Debugging USB Traffic in Linux
![](https://ajo.es/wp-content/uploads/2025/02/image.png)
Debugging USB interacting code in Linux is possible in several ways, if you have a graphical interface you can rely on Wireshark, otherwise you can just use the text based interface to the usb monitor on the Linux Kernel.
In any case you always should start by finding your device Bus and Device number, for example:
sudo lsusb
sudo lsusb -v -d 1234:5678 # VID:PID
May output something like
Bus 002 Device 005: ID 1234:5678 YourDevice
If you are going with Wireshark, just filter with this:
usb.bus_id == 2 && usb.device_address == 5
If you want to use the kernel USB monitoring support manually, you can do:
sudo mount -t debugfs none /sys/kernel/debug
sudo modprobe usbmon
Then, you are ready to get traces for your device traffic, every usb bus has it’s own tracing output, for our example device it’s bus 2, we can find the output in that bus logger:
sudo cat /sys/kernel/debug/usb/usbmon/2u
If you want to filter for your specific device number (5 in this case)
sudo cat /sys/kernel/debug/usb/usbmon/2u | grep ":2:005:"
This is example output for a device on bus 1, device number 048:
majopela@f41:~/jumpstarter$ sudo cat /sys/kernel/debug/usb/usbmon/1u | grep "1:048"
ffff890ed46d9d80 3228854484 S Io:1:048:1 -115:1 64 = 11000000 002838f7 fd7f0000 04000000 00000000 96824000 00000000 00000000
ffff890ed46d9d80 3228855971 C Io:1:048:1 0:1 64 >
ffff890ed46d9d80 3228856073 S Ii:1:048:1 -115:1 64 <
ffff890ed46d9d80 3228856970 C Ii:1:048:1 0:1 64 = 0111d738 04a00411 04300020 00d30559 cabd6080 08116800 8410a0a0 b449120d
ffff890ed46d9d80 3233917728 S Io:1:048:1 -115:1 64 = 01000000 80969bdf fe7f0000 04000000 00000000 96824000 00000000 00000000
ffff890ed46d9d80 3233918971 C Io:1:048:1 0:1 64 >
ffff890ed46d9d80 3233919066 S Ii:1:048:1 -115:1 64 <
ffff890ed46d9d80 3233919971 C Ii:1:048:1 0:1 64 = 0101d738 04a00411 04300020 00d30559 cabd6080 08116800 8410a0a0 b449120d
ffff890ed46d9d80 3238289526 S Io:1:048:1 -115:1 64 = 21000000 f0d4061e fd7f0000 04000000 00000000 96824000 00000000 00000000
ffff890ed46d9d80 3238290830 C Io:1:048:1 0:1 64 >
ffff890ed46d9d80 3238290888 S Ii:1:048:1 -115:1 64 <
ffff890ed46d9d80 3238291829 C Ii:1:048:1 0:1 64 = 0101d738 04a00411 04300020 00d30559 cabd6080 08116800 8410a0a0 b449120d