Monday, February 24, 2025

How to watch USB traffic using Wireshark

 

macOS

Capturing USB traffic on macOS is possible since Wireshark 2.4.0, libpcap 1.9.0, and macOS High Sierra, using the XHC20 interface.

In order to capture on that interface, you will first have to run the command

ifconfig XHC20 up

as root, for example by running

sudo ifconfig XHC20 up

https://wiki.wireshark.org/CaptureSetup/USB