WireShark是個非常不錯的工具，現在的版本已經集成了測試USB抓包的工具USBPcap，該工具官網在，
抓包的格式在這裏有說明
https://desowin.org/usbpcap/captureformat.html
具體內容我附在後面，方便查找。
重點要注意的是，USBPcap pseudoheader（僞頭）不屬於發送內容部分，是USBPcap控制程序的部分，這個Pseudoheader後面的部分，纔是真正要發送或接收到的內容。這也是很多人剛開始抓包的時候，主要讓人迷糊的地方。
例子如下，
這個例子裏面，USB URB 就是這個Pseudoheader，佔0x1C=28個字節，後面的80060001 00001200纔是真正發送的內容，也就是URB setup。
同樣，下面這個例子裏面，
前面28個字節也是Pesudoheader，不屬於發送內容，真正從USB-device接收到的內容是後在的18個字節。這個內容就不解釋了，USB規範2.0表（Table 9-8. Standard Device Descriptor）中已有詳細規定，下載地址在這裏,
https://usb.org/sites/default/files/usb_20_20190524.zip
如果你對這些包的內容的發送與解析感興趣，建議參考
https://docs.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-control-transfer
例如TOKEN PACKET的格式是這樣的，
注意：一般（如HANDSHAKE PACKET/TOKEN PACKET/DATA PACKET）的包中的某些信息SYN/PID/EOP等等信息，一般情況下在硬件底層會自動處理掉，不會涉及到操作系統的層次，在我們用單片機編程時，一般也不會涉及。
USBPcap Capture format specification.
https://desowin.org/usbpcap/captureformat.html
Following document describes the LINKTYPE_USBPCAP used in USBPcap. This merely describes the packet data mentioned in pcap file format.
General notes
The types presented below are described in Windows DDK 7.1.0. Short description:
-
UCHAR - 8 bit unsigned value
-
USHORT - 16 bit unsigned value
-
UINT32 - 32 bit unsigned value
-
UINT64 - 64 bit unsigned value
-
ULONG - 64 bit unsigned value
-
USBD_STATUS - 32 bit unsigned value
All multi-byte values are LITTLE-ENDIAN.
Base packet header
The USBPCAP_BUFFER_PACKET_HEADER as defined in USBPcapBuffer.h:
#pragma pack(1)
typedef struct
{
USHORT headerLen; /* This header length */
UINT64 irpId; /* I/O Request packet ID */
USBD_STATUS status; /* USB status code
(on return from host controller) */
USHORT function; /* URB Function */
UCHAR info; /* I/O Request info */
USHORT bus; /* bus (RootHub) number */
USHORT device; /* device address */
UCHAR endpoint; /* endpoint number and transfer direction */
UCHAR transfer; /* transfer type */
UINT32 dataLength;/* Data length */
} USBPCAP_BUFFER_PACKET_HEADER, *PUSBPCAP_BUFFER_PACKET_HEADER;
-
headerLen (offset 0) describes the total length, in bytes, of the header (including all transfer-specific header data).
-
irpId (offset 2) is merely a pointer to IRP casted to the UINT64. This value can be used to match the request with respons.
-
status (offset 10) is valid only on return from host-controller. This field corrensponds to the Status member of _URB_HEADER
-
function (offset 14) corrensponds to the Function member of _URB_HEADER
-
info (offset 16) is descibed on the bit-field basis. Currently only the least significant bit (USBPCAP_INFO_PDO_TO_FDO) is defined: it is 0 when IRP goes from FDO to PDO, 1 the other way round. The remaining bits are reserved and must be set to 0.
-
bus (offset 17) is the root hub identifier used to distingush between multiple root hubs.
-
device (offset 19) is USB device number. This field is, contary to the USB specification, 16-bit because the Windows uses 16-bits value for that matter. Check DeviceAddress field of USB_NODE_CONNECTION_INFORMATION
-
endpoint (offset 21) is the endpoint number used on the USB bus (the MSB describes transfer direction)
-
transfer (offset 22) determines the transfer type and thus the header type. See below for details.
