Open MSLaaf opened 6 years ago
Output from USPPcapCMD:
following filter control devices are available: \.\USBPcap4 \??\USB#ASMEDIAROOT_Hub#5&7235832&1&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} [Port 3] USB Composite Device Logitech USB Input Device HID Keyboard Device USB Input Device HID-compliant mouse HID-compliant consumer control device HID-compliant device HID-compliant device Logitech Unifying USB receiver Logitech HID-compliant Unifying device HID-compliant device HID-compliant device Logitech HID-compliant Unifying device Logitech HID-compliant Unifying Mouse Logitech Driver Interface Logitech Driver Interface Logitech HID-compliant Unifying device Logitech HID-compliant Unifying keyboard Logitech Driver Interface HID-compliant consumer control device HID-compliant device \.\USBPcap1 \??\USB#ROOT_HUB20#4&f432ec7&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} [Port 1] Generic USB Hub \.\USBPcap2 \??\USB#ROOT_HUB20#4&144fac0d&0#{f18a0e88-c30c-11d0-8815-00a0c906bed8} [Port 1] Generic USB Hub \.\USBPcap3 \??\IUSB3#ROOT_HUB30#4&318a7e80&1#{f18a0e88-c30c-11d0-8815-00a0c906bed8} [Port 5] USB 2.0 MTT Hub [Port 3] USB Input Device HID-compliant device [Port 9] USB Input Device HID-compliant device [Port 11] USB Mass Storage Device XM-35U CF PRO Reader USB Device XM-35U SD PRO Reader USB Device XM-35U XD PRO Reader USB Device XM-35U MS PRO Reader USB Device XM-35U mSD PRO Reader USB Device [Port 12] Crystalfontz CFA635-USB Crystalfontz CFA635-USB (COM3) [Port 14] American Power Conversion USB UPS APC UPS select filter to monitor (q to quit):
Try starting elevated cmd prompt and run "USBPcapCMD -I" in it. If it find non standard HWID that looks like the virtual hub then it should be possible to capture from it after reboot.
If not, then try to find the hardware id of the virtual root hub in device manager. It might be easiest to sort the tree by connection (default is by type). I am not sure if the "Network Scanner Driver" is functioning as a controller or root hub - it will be apparent after you sort by connection.
(Possible alternative: How are you physically connecting to the device? Is it via network? If this is the case, it might be possible to write dissector for this usb over ip implementation.)
HP used hardware / software from EdiMax (and didn't release OSS for it - even though it shows linux) to redirect windows(only) usb traffic to a ScanJet N6350 scanner. It shows as a USB device in the system, but there is a software (virtual) driver installed simulating a HUB. I do not see it in USBPCap 1..4, yet it's clearly a USB driver. They transport the data over UDP to/from the scanner, so it would be nice to see the actual USB traffic on the windows workstation and the resulting IP traffic... Problem is that HP has NOT released SANE drivers to support this scanner on Linux.
Network Scanner Driver
HP Scanjet N6350
I don't know enough about windows driver development to support this device. Is it possible to do so?
N6350_Drivers.pdf