---
sidebar_position: 3
title: usbsnoop
---

# usbsnoop

> Live USB transfer sniffer from two fentry hooks. No usbmon, no hardware sniffer.

A real-time, colorized feed of USB traffic system-wide. Built on the two universal URB chokepoints every host-controller driver funnels through, so it works on xHCI/EHCI/OHCI/dwc alike with no per-controller tracepoints. Fully CO-RE portable. Control transfers decode their 8-byte SETUP packet; bulk transfers decode SCSI commands; payloads render as text or hexdump.

![usbsnoop demo](/img/examples/usbsnoop.gif)

## Running

```sh
yeet run github:yeet-src/usbsnoop
```

Filter to a specific device or transfer type:

```sh
yeet run github:yeet-src/usbsnoop -- --vid 0x046d --pid 0xc52b   # one device by id
yeet run github:yeet-src/usbsnoop -- --type control,int           # only these transfer types
yeet run github:yeet-src/usbsnoop -- --errors-only                # only failures
yeet run github:yeet-src/usbsnoop -- --json | jq .               # NDJSON
```

## Source

[`yeet-src/usbsnoop`](https://github.com/yeet-src/usbsnoop) on GitHub.