Hello, guys, and welcome to another video in this chapter.
In this chapter, we are going to look into
how you can sniff the activity over USB interfaces that are connected to your
network, but when you install Wireshark, you're presented with the dialogue asking
if non secure users should be able to capture packets.
Unfortunately, this only applies to the regular networking
interfaces and doesn't apply to USB command that we are going to use
for this video so you can verify if you remember
of the group by using the ID command, no different Wireshark to start
seeing the USB inter faces, start capturing with Wireshark.
The activities are going on on this USB.
We need to we need to adjust some things.
So first of all adjust to the Wireshark group by running the
command sudo dot user SAN user wireshark you can see in front of you.
And to dump USB traffic, you need the usbmonx module.
So if it's not loaded yet, please run this command as route, modprobe usbmon,
and you should also give regular users privileges and make the USB Mon devices
readable by type in the below command to the setup and so on on your terminal.
So next step is to create a file.
The next step is to create a file named
99-usbmon.r ules in the Directory
provided in this slide to use the rules of that and you need to write the below.
The next step is you can use Nano or V command to create the following file.
99.usbmon. rules in the provided Directory.
You can see inside this file that you will
create you will displace the following device to access the usbmon commands.
you can see press control if you're using nano and.
Please save the file and exit.
Then run the command sudo udevadm control, dash, dash, reload-rules,
and then you can run the command sudo you divide trigger.
this command causes the dash USBmon files
to have a group of Wireshark rather than a group of root.
And if your root is a member of this Wireshark group,
you will be able to access the USBmon files without being the group user.
So next up, you need to use the command.
sudo.usbmon to load the USBmon module.
This is required to allow Wireshark to intersect USB traffic.
We can verify that the permissions are correct and you should see the device
nodes in the directory /dash/usbmon and have a group of Wireshark.
So for this video I prepared all these commands.
And let's go and check if the permissions are correct.
You to type ls space -l.
Then you provide the Directory.
So as you can see, all of the USBmon devices.
Will allow will have Wireshark group, so now we are ready.
So once you plug in a USB device in your laptop or your computer.
You determine which of the usbmon devices
to use by looking at the output unless USB.
This will provide
at least of all the USB devices that are connected to your machine.
So for the purpose of this video, I.
Plugged in my mobile phone, which is something phone
and what you need to pay attention in order to determine which usbmon number,
you're going to use from this one is being one three or four.
You need to take a look at the number provided in front of bus.
So in this case, I plugged in I said to my phone, which is Bus 004.
So in that case we're going to use the /dev/usbmon4 for that purpose.
Lets check it out.
Lets go ahead and use the command
modprobe usbmon
and then we can start Wireshark.
So as you can see, we have all the USB interfaces here, and this is the
USB interface that we want, as we said, USBmon4.
So now we can just go ahead and select the USBmon and start capturing.
And you can see that there will be data being recorded in Wireshark.
So let's just go ahead and
choose this, and you can see that the data will start being captured.
So now, if you can see there's nothing going on because my cell phone is idle,
so as long as they will start using the cell phone and create folders or copy
things, traffic will start coming here and will be captured by Wireshark.
But you can see I am in my home right now
and I can just go ahead and read the new folder.
That you can see there is traffic
going there is traffic going on, while I was creating that folder.
And I can go ahead and delete
the folder again, and you will see this traffic going on again.
So we can stop the capture now.
And now that we have finished capturing
the data and using our device, we can reduce the amount of data being presented
in this case, it wasn't so much data from our phone.
So if you want, you can go ahead and use
the filter that I'm going to type now into this play filter.
USB dot bus underscore ID equal sign.
And then the idea, said, we used the bus number four. USB four is usbmon four.
So you're going to use
four in your case if you go to USBmon is on five or six or three please
replace it, replace the number accordingly, and then you can use.
USB.
Bus ID equal equal sign and here you will place.
The number of the usbmon device USBmon
four like me, you need to put the number four on this bus ID if you use five and
six and so on, please, and replace the number accordingly.
So I'm going to type 4 here.
And then we can use the & sign
and then we can use the usb.
device underscore address.
Equal, equal sign.
So if we go back to our terminal.
You can see that our mobile.
Is, as we said, bus004 the device is 012.
So in the USB device address.
We are going to place the number 12 if your device is another number.
Please go ahead and replace accordingly.
So here we are going to place number 12 & sign and finally.
They're going to use the filter usb cap data.
So.
Go ahead, you hit enter.
So basically, this filter is going to show us all the received and send data so you
can go through each line and you can view all the information.
So that was it for this video.
I hope you get a very nice idea of how to intercept USB traffic and now when you're
ready, you can go ahead and click on the next video.
Where you going to learn how to use Wireshark to detect TCP delays.