First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

how can i search a binary pattern in USB data capture?

  • retag add tags

When I use Edit->Find Packets, it looks for patterns in headers/Frame, too.

I just need to search within USB URB->Leftover Capture Data:

xc's avatar
1
xc
asked 2023-09-22 14:11:05 +0000
edit flag offensive 0 remove flag close merge delete

Comments

(Sample capture on Wiki: USB Link Layer SB1240-via-hub_usbll.7z contains SB1240-via-hub-FS-link-filtered.pcap)

Is it just finding the packets or is the data so large you have to search within it?

usb.capdata contains "\x00\x00\x0c" works with the sample file mentioned above.

Chuckc's avatar Chuckc (2023-09-22 16:32:12 +0000) edit
more
  • delete
add a comment see more comments

1 Answer

0

My USB captures has over 20000 packets, each packet contains frame info and the payload. I just need to search thru the payload, when Edit->Find Packet... using hex value, say 00, it will find a lot of 00 in the frame/header area in the first packet

For example, here is a screen capture of Wireshark: https://www.dataq.com/temp/glitch.jpg

I wish to search the area in blue of all captured packets, but if I use Edit->Find Packet... to find 00, the red 00 in the frame/header area in the first packet

xc's avatar
1
xc
answered 2023-09-22 16:47:00 +0000, updated 2023-09-22 17:06:46 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer