux instead of Mac OS, Wireshark supports USB sniffing: wiki.wireshark.org/CaptureSetup/USB Jan 8, 2014 at 17:37
-
1Apple don't provide IOUSBFamily log for El Capitan 10.11.5. It seems they stopped updating it a few years ago. They do publish the source: opensource.apple.com/tarballs/IOUSBFamily but was unable to compile the latest version in Xcode due to errors. Jul 15, 2016 at 20:36