The linux ker­nel has a facil­ity called “usb­mon” which can be used to sniff the USB bus. It’s been in there for ages, and the out­put is really easy to col­lect, even from the com­mand line shell. Sim­ply mount debugfs and ins­mod the usb­mon module:

mount -t debugfs none_debugs /sys/kernel/debug
modprobe usbmon

Then you can just cat USB traf­fic like this:

cat /sys/kernel/debug/usbmon/1u
 Read more...