Packet structure

+-------------------------------------------+
|                  URB ID                   |
|                (8 Octets)                 |
+-------------------------------------------+
|                 Event type                |
|                  (1 Octet)                |
+-------------------------------------------+
|                Transfer type              |
|                  (1 Octet)                |
+-------------------------------------------+
|   Endpoint number and transfer direction  |
|                  (1 Octet)                |
+-------------------------------------------+
|               Device address              |
|                  (1 Octet)                |
+-------------------------------------------+
|                 Bus number                |
|                 (2 Octets)                |
+-------------------------------------------+
|                 Setup flag                |
|                  (1 Octet)                |
+-------------------------------------------+
|                  Data flag                |
|                  (1 Octet)                |
+-------------------------------------------+
|             Timestamp, seconds            |
|                 (8 Octets)                |
+-------------------------------------------+
|          Timestamp, microseconds          |
|                 (4 Octets)                |
+-------------------------------------------+
|                   Status                  |
|                 (4 Octets)                |
+-------------------------------------------+
|                Data length                |
|                 (4 Octets)                |
+-------------------------------------------+
|             Delivered data length         |
|                 (4 Octets)                |
+-------------------------------------------+
|        Setup/isochronous information      |
|                 (8 Octets)                |
+-------------------------------------------+
|                  Payload                  |
.                                           .
.                                           .
.                                           .

Description

A packet corresponds either to a URB submitted to the USB subsystem, a completion report for a URB, or an error report for a URB.

All fields are in host byte order:

• When performing a live capture, the host byte order is the byte order of the machine on which the packets are being captured.

• When reading a pcap file, the host byte order is the byte order for the file, as specified by the file's magic number.

• When reading a pcapng file, the host byte order is the byte order for the section of the pcapng file in which the packet appears, as specified by that section's Section Header Block.

The URB ID field is a unique ID for the URB to which this packet refers.

The event type field is an ASCII character that indicates the type of the event; it is:

• 'S' (0x53), if the event is a submission of a URB;
• 'C' (0x43), if the event is a completion report for a URB;
• 'E' (0x45), if the event reports an error from a URB submission.

The transfer type field has a value that is one of:

• 0, if the transfer to which the URB applies is a isochronous transfer;
• 1, if the transfer to which the URB applies is a interrupt transfer;
• 2, if the transfer to which the URB applies is a control transfer;
• 3, if the transfer to which the URB applies is a bulk transfer.

The uppermost bit of the endpoint number and transfer direction field is 1 if the transfer is an input transfer and 0 if it is an output transfer. The lowr 7 bits of the field contain the endpoint number.

The setup flag field is zero if the event is a submission of a URB for a control transfer and non-zero otherwise.

The data flag field is zero if the event contains data and non-zero if it contains no data.

The timestamp fields contain a time stamp for the event, in seconds and microseconds since 1970-01-01 00:00:00 UTC; this MUST be the same as the timestamp for the packet.

The status field contains zero if no error is being reported by the event or the negative of a Linux errno value for the error being reported if an error is being reported by the event.

If the setup flag is zero, the setup/isochronous informration field contains the setup data for a setup packet, as specified in the USB standard.

If the setup flag is non-zero, and the transfer is an isochronous transfer, the setup/isochronous information field contains:

+----------------------------------------+
|              Error count               |
|               (4 Octets)               |
+----------------------------------------+
|         Number of descriptors          |
|               (4 Octets)               |
+----------------------------------------+

where the error count field is the number of errors in the isochronous transfer and the number of descriptors field is the number of isochronous descriptors for the transfer.

If the setup flag is non-zero, and the transfer is not an isochronous transfer, the setup/isochronous information field does not contain any information and should be ignored.

The data, if any, for the event follows the setup/isochronous information field.