-
dataLength (offset 23) specifies the total length of transfer data to follow directly after the header (at offset headerLen).
Transfer-specific headers
All transfer-specific headers inherit the USBPCAP_BUFFER_PACKET_HEADER, so first there is the USBPCAP_BUFFER_PACKET_HEADER, then (if any) additional transfer-specific header data and then the transfer data.
USBPCAP_TRANSFER_ISOCHRONOUS
When transfer is equal to USBPCAP_TRANSFER_ISOCHRONOUS (0) the header type is USBPCAP_BUFFER_ISOCH_HEADER
/* Note about isochronous packets:
* packet[x].length, packet[x].status and errorCount are only relevant
* when USBPCAP_INFO_PDO_TO_FDO is set
*
* packet[x].length is not used for isochronous OUT transfers.
*
* Buffer data is attached to:
* * for isochronous OUT transactions (write to device)
* Requests (USBPCAP_INFO_PDO_TO_FDO is not set)
* * for isochronous IN transactions (read from device)
* Responses (USBPCAP_INFO_PDO_TO_FDO is set)
*/
#pragma pack(1)
typedef struct
{
ULONG offset;
ULONG length;
USBD_STATUS status;
} USBPCAP_BUFFER_ISO_PACKET, *PUSBPCAP_BUFFER_ISO_PACKET;
#pragma pack(1)
typedef struct
{
USBPCAP_BUFFER_PACKET_HEADER header;
ULONG startFrame;
ULONG numberOfPackets;
ULONG errorCount;
USBPCAP_BUFFER_ISO_PACKET packet[1];
} USBPCAP_BUFFER_ISOCH_HEADER, *PUSBPCAP_BUFFER_ISOCH_HEADER;
USBPCAP_TRANSFER_INTERRUPT
When transfer is equal to USBPCAP_TRANSFER_INTERRUPT (1) the header type is USBPCAP_BUFFER_PACKET_HEADER
USBPCAP_TRANSFER_CONTROL
When transfer is equal to USBPCAP_TRANSFER_CONTROL (2) the header type is USBPCAP_BUFFER_CONTROL_HEADER
/* USBPcap versions before 1.5.0.0 recorded control transactions as two
* or three pcap packets:
* * USBPCAP_CONTROL_STAGE_SETUP with 8 bytes USB SETUP data
* * Optional USBPCAP_CONTROL_STAGE_DATA with either DATA OUT or IN
* * USBPCAP_CONTROL_STAGE_STATUS without data on IRP completion
*
* Such capture was considered unnecessary complex. Due to that, since
* USBPcap 1.5.0.0, the control transactions are recorded as two packets:
* * USBPCAP_CONTROL_STAGE_SETUP with 8 bytes USB SETUP data and
* optional DATA OUT
* * USBPCAP_CONTROL_STAGE_COMPLETE without payload or with the DATA IN
*
* The merit behind this change was that Wireshark dissector, since the
* very first time when Wireshark understood USBPcap format, was really
* expecting the USBPCAP_CONTROL_STAGE_SETUP to contain SETUP + DATA OUT.
* Even if Wireshark version doesn't recognize USBPCAP_CONTROL_STAGE_COMPLETE
* it will still process the payload correctly.
*/
#define USBPCAP_CONTROL_STAGE_SETUP 0
#define USBPCAP_CONTROL_STAGE_DATA 1
#define USBPCAP_CONTROL_STAGE_STATUS 2
#define USBPCAP_CONTROL_STAGE_COMPLETE 3
#pragma pack(1)
typedef struct
{
USBPCAP_BUFFER_PACKET_HEADER header;
UCHAR stage;
} USBPCAP_BUFFER_CONTROL_HEADER, *PUSBPCAP_BUFFER_CONTROL_HEADER;
Where stage determines the control transfer stage.
USBPCAP_TRANSFER_BULK
When transfer is equal to USBPCAP_TRANSFER_BULK (3) the header type is USBPCAP_BUFFER_PACKET_HEADER