I'm looking at how MITM works on USB devices. This website states that:

Bulk transfers provide error correction in the form of a CRC16 field on the data payload and error detection/re-transmission mechanisms ensuring data is transmitted and received without error.

Presumably, if I wanted to modify some data (MITM) on a bulk transfer, I'd need to fix up the CRC16 as well.

Wireshark can be used to dump USB packets. Below is a captured USB "bulk in" packet.enter image description here

The packet data is provided here:

"\x40\x52\x59\x18\x53\x9d\xff\xff\x43\x03\x81\x06\x01\x00\x2d\x00" \
"\xe7\x2f\xa0\x62\x00\x00\x00\x00\x20\x2e\x0c\x00\x00\x00\x00\x00" \
"\xb7\x00\x00\x00\xb7\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00" \
"\x7f\x00\x04\x84\x00\x00\x0f\x80\x06\x00\x60\x00\x00\x30\x00\x00" \
"\x00\x00\x00\x00\x86\x21\xf2\x0e\x20\x1c\x00\x00\x37\xb8\x00\x01" \
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
"\x00\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\xff\xff\xff\xff" \
"\xff\xff\x64\x52\x99\x4f\x8a\xf0\xff\xff\xff\xff\xff\xff\x60\x00" \
"\x00\x07\x47\x72\x69\x66\x66\x65\x79\x01\x04\x02\x04\x0b\x16\x32" \
"\x08\x0c\x12\x18\x24\x30\x48\x60\x6c\x2d\x1a\x0c\x11\x18\xff\x00" \
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \
"\x00\x00\x00\x00\x00\x03\x01\x03\xdd\x09\x00\x10\x18\x02\x00\x00" \
"\x04\x00\x00\xdd\x1e\x00\x90\x4c\x33\x0c\x11\x18\xff\x00\x00\x00" \
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \

The Wireshark dissector doesn't point out a checksum. This leads me to believe the checksum is at the end of the "Leftover Capture Data". I can't seem to regenerate the last two bytes as a matching CRC16.

Am I wrong in trying to generate the checksum from leftover_data[:-2]?

Is the checksum present in the capture?

Is the checksum in another packet?

Do Wireshark USB captures even record the checksum?

1 Answer 1


You are apparently using a software capture, usbmon rather than a hardware capture such as OpenVizla, so the CRC is not going to be visible to you. See the USB Analysis 101 video by Tomasz Moń for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.