USB logging


USB logging only worked sufficiently well when Windows 98 was run under Linux via the virtualizer VirtualBox from Sun. It was posible to sniff USB communication even when the device split into two or three addresses.

Other methods that were tried and found insufficient were:

  • SniffUSB, a Windows program that logs USB traffic.
    It was unstable, and confused the device into 2 devices, of which it was unable to log anything sensible.
  • Qemu a virtualization program.
    The USB device reacted partially correct only once, so there was too little too early to log.
  • VMWare a virtualization program.
    Never got any USB reaction at all with this USB device.


    I have an old USB device, a "Logitech WingMan Force Feedback Mouse" that I want to use under Linux, but there are no drivers for it, no documentation, and no source code. Windows do not support it any more. The only way to get it to do its stuff is to fire up Windows 98 on an old machine and install the original mouse drivers and programs.

    Unfortunately, it turned out to be exceedingly difficult to sniff its USB communication, but I persevered, and perspired, for over a week of real work time, but succeeded, and now I share the method here, since I know others have similar problems for other USB devices.

    If you want a copy of this sniffed log, its here.
    If you decode it, or write a program for the mouse, please tell me:
    Force feedback mouse


    VirtualBox was installed with Windows 98 under Linux, and was run as root to get easy access to the USB devices in Linux. (Yes, I know this is horribly security wise, but I tried it the "correct" way first, and it was just too much bother.)

    The drivers and programs for the device was installed under this virtual Windows machine, and then it worked like it did under a real machine. The machine was then shut down.

     cat /sys/kernel/debug/usbmon/3u 
    was then used to start the logging from the USB port, and the virtual machine was turned on, and when it had booted, the USB device was connected, and used for a while.

    This turned out to give an excellent log.
    See for detailed documentation of how to do the actual USB sniffing.


    2009.10.24 First draft.
    2010.01.08 Picture and sniffed log added.