How to sniff a USB port under Windows?

Question

From time to time, I need to dump USB traffic under Windows, mostly to support hardware under Linux, so my primary goal is to produce dump files for protocol analysis.

For USB traffic, it seems that SniffUsb is the clear winner... It works under Windows XP (but not later) and has a much nicer GUI than earlier versions. It produces huge dump files, but everything is there.

However, my device is in fact a USB serial device, so I turned to Portmon which can sniff serial port traffic without the USB overhead.

user_13744 · Answer

USBSnoop works too - and is free.

Or, you could buy a USB to Ethernet converter and use whatever network sniffer you prefer to see the data.

user_14122 · Answer

Personally, I'd use QEMU or KVM and instrument their USB passthrough code, and then use libusb to prototype the replacement driver in user space (this latter bit I've done before; writing USB device drivers in Python is fun!).

user_1075282 · Answer

Microsoft Message Analyzer was able to capture USB traffic, with Device and Log File parser from MS: link

Update: as mentioned by @facetus, MS Message Analyzer has been retired on November 25 2019.

How to sniff a USB port under Windows?

6 Answers