usbsnoop

Live USB transfer sniffer from two fentry hooks. No usbmon, no hardware sniffer.

A real-time, colorized feed of USB traffic system-wide. Built on the two universal URB chokepoints every host-controller driver funnels through, so it works on xHCI/EHCI/OHCI/dwc alike with no per-controller tracepoints. Fully CO-RE portable. Control transfers decode their 8-byte SETUP packet; bulk transfers decode SCSI commands; payloads render as text or hexdump.

Running

yeet run github:yeet-src/usbsnoop

Filter to a specific device or transfer type:

yeet run github:yeet-src/usbsnoop -- --vid 0x046d --pid 0xc52b   # one device by id
yeet run github:yeet-src/usbsnoop -- --type control,int           # only these transfer types
yeet run github:yeet-src/usbsnoop -- --errors-only                # only failures
yeet run github:yeet-src/usbsnoop -- --json | jq .               # NDJSON

Source

yeet-src/usbsnoop on GitHub.