Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Sept/Oct 2019 Issue of The NT Insider available


Download PDF here: http://insider.osr.com/2019/ntinsider_2019_01.pdf

It’s a particularly BIG issue, too: 40 pages of technical goodness, ranging from WDF to Minifilters. Check it out.
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

USB DeviceAddress

George_BittencourtGeorge_Bittencourt Member - All Emails Posts: 5

Hello,

I am using the USBPcap library to capture USB packets from selected devices.
When reading packets captured by the library we use the device address to do some filtering.

In some cases this adress changes and we endup capturing the wrong device.
After some research I found that this device address is set by Windows during device enumeration.

My question is: can Windows change this device address after it was set for the first time?
I know it might change during reboots, but once the device is conected and Windows is up can it change?

Thanks,

-George

Comments

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 7,413

    but once the device is conected and Windows is up can it change?

    This isn’t a “Windows” thing... it’s a USB specification thing.

    The address is established during the connection/enumeration phase for the device (gad... I can’t remember the precise USB term for this... perhaps Mr. Roberts, who is usually up on all things USB will inform us). The address will only change if the device is logically or physically disconnected and re-connected.

    As I always do, I have to ask: Why not use a “real” USB bus analyzer... one that plugs into the USB bus at the hardware level? They’re inexpensive... and I have learned never to trust the software trace tools.

    Peter

    Peter Viscarola
    OSR
    @OSRDrivers

  • Tim_RobertsTim_Roberts Member - All Emails Posts: 13,068
    via Email
    Peter_Viscarola_(OSR) wrote:
    >> but once the device is conected and Windows is up can it change?
    > This isn’t a “Windows” thing... it’s a USB specification thing.
    >
    > The address is established during the connection/enumeration phase for the device (gad... I can’t remember the precise USB term for this... perhaps Mr. Roberts, who is usually up on all things USB will inform us).

    Enumeration is the correct term.  See?  You never forget.


    > The address will only change if the device is logically or physically disconnected and re-connected.

    That is exactly correct.  If the device address changed, then something
    must have caused the bus to trigger another enumeration.

    Tim Roberts, [email protected]
    Providenza & Boekelheide, Inc.

  • Michal_VodickaMichal_Vodicka Member - All Emails Posts: 53
    via Email
    > -----Original Message-----
    > From: Peter_Viscarola_(OSR) [mailto:osr+d290725-
    > [email protected]]
    > Sent: Wednesday, October 24, 2018 9:35 PM
    > To: Michal_Vodicka
    > Subject: Re: [NTDEV] USB DeviceAddress
    >
    > As I always do, I have to ask: Why not use a “real” USB bus analyzer... one
    > that plugs into the USB bus at the hardware level? They’re inexpensive...
    > and I have learned never to trust the software trace tools.

    I just need one and the company complains about price... do you have some tip for inexpensive and still usable one? I used Ellisys 200 for years but I think we paid less than current basic price for professional edition then. I guess they tripled price, maybe more. Currently standard edition which is minimal usable for me costs 1600 Euro (not USD) which doesn't seems like inexpensive for me.

    Michal
  • Paul_AttrydePaul_Attryde Member Posts: 12

    Michal, having been recently comparing HW traces from an Ellisys to viewing data captured by a software trace (usbpcap on linux, but still viewing it in Wireshark) I'll confirm Peter's comments about not trusting software data. Not that it's outright wrong, it's just so incomplete; things happen in USB land that (for me) the software traces just can't capture.

    I agree that 1600 Euro on it's is not cheap, but when you compare it to the prices that some other vendors (IE, CATC) charge it's a drop in the bucket.

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 7,413

    I love the Ellisys analyzers (though you do see the LeCroy/CATC a lot). Like a lot of electronics, the price in Euros seems to be the same numerical price as the price in USD. The Standard edition is currently US$1599 -- which I don't consider to be that expensive. When an MSDN Professional (CLOUD) subscription is US$800 per year, I consider the cost of the hardware analyzer to be a relative bargain.

    Then again, getting Dan to approve a hardware purchase here at OSR doesn't exactly require super-human effort. Though, he did draw the line at my purchasing a LeCroy PCIe x8 bus analyzer... the bastard made me borrow one instead.

    Peter Viscarola
    OSR
    @OSRDrivers

  • Michal_VodickaMichal_Vodicka Member - All Emails Posts: 53
    via Email
    Paul,

    I completely agree hw analyzer is better than any software level trace, although I had cases when sw was useful, too. Because I could see IRPs/URBs and problem at software level. But if I have to choose, I'd definitely prefer hw one.

    I've never liked CATC. Ridiculously expensive, logs hard to read, incompatible formats among their versions, annoying obstructions when I needed their sw just to see the log somebody else sent me... Ellisys was good and cheap, I had both 100 and 200 versions, but it isn't cheap anymore.

    Michal
  • Michal_VodickaMichal_Vodicka Member - All Emails Posts: 53
    via Email
    > Like a lot of electronics, the price in Euros seems to be the same numerical price as
    > the price in USD.

    Not only electronics...

    > The Standard edition is currently US$1599 -- which I don't
    > consider to be that expensive.

    It isn't a disaster but it isn't so easy to explain it to people who approve it. OK, I just hoped you know about some really inexpensive one as Ellisys used to be in the past.

    Michal
  • DianeDiane Member - All Emails Posts: 14

    There are other analyzers besides Teledyne LeCroy and Ellisys, so if cost is a concern you might want to look at one of those smaller companies. What speed is your device? The slower the device, the cheaper the analyzer...

    Also, if you are connected to an xHCI controller, hardware determines the device address. For EHCI, the driver does that.

    Diane

  • Michal_VodickaMichal_Vodicka Member - All Emails Posts: 53
    edited October 2018 via Email
    > There are other analyzers besides Teledyne LeCroy and Ellisys, so if cost is a
    > concern you might want to look at one of those smaller companies. What
    > speed is your device? The slower the device, the cheaper the analyzer...

    The current device is full speed so Beagle USB 12 should be sufficient but for the future it'd be better to have high speed analyzer. I found http://www.internationaltestinstruments.com/products/97-1480a-usb-20-protocol-analyzer.aspx which is really cheap. I already have some logs from it and they look usable. Software looks rather similar to Ellisys one. However, their web doesn't look very maintained and previously my antivirus complained about it (now it doesn't).

    Any experience/recommendation with LeCroy and Ellisys alternatives?

    Michal
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Writing WDF Drivers 21 Oct 2019 OSR Seminar Space & ONLINE
Internals & Software Drivers 18 Nov 2019 Dulles, VA
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 27 Apr 2020 OSR Seminar Space & ONLINE