ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] How to re-assemble contents of a USB upload?

From: Svenn Are Bjerkem <svenn.bjerkem@xxxxxxxxxxxxxx>
Date: Tue, 28 Jun 2011 23:30:16 +0200
On 28 June 2011 23:14, Svenn Are Bjerkem <svenn.bjerkem@xxxxxxxxxxxxxx> wrote:
> tshark -r capfile -R "usb.transfer_type == 2 && usb.data_len == 512"
> -T fields -e usb.capdata

Eager to test my new knowledge, I found that using
-e usb.setup.wValue -e usb.capdata
nicely gave me the base address in front of each chunk.

I also tested with usb.bmRequestType == 0x40 instead of usb.data_len
== 512, but that also gave me the final CPU release which fxload sends
after end of hex file. At least I know what to do.

Cheers,
-- 
Svenn