Wireshark error: Network type 249 unknown or unsupported

[gaban]

Hi

 

I'm trying to get wireshark to read the pcap file generated by usbpcapcmd.exe or the sample_2013_04_10.pcap but this error was displayed:

"The file "usbpcap_sample_v2.pcap" is a capture for a network type that wireshark soesn't support (pcap:network type 249 unknown or unsupported)"

 

I'm using the latest version of Wireshark and has tried on 32-bit version of Windows Vista, as well as VM image of WinXP.

Do we need to install some plugin for wireshark to make this work?

 

Thank you.

 

Best regards,

faiz

[Tomasz Moń]

On Mon, Apr 22, 2013 at 12:52 PM, gaban <gab...@gmail.com> wrote:

I'm using the latest version of Wireshark and has tried on 32-bit version of Windows Vista, as well as VM image of WinXP.

Do we need to install some plugin for wireshark to make this work?

What do you mean by latest version? Please note that Wireshark 1.9.2 is not recent enough as the USBPcap patch was commited in revision 48847. There is currently no official Wireshark release that has USBPcap support.

You should use the automated build and/or compile from SVN/git.

[pd1ex...@gmail.com]

Tomasz, thanks for your above hint, it really helped me out.
Now, I am wondering why I just get the URB_INTERRUPPT In whatever I am doing, surfing with smartphone, sip, pop, etc.
Thanks,

[Tomasz Moń]

On Wed, May 15, 2013 at 9:41 AM, <pd1ex...@gmail.com> wrote:
> Tomasz, thanks for your above hint, it really helped me out.
> Now, I am wondering why I just get the URB_INTERRUPPT In whatever I am
> doing, surfing with smartphone, sip, pop, etc.
> Thanks,

Most likely you have a USB mouse connected to the hub you are monitoring.

[pd1ex...@gmail.com]

Many thanks Tomasz.

You are right, now I got the right usb-port. However, I was expecting being able to see a live tcpdump showing me all network protocols exchanged with the handset, but it just focuses on USB-protocolls. I dont see any http, etc.

Is my use case not appropriate for usbpcap?

Thanks again.

[Patrick Klos]

pd1ex...@gmail.com wrote:
> Many thanks Tomasz.
> You are right, now I got the right usb-port. However, I was expecting
> being able to see a live tcpdump showing me all network protocols
> exchanged with the handset, but it just focuses on USB-protocolls. I
> dont see any http, etc.
> Is my use case not appropriate for usbpcap?
> Thanks again.

I'd be interested in seeing a PCAP file with the packets (if you don't
mind sharing)? I'd like to see how TCP/IP packets are transported over
the USB link?

Patrick Klos
Klos Technologies, Inc.

[Tomasz Moń]

On Thu, May 16, 2013 at 10:08 AM, <pd1ex...@gmail.com> wrote:
> Many thanks Tomasz.
> You are right, now I got the right usb-port. However, I was expecting being
> able to see a live tcpdump showing me all network protocols exchanged with
> the handset, but it just focuses on USB-protocolls. I dont see any http,
> etc.
> Is my use case not appropriate for usbpcap?

If your device is of USB communications device class (USB CDC) then
Wireshark should feed the data transmitted over bulk endpoints to
ethernet dissector. Wireshark needs to know about device before doing
so though, so the capture file must contain USB descriptors.

If your device is of some other class, then you would have to add
appropriate dissector to Wireshark.