Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] USBPcap: USB capture on Windows

From: Patrick Klos <patrick@xxxxxxxx>
Date: Fri, 12 Apr 2013 10:55:50 -0400
Tomasz Moń wrote:
Currently the live capture can be done on "standard input" capture basis: you write a magic command in cmd.exe and you get the Wireshark to capture raw USB traffic on Windows.

Unfortunately, on 64-bit versions of Windows, all drivers (that includes USBPcap filter driver which captures the raw USB data) have to be digitally signed. There is a USBPcap donation fund [2] running that collects money towards code signing certificate. If you like the idea of capturing raw USB traffic on Windows, please consider throwing a few bucks into the fund.

Hello Tomasz,

This sounds like an interesting feature. If I have some time to get to know the code and how it works, I may be willing to sign the driver(s) with my own certificate (once I can build them from scratch myself). I've recently built a system upon which I can get the latest Wireshark sources and build Wireshark from scratch. What does it take to get the USB support from there?

Sincerely,

Patrick Klos
Klos Technologies, Inc.