NETCAP
Overview
GitHub
Homepage
GoDoc
Search…
v0.5
Overview
Audit Records
Specification
Installation
Quickstart
Configuration
Bash Completion
Packet Collection
Audit Record Labeling
HTTP Proxy
USB Capture
Payload Capture
Distributed Collection
Workers
Filtering and Export
Data Compression
Internals
Metrics
Resolvers
TLS Fingerprinting
Reassembly
Deep Packet Inspection
Live Capture
Maltego Integration
Logging
Packet Contexts
Industrial Control Systems
File Extraction
Email Extraction
Device Profiles
Python Integration
Changelog
Troubleshooting
Unit Tests
Extension
Downloads
Docker Containers
FAQ
Contributing
License
Powered By
GitBook
USB Capture
Capture traffic sent via Universal Serial Bus (USB) protocol
Live Capture
USB live capture is now possible, currently the following Audit Records exist: USB and USBRequestBlockSetup.
To capture USB traffic live on macOS, install wireshark and bring up the USB interface:
1
$ sudo ifconfig XHC20 up
Copied!
Now attach netcap and set baselayer to USB:
1
$ net.cap -iface XHC20 -base usb
Copied!
Offline from dumpfile
To read offline USB traffic from a PCAP file use:
1
$ net.cap -r usb.pcap -base usb
Copied!
Don't forget to set the
-payload
flag if you want to preserve the data being transmitted!
Audit Records
The
USB
and
USBRequestBlockSetup
audit records contain the following fields:
1
message
USB
{
2
string
Timestamp
=
1
;
3
uint64
ID
=
2
;
4
int32
EventType
=
3
;
5
int32
TransferType
=
4
;
6
int32
Direction
=
5
;
7
int32
EndpointNumber
=
6
;
8
int32
DeviceAddress
=
7
;
9
int32
BusID
=
8
;
10
int64
TimestampSec
=
9
;
11
int32
TimestampUsec
=
10
;
12
bool
Setup
=
11
;
13
bool
Data
=
12
;
14
int32
Status
=
13
;
15
uint32
UrbLength
=
14
;
16
uint32
UrbDataLength
=
15
;
17
uint32
UrbInterval
=
16
;
18
uint32
UrbStartFrame
=
17
;
19
uint32
UrbCopyOfTransferFlags
=
18
;
20
uint32
IsoNumDesc
=
19
;
21
bytes
Payload
=
20
;
22
}
23
​
24
message
USBRequestBlockSetup
{
25
string
Timestamp
=
1
;
26
int32
RequestType
=
2
;
27
int32
Request
=
3
;
28
int32
Value
=
4
;
29
int32
Index
=
5
;
30
int32
Length
=
6
;
31
}
Copied!