A low-cost USB sniffer that plugs into Wireshark as an interface

What the board actually captures

The sniffer sits between a USB host and a device and records the traffic crossing that link. The README describes it as a low-cost LS/FS/HS sniffer with a Wireshark interface, which means it covers low speed, full speed and high speed devices.

What you do with the data is ordinary protocol analysis. The tool can be run standalone from a command line, or installed as a plugin for Wireshark with direct control from the user interface, and in both cases the capture is saved in standard PcapNG format. That last point is the important design decision: because the output is PcapNG, a capture can be opened by any tool that reads that format, shared with a colleague, or compared against a capture taken on a different machine.

Three example capture files are published with the project, which is a useful way to see the output before ordering boards: a low-speed mouse, a full-speed virtual COM-port adapter, and a high-speed USB flash drive. The README also notes that a recent Wireshark, version 4.x, is needed, since older versions may not decode the USB payload but should still show the raw data.

The parts: an MCU, an FPGA and a USB PHY

The hardware is built around three named components. The Cypress CY7C68013A is the microcontroller, the Lattice LCMXO2 is the FPGA, and the Microchip USB3343 provides the USB physical layer.

Prices and availability of the integrated circuits vary, and the README states that the total bill of materials should be less than 50 dollars. That figure is the number to hold on to when comparing this against a commercial USB analyser, because everything else in the design is ordinary and the FPGA is what turns the board into a sniffer rather than a pass-through hub.

There is a specific constraint on the FPGA. The LCMXO2-2000HC speed grades 5 and 6 were tested, and the provided JED file was built for speed grade 5, so it should work for both. Speed grade 4 is too slow and does not meet the timing requirements. In other words, the bitstream shipped with the project targets grade 5, and buying the cheapest part is buying a part that will not work at the stated speed, however similar its part number looks.

Sourcing the parts, the board and the case

The README is unusually direct about sourcing, and the warning is worth heeding. Do not buy the CY7C68013A from eBay or AliExpress, because they are said to be either fake or sketchy in some way. The IC can be quite expensive from regular suppliers, and LCSC is named as a legitimate supplier that often has it at much cheaper prices.

For the board itself, PCBs can be ordered from OSH Park or any other PCB manufacturer, and the gerber files are provided as bin/usb-sniffer-gerbers.zip. There are also STL files for the case, so the enclosure is a 3D print rather than a purchase.

The result is that the whole device is reproducible: the design files, the FPGA bitstream, the firmware and the enclosure are all in the repository, and what you supply is a soldering iron, a fab run and the components. That is a fair amount of work for a tool that captures traffic, and it is the reason the pre-built binaries for the software are provided separately, so at least the capture side needs no build step.

Bringing the board up in three programming steps

The hardware needs no external programmer, since both the MCU and the FPGA are programmed over the USB interface itself. The bring-up sequence is three commands, and each one has a visible consequence.

First the firmware is loaded into the MCU SRAM:

./usb_sniffer --mcu-sram usb_sniffer.bin

The device resets and enumerates as a USB Sniffer with a dummy serial number. The EEPROM is then programmed:

./usb_sniffer --mcu-eeprom usb_sniffer.bin

After a reset or power cycle the device enumerates as a USB Sniffer with a real serial number, and because that number is derived from the FPGA unique identifier, a successful step also confirms the FPGA is functional. The last step programs the FPGA flash:

./usb_sniffer --fpga-flash usb_sniffer_impl.jed

The MCU EEPROM can be reprogrammed at any time as long as the board is running valid firmware. Two platform notes come before all of this. On Windows, a board with a blank EEPROM enumerates as an unknown USB device, and the supplied dummy INF file should be used as a driver so it associates with a generic WinUSB driver and is recognised by the tools. On Linux, copy 90-usb-sniffer.rules to /etc/udev/rules.d to set the permissions that let a regular user access the device.

Recovery when the firmware is corrupted, and the link test

Because the MCU is programmed through the USB interface, a corrupted firmware image can leave a board that no longer enumerates. The recovery path is documented and mechanical: run the MCU in the unconfigured mode by shorting the BOOT and VCC test points, located near the EEPROM IC on the board, and resetting the device. Both programming steps then have to be repeated to bring the board back to a working state.

For checking the connection between the MCU and the FPGA, there is a self-test:

./usb_sniffer --test

The expected result is 40 to 50 MB/s. If the speed is significantly slower, the advice is to connect the sniffer directly into the root USB port without intermediate hubs, which points at the likely cause, since a hub in between adds a bottleneck the tool cannot work around. The README recommends running this test after any significant change to the hardware setup, which makes it a useful baseline number to record before and after swapping cables or ports.

Installing the interface into Wireshark

Pre-built binaries are provided for Linux and Windows, named usb_sniffer_linux and usb_sniffer_win.exe. To use it with Wireshark, the file goes into the extcap plugin directory. The typical locations given are ~/.local/lib/wireshark/extcap on Linux and C:/Users/<user>/AppData/Roaming/Wireshark/extcap/ on Windows, and the exact path is available in the Wireshark interface under Help, then About Wireshark, then Folders, then Personal Extcap path. On Linux the binary also needs its executable attribute set.

Once installed, refreshing the list of interfaces in Wireshark shows USB Sniffer among them. The settings icon next to the interface name opens a dialog where you configure the capture speed, empty frame folding, the trigger type and a limit on the number of captured packets, where 0 means unlimited. After that, starting and stopping the capture works exactly as with any other interface, and the result is a PcapNG file that can be saved, reopened and shared.

What this board does not do, and what to check before ordering

The honest limits are visible in the design. This is a traffic capture tool for a USB link, not a protocol analyser with decoding of every class, and the README is explicit that USB payload decoding depends on a recent Wireshark 4.x. It records what crosses the link between a host and a device, which means it is a debugging and analysis instrument for your own equipment rather than something that can inspect traffic on an arbitrary bus.

The practical prerequisites are also real. You need a soldering setup and the willingness to assemble a board from gerbers, the correct LCMXO2 speed grade, a genuine CY7C68013A from a reputable supplier, and a 3D print or equivalent for the case. The whole build is under 50 dollars in components, and the cost is the assembly time rather than the parts.

Before ordering, three checks will save an afternoon: confirm the FPGA part number is grade 5 or 6, source the MCU from a supplier the README trusts, and check that the FPGA bitstream you will flash is the JED file shipped in the project rather than one you build yourself, since the timing requirement at grade 5 is the constraint the whole design sits on.

Editorial conclusion

This sniffer suits an engineer who needs to see the traffic crossing a USB link between their own host and device and who is prepared to solder a board from published gerbers. It is the wrong choice for a finished analyser you can buy, for anyone who needs USB 3 SuperSpeed traffic, which the LS, FS and HS design does not cover, and for anyone who cannot source a genuine CY7C68013A. Verify first that the LCMXO2 you buy is speed grade 5 or 6, that your Wireshark is version 4.x so the payload decodes, and that the link test reaches 40 to 50 MB/s before you trust a capture you intend to analyse.

Frequently asked questions

Official sources

1. ataradov/usb-sniffer on GitHub
2. Issues
3. License: BSD-3-Clause
4. README