Capturing USB data through Wireshark

1)Install Wireshark through Update Manager.

2)Enable usbmon through below commands

#mount -t debugfs none_debugs /sys/kernel/debug

#modprobe usbmon

#ls /sys/kernel/debug/usb/usbmon

0s  0u  1s  1t  1u  2s  2t  2u  3s  3t  3u  4s  4t  4u 

3)Check the USB devices through tshark
#sudo tshark -D

E.g:
#sudo tshark -D
tshark: Lua: Error during loading:
 [string "/usr/share/wireshark/init.lua"]:45: dofile has been disabled
1. eth0
2. wlan0
3. usbmon1 (USB bus number 1)
4. usbmon2 (USB bus number 2)
5. usbmon3 (USB bus number 3)
6. usbmon4 (USB bus number 4)
7. any (Pseudo-device that captures on all interfaces)
8. lo

4)List of de-vices connected can be seen through the command
#usb-devices

5)
If the device is connected to usb2,then to capture through wireshark command has below:

#sudo tshark -i usbmon2 -w 1.pcap

Open the capture file through Wireshark GUI.

USBMon capturing

1)mount -t debugfs none_debugs /sys/kernel/debug

2)modprobe usbmon

3)ls /sys/kernel/debug/usb/usbmon

0s  0u  1s  1t  1u  2s  2t  2u  3s  3t  3u  4s  4t  4u 

4)Find which bus connects to the desired device
 Run "cat /proc/bus/usb/devices", and find the T-line which corresponds to
 the device. Usually you do it by looking for the vendor string. If you have
 many similar devices, unplug one and compare two /proc/bus/usb/devices outputs.
 The T-line will have a bus number. Example:
 
 T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12  MxCh= 0
 D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
 P:  Vendor=0557 ProdID=2004 Rev= 1.00
 S:  Manufacturer=ATEN
 S:  Product=UC100KM V2.00
 
 Bus=03 means it's bus 3.
 
 3. Start 'cat'
 
 # cat /sys/kernel/debug/usb/usbmon/3u > /tmp/1.mon.out
 
 to listen on a single bus, otherwise, to listen on all buses, type:
 
 # cat /sys/kernel/debug/usb/usbmon/0u > /tmp/1.mon.out