> For the complete documentation index, see [llms.txt](https://docs.netcap.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.netcap.io/v0.4.1/usb-capture.md).

# USB Capture

## Live Capture

USB live capture is now possible, currently the following Audit Records exist: USB and USBRequestBlockSetup.

To capture USB traffic live on macOS, install wireshark and bring up the USB interface:

```
$ sudo ifconfig XHC20 up
```

Now attach netcap and set baselayer to USB:

```
$ net.cap -iface XHC20 -base usb
```

## Offline from dumpfile

To read offline USB traffic from a PCAP file use:

```
$ net.cap -r usb.pcap -base usb
```

Don't forget to set the **-payload** flag if you want to preserve the data being transmitted!