What (software) usb sniffers are available for win

Question

Are there any software drivers for windows 7 (64-bit) that can report the data transferred between some application software and a usb device?

I have tried snoopy (http://sourceforge.net/projects/usbsnoop/) but I can't get it working. Possibly I would need to go down the route of installing an earlier version of windows.

Any other suggestions?

Answer 1

Here is a tutorial for installing and using a newer Windows 7 network monitor called Netmon.

http://blogs.msdn.com/b/usbcoreblog/archive/2009/12/04/etw-in-the-windows-7-usb-core-stack.aspx

I haven't tried it to see if it works. When I do, I will post an update saying whether it works with Windows 7 x64.

EDIT:

It worked on my Parallels Win7 x64 Virtual Machine.

The biggest downside was the massive amount of packets it logged. To help with this, the following filter can extract only the packets with your USB VID (vendor id), where the vid is 0xABCD.

// Following searches frame for hex data of 0xAB 0xCD

ContainsBin(FrameData, hex, "AB CD")

Note: As in the tutorial, to log usb packets, use the following commands in a cmd prompt run as an administrator:

Logman start Usbtrace -p Microsoft-Windows-USB-USBPORT -o usbtrace.etl -ets -nb 128 640 -bs 128

Logman update Usbtrace -p Microsoft-Windows-USB-USBHUB -ets

//Perform desired usb activities

Logman stop Usbtrace -ets

EDIT 2

UsbSnoop is another free option. I have confirmed that it works on my Win7 x64 machine.

http://www.pcausa.com/Utilities/UsbSnoop/

Answer 2

Try SourceUSB from SourceQuest. They have a demo version too.

Answer 3

Take a look at WDMSniffer by Compuware. It supports IRP, USB, 1394 (Firewire), SCSI, NDIS and TDI.

Answer 4

Windows web site has devon I think they call it.

Is that what you want?

Answer 5

USBPCap + Wireshark is a great new open-source solution that I recommend.

I've had good results with Event Tracing in Windows (ETW), as described at (link) (part 1) and in part 2 of that post. I remember the setup being somewhat involved though.

USBlyzer and USBTrace are both good products but they come with a $200 price tag. They both offer demo versions though and I've had good results with them. They're very easy to set up and use.

For a list of other tools see: here

Answer 6

busdog: http://code.google.com/p/busdog/

You need to enable test signing for 64 bit however