{"repo":"yeet-src/usbsnoop","free":true,"listed":false,"github":"https://github.com/yeet-src/usbsnoop","clone":"git clone https://github.com/yeet-src/usbsnoop.git","description":"Live, system-wide USB transfer sniffer in eBPF — decodes USB traffic inline (control SETUP, SCSI, HID) from two universal URB hooks. No usbmon, no hardware sniffer. CO-RE portable.","language":"JavaScript","stars":86,"topics":["bpf","co-re","ebpf","libbpf","linux","observability","reverse-engineering","tracing","usb","usb-sniffer"],"license":null,"category":"analytics","readme_excerpt":"usbsnoop — live USB transfer sniffer from two fentry hooks A real-time, colorized feed of USB traffic system-wide — built on the two universal URB chokepoints every host-controller driver funnels through, so it works on xHCI/EHCI/OHCI/dwc alike with no per-controller tracepoints and no usbmon . Fully CO-RE portable. fentry hook what it tells us ------------------------ ------------------------------------------------------- usb submit urb a transfer was queued (device, endpoint, type, payload) usb hcd giveback urb it completed (status, bytes moved, latency, payload) An lru hash keyed by the URB pointer stitches the two together: submit stamps a start time, completion reads it back for the submit→complete latency, then deletes it. This mirrors httpbody 's request/response pairing — SUBMIT is the \"request\" (what the host sends), COMPLETE the \"response\" (what the device returns). Control transfers get their 8-byte SETUP packet decoded into the standard request name ( GET DESCRIPTOR , SET CONFIGURATION , …); data stages render as text when they look textual and as a hexdump otherwise. Output is one line per event (compact). The first time a device appears it gets a ▸ legend line ( bus-dev , vid:pid , product, link speed); after that each row carries only the short DEV tag, so the left-hand columns stay aligned and scannable under heavy traffic. Each row shows time, kind (SUBMIT/CMPLT), transfer type, epNdir , the direction arrow ( ← device→host IN, → host→device OUT), byte counts","default_branch":null,"files":null,"tree":[],"storefront":"/r/yeet-src","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/yeet-src/usbsnoop/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}